Add citrix_directory_traversal module to /modules/auxiliary/scanner/h… #12813

ErikWynter · 2020-01-11T22:50:13Z

About

This change adds a new module to /modules/auxiliary/scanner/http/ that can be used to verify whether or not a web server is vulnerable to CVE-2019-19781 - a directory traversal in in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. For more info about this vulnerability, see: https://nvd.nist.gov/vuln/detail/CVE-2019-19781

Vulnerable System

Citrix ADC (NetScalers) systems vulnerable to directory traversal (CVE-2019-19781).

Verification Steps

Select a webserver to target.
Do: use auxiliary/scanner/http/citrix_directory_traversal
Do: set RHOSTS [target IP or hostname]
Do: run
The module will issue an HTTP GET request for [TARGET]/vpn/../vpns/cfg/smb.conf. If HTTP response code 200 is received, it will indicate that the target is vulnerable to CVE-2019-19781.

Options

Proxies . This option is not set by default.
RPORT . The default setting is 80. To use: set RPORT [target port, default is 80]
SSL . The default setting is false.
THREADS . The default setting is 1.
VHOST . This option is not set by default.

Scenarios

msf5 auxiliary(scanner/http/citrix_directory_traversal) > run

[*] Found 127.0.0.1/vpn/../vpns/cfg/smb.conf.
[+] The target is vulnerable to CVE-2019-19781.
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

…ttp/

wvu · 2020-01-13T16:50:56Z

Hi! Thanks for this. We'll be making some final changes to the module and landing with #12816, using this module as the exploit's check method, if possible. I'll let you know when I'm ready to merge this. Thanks!

ErikWynter · 2020-01-13T19:39:15Z

Hi! Thanks for your message. Please let us know if we can help with additional documentation or anything else at this stage. And it would indeed be great if you could keep us updated about when and in what form you will be including the module. Thanks in advance!

wvu · 2020-01-13T20:21:37Z

@kalba-security: If you could write module documentation, that would be a task off my list.

FYI, there are some sweeping functional and stylistic changes that need to be done in order to merge this. I'll keep you posted before anything hits master, but we have a bit of a deadline here. Thank you.

wvu · 2020-01-13T20:30:45Z

modules/auxiliary/scanner/http/citrix_directory_traversal.rb

+  def initialize
+    super(
+      'Name'        => 'Citrix ADC Directory Traversal',
+      'Description' => 'This module exploits a directory traversal vulnerability (CVE-2019-19781) within Citrix ADC (NetScalers). It requests the smb.conf file located in the /vpns/cfg directory by issuing the request /vpn/../vpns/cfg/smb.conf. It then checks if the server is vulnerable by looking for the presense of a "global" variable in smb.conf, which this file should always contain.',


I've updated the code to check for global, since this check is not currently present. Please stand by until I can push my commits for viewing. Thanks!

ErikWynter · 2020-01-13T21:56:27Z

@wvu-r7 Hey, I have the documentation ready. Let me know if I can add it now. Otherwise I won't be able to do it until tomorrow.

…

On Monday, 13 January 2020, ♄ ***@***.***> wrote: ***@***.**** commented on this pull request. ------------------------------ In modules/auxiliary/scanner/http/citrix_directory_traversal.rb <#12813 (comment)> : > +# Current source: https://github.com/rapid7/metasploit-framework +## + +class MetasploitModule < Msf::Auxiliary + + # Exploit mixins should be called first + include Msf::Exploit::Remote::HttpClient + include Msf::Auxiliary::WmapScanServer + # Scanner mixin should be near last + include Msf::Auxiliary::Scanner + include Msf::Auxiliary::Report + + def initialize + super( + 'Name' => 'Citrix ADC Directory Traversal', + 'Description' => 'This module exploits a directory traversal vulnerability (CVE-2019-19781) within Citrix ADC (NetScalers). It requests the smb.conf file located in the /vpns/cfg directory by issuing the request /vpn/../vpns/cfg/smb.conf. It then checks if the server is vulnerable by looking for the presense of a "global" variable in smb.conf, which this file should always contain.', I've updated the code to check for global, since this check is not currently present. Please stand by until I can push my commits for viewing. Thanks! — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#12813?email_source=notifications&email_token=ANKL6M4M2K2KCX4U2E2FMV3Q5TFPPA5CNFSM4KFUMX52YY3PNVWWK3TUL52HS4DFWFIHK3DMKJSXC5LFON2FEZLWNFSXPKTDN5WW2ZLOORPWSZGOCRSFDPQ#pullrequestreview-342118846>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ANKL6M4RXDZKPYFCH2GQD73Q5TFPPANCNFSM4KFUMX5Q> .

wvu · 2020-01-13T22:08:54Z

@kalba-security: Feel free to push the docs! Thanks!

wvu · 2020-01-13T22:36:11Z

You ROCK! Thank you so much. I'll update the docs if the code changes can be reflected.

wvu · 2020-01-13T22:37:50Z

Here is the updated code: master...wvu-r7:pr/12813. I'm happy to explain and justify anything. I will need to merge all of this in the next couple hours.

altjx · 2020-01-13T22:48:40Z

Looks good!!! @wvu-r7. Quick question, we're not allowed to put email addresses or Twitter handles in by chance are we? Can't remember if that was restricted or not.

ErikWynter · 2020-01-13T22:51:25Z

Yeah looks great @wvu-r7!! In the documentation I already referenced the global check you added btw.

wvu · 2020-01-13T22:57:00Z

@altjx: Nope, but it's okay to tack them on as a comment! What Twitter handles do y'all want to use? It's easier to avoid conflicts if I make the commit. Sorry for the situation. :(

wvu · 2020-01-13T22:59:01Z

Btw, we're planning to convert all CVE references to NVD soon enough, since CVE Details has been... lacking. So I removed the NVD URL reference for now.

altjx · 2020-01-13T23:09:35Z

Sounds great! We can use the following:

@wyntererik
@altjx

No worries! I'm on a plane anyway so I wouldn't be able to do it LOL. Thanks so much!

wvu · 2020-01-13T23:44:26Z

I've improved the smb.conf check and added a PATH option. There are many traversal options, including obfuscation...

altjx · 2020-01-13T23:49:10Z

Gotcha!

wvu · 2020-01-14T00:18:52Z

Release Notes

This adds a scanner for CVE-2019-19781, a directory traversal vulnerability in Citrix Application Delivery Controller (NetScaler).

wvu · 2020-01-14T00:20:43Z

Commits I've added:

f1cc40b
d7deb4e
94b6b6d
332afe8
3354e69
4ac7f81
99235c7

Thanks again!

wvu · 2020-01-14T00:22:06Z

Off to finish #12816!

wvu · 2020-01-14T00:22:44Z

You can find the module in the tree at https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/citrix_dir_traversal.rb.

altjx · 2020-01-14T02:03:15Z

Thanks so much!! @wvu-r7 I apologize but I typod my Twitter handle. should have been @altonjx sorry about that

wvu · 2020-01-14T02:18:47Z

Doh! No problem, let me fix that for ya.

altjx · 2020-01-14T02:21:11Z

Thanks again!! 🙏🏽

wvu · 2020-01-14T02:23:27Z

All fixed. :-)

bcoles · 2020-01-14T02:28:03Z

documentation/modules/auxiliary/scanner/http/citrix_directory_traversal.md

+
+Because vulnerable servers allow for directory traversal, they will accept the request `GET /vpn/../vpns/` and  process it as a request for `GET /vpns/`, a directory that contains PERL scripts that can be targeted to allow for limited file writing on the vulnerable host.
+
+This module checks if a target server is vulnerable by issuing an HTTP GET request for `/vpn/../vpns/cfg/smb.conf`and then checking the response for `global`since this configuration file should contain global variables. If ``global``is found, the server is vulnerable to CVE-2019-19781.


Suggested change

This module checks if a target server is vulnerable by issuing an HTTP GET request for `/vpn/../vpns/cfg/smb.conf`and then checking the response for `global`since this configuration file should contain global variables. If ``global``is found, the server is vulnerable to CVE-2019-19781.

This module checks if a target server is vulnerable by issuing an HTTP GET request for `/vpn/../vpns/cfg/smb.conf`and then checking the response for `global` since this configuration file should contain global variables. If `global` is found, the server is vulnerable to CVE-2019-19781.

bcoles · 2020-01-14T02:28:41Z

documentation/modules/auxiliary/scanner/http/citrix_directory_traversal.md

+1.  `Proxies`  . This option is not set by default.
+2.  `RPORT`  . The default setting is  `80`. To use:  `set RPORT [PORT]`
+3.  `SSL`  . The default setting is  `false`.
+4.  `THREADS`  . The default setting is  `1`.
+5.  `VHOST`  . This option is not set by default.


This formatting is inconsistent with existing documentation. See examples:

Template

Examples

bcoles · 2020-01-14T02:31:00Z

modules/auxiliary/scanner/http/citrix_directory_traversal.rb

+          'Erik Wynter',
+          'altonjx',


Traditionally, the author's role is provided in comments. ie:

[ 'someone', # discovery and PoC 'someone else', # metasploit ]

This one's fair.

Addressing over in #12816.

wvu · 2020-01-14T02:53:46Z

@bcoles: Please review against master. Added commits are in #12813 (comment). I wasn't able to push to their branch, and a PR wouldn't make my deadline. If you have further changes, I would appreciate a PR!

bcoles · 2020-01-14T02:57:58Z

@bcoles: Please review against master. Added commits are in #12813 (comment). I wasn't able to push to their branch, and a PR wouldn't make my deadline. If you have further changes, I would appreciate a PR!

A case statement seems a little ridiculous for a single branch conditional. Future proofing?

Also, turi.to_s.end_with?('smb.conf') would be preferred over a regex for readability.

wvu · 2020-01-14T02:59:03Z

Yes, future-proofing. Indeed ridiculous for a single branch. I have other cases I would like to add, but I reached a deadline.

ETA: It was originally just if and end_with?. Agreed that it read better!

wvu · 2020-01-14T03:10:07Z

Screw it. I added the PATH option. Reverted to if/end_with? over in #12816.

alanyee · 2020-04-09T23:30:51Z

Since it's not documentation anywhere else, the files have been renamed to
https://github.com/rapid7/metasploit-framework/blob/master/documentation/modules/auxiliary/scanner/http/citrix_dir_traversal.md
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/citrix_dir_traversal.rb

So, use

use auxiliary/scanner/http/citrix_dir_traversal

wvu · 2020-04-10T00:44:39Z

The files were renamed while merging into master, so if anyone has been grabbing the file from this PR, they should update normally.

See f1cc40b from #12813 (comment), tbh.

I understand everyone wants the code, but PRs are technically WIP until they're merged. Updating is the responsibility of the user in that case. So thanks for dropping a note! The rest of y'all are slackers. ;)

ErikWynter and others added 2 commits January 11, 2020 22:45

Add citrix_directory_traversal module to /modules/auxiliary/scanner/h…

03d6d1a

…ttp/

Changed permission from executable to just readable

b3bf82b

wvu added feature module labels Jan 12, 2020

wvu self-assigned this Jan 12, 2020

space-r7 added the needs-docs label Jan 13, 2020

wvu mentioned this pull request Jan 13, 2020

add citrix path traversal exploit #12816

Merged

2 tasks

wvu reviewed Jan 13, 2020

View reviewed changes

Add documentation

c30cd8e

wvu added a commit that referenced this pull request Jan 14, 2020

Land #12813, Citrix CVE-2019-19781 scanner

6498a7c

wvu merged commit c30cd8e into rapid7:master Jan 14, 2020

msjenkins-r7 pushed a commit that referenced this pull request Jan 14, 2020

Land #12813, Citrix CVE-2019-19781 scanner

53eda64

wvu mentioned this pull request Jan 14, 2020

Fix #12813, Twitter handle correction #12819

Merged

wvu added a commit that referenced this pull request Jan 14, 2020

Land #12819: Fix #12813, Twitter handle correction

6c4970f

msjenkins-r7 pushed a commit that referenced this pull request Jan 14, 2020

Land #12819: Fix #12813, Twitter handle correction

5776fe1

bcoles reviewed Jan 14, 2020

View reviewed changes

wvu mentioned this pull request Jan 14, 2020

Fix #12813, prefer send_request_cgi over send_request_raw #12820

Merged

wvu added a commit that referenced this pull request Jan 14, 2020

Land #12820: Fix #12813, send_request_cgi change

1636008

msjenkins-r7 pushed a commit that referenced this pull request Jan 14, 2020

Land #12820: Fix #12813, send_request_cgi change

03d2d5e

wvu mentioned this pull request Jan 14, 2020

Check for whitespace in [global] directive for Citrix #12828

Merged

wvu mentioned this pull request Jul 8, 2020

Credit Mikhail Klyuchnikov for CVE-2019-19781 #13829

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add citrix_directory_traversal module to /modules/auxiliary/scanner/h… #12813

Add citrix_directory_traversal module to /modules/auxiliary/scanner/h… #12813

ErikWynter commented Jan 11, 2020

wvu commented Jan 13, 2020

ErikWynter commented Jan 13, 2020

wvu commented Jan 13, 2020

wvu Jan 13, 2020

ErikWynter commented Jan 13, 2020 via email •

edited

Loading

wvu commented Jan 13, 2020

wvu commented Jan 13, 2020

wvu commented Jan 13, 2020

altjx commented Jan 13, 2020 •

edited

Loading

ErikWynter commented Jan 13, 2020 •

edited

Loading

wvu commented Jan 13, 2020

wvu commented Jan 13, 2020

altjx commented Jan 13, 2020 •

edited

Loading

wvu commented Jan 13, 2020

altjx commented Jan 13, 2020

wvu commented Jan 14, 2020 •

edited by tperry-r7

Loading

wvu commented Jan 14, 2020

wvu commented Jan 14, 2020

wvu commented Jan 14, 2020

altjx commented Jan 14, 2020 •

edited

Loading

wvu commented Jan 14, 2020

altjx commented Jan 14, 2020

wvu commented Jan 14, 2020

bcoles Jan 14, 2020

bcoles Jan 14, 2020

bcoles Jan 14, 2020

wvu Jan 14, 2020

wvu Jan 14, 2020

wvu commented Jan 14, 2020 •

edited

Loading

bcoles commented Jan 14, 2020

wvu commented Jan 14, 2020 •

edited

Loading

wvu commented Jan 14, 2020

alanyee commented Apr 9, 2020

wvu commented Apr 10, 2020 •

edited

Loading


		Because vulnerable servers allow for directory traversal, they will accept the request `GET /vpn/../vpns/` and process it as a request for `GET /vpns/`, a directory that contains PERL scripts that can be targeted to allow for limited file writing on the vulnerable host.

		This module checks if a target server is vulnerable by issuing an HTTP GET request for `/vpn/../vpns/cfg/smb.conf`and then checking the response for `global`since this configuration file should contain global variables. If ``global``is found, the server is vulnerable to CVE-2019-19781.

Add citrix_directory_traversal module to /modules/auxiliary/scanner/h… #12813

Add citrix_directory_traversal module to /modules/auxiliary/scanner/h… #12813

Conversation

ErikWynter commented Jan 11, 2020

About

Vulnerable System

Verification Steps

Options

Scenarios

wvu commented Jan 13, 2020

ErikWynter commented Jan 13, 2020

wvu commented Jan 13, 2020

wvu Jan 13, 2020

Choose a reason for hiding this comment

ErikWynter commented Jan 13, 2020 via email • edited Loading

wvu commented Jan 13, 2020

wvu commented Jan 13, 2020

wvu commented Jan 13, 2020

altjx commented Jan 13, 2020 • edited Loading

ErikWynter commented Jan 13, 2020 • edited Loading

wvu commented Jan 13, 2020

wvu commented Jan 13, 2020

altjx commented Jan 13, 2020 • edited Loading

wvu commented Jan 13, 2020

altjx commented Jan 13, 2020

wvu commented Jan 14, 2020 • edited by tperry-r7 Loading

Release Notes

wvu commented Jan 14, 2020

wvu commented Jan 14, 2020

wvu commented Jan 14, 2020

altjx commented Jan 14, 2020 • edited Loading

wvu commented Jan 14, 2020

altjx commented Jan 14, 2020

wvu commented Jan 14, 2020

bcoles Jan 14, 2020

Choose a reason for hiding this comment

bcoles Jan 14, 2020

Choose a reason for hiding this comment

bcoles Jan 14, 2020

Choose a reason for hiding this comment

wvu Jan 14, 2020

Choose a reason for hiding this comment

wvu Jan 14, 2020

Choose a reason for hiding this comment

wvu commented Jan 14, 2020 • edited Loading

bcoles commented Jan 14, 2020

wvu commented Jan 14, 2020 • edited Loading

wvu commented Jan 14, 2020

alanyee commented Apr 9, 2020

wvu commented Apr 10, 2020 • edited Loading

ErikWynter commented Jan 13, 2020 via email •

edited

Loading

altjx commented Jan 13, 2020 •

edited

Loading

ErikWynter commented Jan 13, 2020 •

edited

Loading

altjx commented Jan 13, 2020 •

edited

Loading

wvu commented Jan 14, 2020 •

edited by tperry-r7

Loading

altjx commented Jan 14, 2020 •

edited

Loading

wvu commented Jan 14, 2020 •

edited

Loading

wvu commented Jan 14, 2020 •

edited

Loading

wvu commented Apr 10, 2020 •

edited

Loading