SpamTitan Gateway Remote Code Execution #14330
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
I was not able to get this to work on my setup. It looks like the final trigger might not be successful? Target:
Verbose outputHTTPTrace outputWireshark output
|
|
Interesting, the HTTP part went well ( I just retested it against 7.01 and it worked for me. I noticed that, sometimes, it has to be run a few times to get a session. Also, can you try with another target (FreeBSD Dropper) please? Another debug test would be to boot the VM into Single-User mode and check if the payload had been correctly added to |
|
I'm by no means an SNMP expert, but I will say that wireshark presents no packets when I use the "snmp" filter. Edit: I notice that the SNMP community string when I threw this was |
|
Other target settings: |
|
It is definitely the SNMP connect_snmp(true, 'RPORT' => 161)I have absolutely no idea why it behaves like that for you and I was not able to reproduce it. This will need to be debugged and step into
def connect_udp(global = true, opts={})
nsock = Rex::Socket::Udp.create(
'PeerHost' => opts['RHOST'] || rhost,
'PeerPort' => (opts['RPORT'] || rport).to_i,
'LocalHost' => opts['CHOST'] || chost || "0.0.0.0",
'LocalPort' => (opts['CPORT'] || cport || 0).to_i,
'Context' =>
{
'Msf' => framework,
'MsfExploit' => self,
}) |
|
For what it is worth, it works fine for me if I change the hash in the connect_snmp call from |
|
OK.... so I again have no idea what's going on... According to the code at When I change and add It works? I'm struggling because |
|
Waiiit. So when we return that udp socket object, it has a hash to itself (likely with the correct port) but then back in We create a new snmp instance with nothing from the hash that got attached to the UDP socket... and notice that I wonder if this is a bug in the udp/snmp creation? This looks like you could create a UDP socket, then create an SNMP socket based on it, and have the UDP port and SNMP ports not match? I'm still unclear on why our responses are different, though. |
|
You're absolutely right. It looks like you can provide different host/port information to both
I believe, in your case, the socket is somehow not connected when the code reaches sendto and a connection using the provided port ( All of this doesn't sounds right to me. We should be able to use the same custom port in both Thanks for looking into it. |
…r` instance in `connect_snmp`
cdelafuente-r7
force-pushed
the
spamtitan_rce
branch
from
25a6ad9
to
afea5cd
Compare
|
Here are the last changes I've made:
I also rebase everything and force-pushed to fix conflict with the recent updates in master. |
|
|
I'm cool with landing this, but as it changes a library and I'm going to be gone for more than a week, I'm going to put it on hold until I'm around to help douse any fires it may cause. |
Release NotesNew module |
adfoster-r7
added
the
rn-modules
|
Hey, I was testing this exploit. While setting the target, after accessing the web interface and trying to update. I am getting a message saying "License not found. Please Load a valid license". The check for updates section button is disabled. is there anyway to bypass this and start updating |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
TitanHQ SpamTitan Gateway is an anti-spam appliance that protects against unwanted emails and malwares. This module exploits an improper input sanitization in versions 7.01, 7.02, 7.03 and 7.07 to inject command directives into the SNMP configuration file and get remote code execution as root. Note that only version 7.03 needs authentication and no authentication is required for versions 7.01, 7.02 and 7.07.
First, it sends an HTTP POST request to the
snmp-x.phppage with anSNMPDcommand directives (extend+ command) passed to thecommunityparameter. This payload is then added tosnmpd.confby the application. Finally, the module triggers the execution of this command by querying the SNMP server for the correct OID.This exploit module has been successfully tested against versions 7.01, 7.02, 7.03, and 7.07.
Installation
A demo version of the vulnerable application can be downloaded here. Since the latest version of SpamTitan Gateway has this vulnerability fixed and no demo of the vulnerable versions are available for download, the previous major release demo has to be used and updates have to be installed manually.
Installation steps:
.ovaimage: https://stdownload.titanhq.com/vmware/SpamTitan-6-amd64.ovaadminhiadminSystem Setup>System Updatesand clickStartin theCheck for Updates Nowsection. It will download all available update patches.Available Updatessection, choose the version you want to test and click theinstallbutton in front of it.Verification Steps
use exploit/freebsd/webapp/spamtitan_unauth_rceset RHOSTS <ip>set LHOST <ip>runScenarios
SpamTitan Gateway v7.01 - target 0 (in-memory command)
SpamTitan Gateway v7.01 - target 1 (FreeBSD Dropper - x64)
SpamTitan Gateway v7.01 - target 2 (FreeBSD Dropper - x86)