Add exploit for IBM DRM RCE (CVE-2020-4427, CVE-2020-4428, CVE-2020-4429) #13300

pedrib · 2020-04-21T08:51:59Z

This PR adds an exploit for an unauthenticated remote code execution as root in IBM Data Risk Manager. This is a 0day at the time of this PR, check:
https://github.com/pedrib/PoC/blob/master/advisories/IBM/ibm_drm/ibm_drm_rce.md

See also: #13301 and #13304.

vvv

here we go

ready to go

pedrib · 2020-04-21T10:12:38Z

I am waiting on the CVE IDs, but please go ahead with the review while we wait.

gwillcox-r7 · 2020-04-21T16:59:18Z

Added needs-testing label as from looks of things, only those with an active service contract can download the IBM DRM software.

pedrib · 2020-04-21T17:05:00Z

@gwillcox-r7 I can send pcaps if needed, same for PR #13301

gwillcox-r7 · 2020-04-21T17:36:43Z

@gwillcox-r7 I can send pcaps if needed, same for PR #13301

If you can send PCAPs for both this PR and for #130001 to msfdev[at]metasploit.com this would greatly assist our team in helping to confirm info. Thanks!

gwillcox-r7 · 2020-04-21T21:28:23Z

@pedrib If you could also send a demo of both of the modules to the same email address this would also be helpful.

pedrib · 2020-04-22T08:33:52Z

@gwillcox-r7 a demo? Like an asciinema cast?

acammack-r7

Thanks for bringing us to the 0-day party! Detection seems a bit wobbly, though, and I think we would want to properly parse the JSON responses instead of just using regexes. I think there are also some code styling things that rubocop -a can help fix.

modules/exploits/linux/http/ibm_drm_rce.rb

pedrib · 2020-04-24T03:21:19Z

@acammack-r7 all done, and thanks for showing me rubocop, will use it from now on on all my submissions.

I'm still waiting for those CVE, do you mind waiting or want to merge these PR now? If so I can send you the pcaps

wvu · 2020-04-28T06:56:14Z

Are you still waiting for CVEs?

modules/exploits/linux/http/ibm_drm_rce.rb

pedrib · 2020-04-28T07:14:07Z

@wvu-r7 all done. Yes I am still waiting, there's emails back and forth between myself and MITRE. Seems like IBM are the ones that have to issue CVE for their own product, and they are making me wait... I wonder why

pedrib · 2020-04-30T04:17:59Z

Guys, I have removed all CVE and other TODO-links from these modules to get them ready for merging.
I will add all the info later (CVE, more advisory / vendor links, confirm affected versions). IBM is not responding to me at the moment, so once they do I'll send another PR.

I have sent pcaps to your email address.
This comment also applies to PR #13301 and #13304 .

pedrib · 2020-05-01T03:19:11Z

@wvu-r7 finally we have CVE! Added them to this module and PR #13301 + PR #13304

modules/exploits/linux/http/ibm_drm_rce.rb

wvu

Reviewed module doc.

documentation/modules/exploit/linux/http/ibm_drm_rce.md

wvu

Code reviewed. If I missed anything, apply comments everywhere they apply.

modules/exploits/linux/http/ibm_drm_rce.rb

pedrib · 2020-05-05T06:21:15Z

ok all done!

wvu · 2020-05-05T15:49:41Z

Squashed and rebased!

Update documentation/modules/exploit/linux/http/ibm_drm_rce.md Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com> Update documentation/modules/exploit/linux/http/ibm_drm_rce.md Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com> Update documentation/modules/exploit/linux/http/ibm_drm_rce.md Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com> Update ibm_drm_rce.md Update modules/exploits/linux/http/ibm_drm_rce.rb Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com> Update modules/exploits/linux/http/ibm_drm_rce.rb Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com> Update modules/exploits/linux/http/ibm_drm_rce.rb Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com> Update modules/exploits/linux/http/ibm_drm_rce.rb Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com> Update modules/exploits/linux/http/ibm_drm_rce.rb Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com> Update modules/exploits/linux/http/ibm_drm_rce.rb Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com> Update modules/exploits/linux/http/ibm_drm_rce.rb Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com> make final changes! Update modules/exploits/linux/http/ibm_drm_rce.rb Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com> Update modules/exploits/linux/http/ibm_drm_rce.rb Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com> Update modules/exploits/linux/http/ibm_drm_rce.rb Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com> Update modules/exploits/linux/http/ibm_drm_rce.rb Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com> Update modules/exploits/linux/http/ibm_drm_rce.rb Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com> Update modules/exploits/linux/http/ibm_drm_rce.rb Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com> Update modules/exploits/linux/http/ibm_drm_rce.rb Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com> Update modules/exploits/linux/http/ibm_drm_rce.rb Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com> Update modules/exploits/linux/http/ibm_drm_rce.rb Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com> Update modules/exploits/linux/http/ibm_drm_rce.rb Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com> Update modules/exploits/linux/http/ibm_drm_rce.rb Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com> Update modules/exploits/linux/http/ibm_drm_rce.rb Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com> Update modules/exploits/linux/http/ibm_drm_rce.rb Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com> Update modules/exploits/linux/http/ibm_drm_rce.rb Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com> Update modules/exploits/linux/http/ibm_drm_rce.rb Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com> Update modules/exploits/linux/http/ibm_drm_rce.rb Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com> Update modules/exploits/linux/http/ibm_drm_rce.rb Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com> Update modules/exploits/linux/http/ibm_drm_rce.rb Co-authored-by: wvu-r7 <wvu-r7@users.noreply.github.com> final final final

wvu · 2020-05-05T16:32:29Z

Release Notes

This adds a remote root exploit for IBM Data Risk Manager versions 2.0.3 and below. Version 2.0.6 might also be vulnerable. The exploit covers:

Pedro Ribeiro added 5 commits March 31, 2020 11:30

Merge pull request #14 from rapid7/master

da22e35

vvv

Merge pull request #15 from rapid7/master

1ed6443

here we go

Merge pull request #16 from rapid7/master

243eec2

ready to go

Create ibm_drm_rce.rb

8f5d6e4

Create ibm_drm_rce.md

e75a642

cdelafuente-r7 added docs module labels Apr 21, 2020

gwillcox-r7 added the needs-testing-environment PRs that need community testing and/or vulnerable test targets before they're able to be landed label Apr 21, 2020

pedrib mentioned this pull request Apr 22, 2020

Add SSH exploit for IBM Data Risk Manager (CVE-2020-4429) #13304

Merged

wvu self-assigned this Apr 22, 2020

acammack-r7 reviewed Apr 23, 2020

View reviewed changes

modules/exploits/linux/http/ibm_drm_rce.rb Outdated Show resolved Hide resolved

add proper check + rubocup changes

a29b05c

wvu added the blocked Blocked by one or more additional tasks label Apr 28, 2020

wvu reviewed Apr 28, 2020

View reviewed changes

modules/exploits/linux/http/ibm_drm_rce.rb Outdated Show resolved Hide resolved

Update ibm_drm_rce.rb

e79fa7c

remove CVE for merge, will add later

d28a886

add CVE

af88fae

add full disclosure URL

dcf9dc1

wvu reviewed May 4, 2020

View reviewed changes

modules/exploits/linux/http/ibm_drm_rce.rb Outdated Show resolved Hide resolved

break into small chunks

5651f4a

wvu removed the blocked Blocked by one or more additional tasks label May 5, 2020

wvu suggested changes May 5, 2020

View reviewed changes

documentation/modules/exploit/linux/http/ibm_drm_rce.md Outdated Show resolved Hide resolved

documentation/modules/exploit/linux/http/ibm_drm_rce.md Show resolved Hide resolved

documentation/modules/exploit/linux/http/ibm_drm_rce.md Outdated Show resolved Hide resolved

wvu previously requested changes May 5, 2020

View reviewed changes

wvu force-pushed the ibm_drm_rce branch from adf27af to 18aa5a6 Compare May 5, 2020 15:49

wvu force-pushed the ibm_drm_rce branch from 18aa5a6 to a17d78a Compare May 5, 2020 15:54

wvu changed the title ~~Add exploit for IBM DRM RCE~~ Add exploit for IBM DRM RCE (CVE-2020-4427, CVE-2020-4428, CVE-2020-4429) May 5, 2020

wvu merged commit e0a67f4 into rapid7:master May 5, 2020

pedrib deleted the ibm_drm_rce branch May 5, 2020 17:45

tperry-r7 added the rn-modules release notes for new or majorly enhanced modules label May 13, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add exploit for IBM DRM RCE (CVE-2020-4427, CVE-2020-4428, CVE-2020-4429) #13300

Add exploit for IBM DRM RCE (CVE-2020-4427, CVE-2020-4428, CVE-2020-4429) #13300

pedrib commented Apr 21, 2020 •

edited by wvu

pedrib commented Apr 21, 2020

gwillcox-r7 commented Apr 21, 2020

pedrib commented Apr 21, 2020

gwillcox-r7 commented Apr 21, 2020 •

edited by adfoster-r7

gwillcox-r7 commented Apr 21, 2020

pedrib commented Apr 22, 2020

acammack-r7 left a comment

pedrib commented Apr 24, 2020 •

edited

wvu commented Apr 28, 2020

pedrib commented Apr 28, 2020

pedrib commented Apr 30, 2020

pedrib commented May 1, 2020

wvu left a comment

wvu left a comment

pedrib commented May 5, 2020

wvu commented May 5, 2020 •

edited

wvu commented May 5, 2020 •

edited by tperry-r7

Navigation Menu

Add exploit for IBM DRM RCE (CVE-2020-4427, CVE-2020-4428, CVE-2020-4429) #13300

Add exploit for IBM DRM RCE (CVE-2020-4427, CVE-2020-4428, CVE-2020-4429) #13300

Conversation

pedrib commented Apr 21, 2020 • edited by wvu

pedrib commented Apr 21, 2020

gwillcox-r7 commented Apr 21, 2020

pedrib commented Apr 21, 2020

gwillcox-r7 commented Apr 21, 2020 • edited by adfoster-r7

gwillcox-r7 commented Apr 21, 2020

pedrib commented Apr 22, 2020

acammack-r7 left a comment

Choose a reason for hiding this comment

pedrib commented Apr 24, 2020 • edited

wvu commented Apr 28, 2020

pedrib commented Apr 28, 2020

pedrib commented Apr 30, 2020

pedrib commented May 1, 2020

wvu left a comment

Choose a reason for hiding this comment

wvu left a comment

Choose a reason for hiding this comment

pedrib commented May 5, 2020

wvu commented May 5, 2020 • edited

wvu commented May 5, 2020 • edited by tperry-r7

Release Notes

pedrib commented Apr 21, 2020 •

edited by wvu

gwillcox-r7 commented Apr 21, 2020 •

edited by adfoster-r7

pedrib commented Apr 24, 2020 •

edited

wvu commented May 5, 2020 •

edited

wvu commented May 5, 2020 •

edited by tperry-r7