Add Exploit for CVE-2021-38648 (OMIGOD LPE) #15802
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
You should have installed Protocon on the target! |
wvu
reviewed
Oct 27, 2021
Comment on lines
+21
to
+25
| The hardcoded messages were recovered using: | ||
| ``` | ||
| strace -v -s 5000 -f -xx -e trace=socket,connect,write,writev,close \ | ||
| /opt/omi/bin/omicli iv root/scx { SCX_OperatingSystem } ExecuteShellCommand { command '...' timeout 0 } | ||
| ``` |
adfoster-r7
reviewed
Oct 28, 2021
| pid = pidof('omiserver').first | ||
| return CheckCode::Safe if pid.nil? | ||
|
|
||
| omiserver_bin = read_file("/proc/#{pid}/cmdline").split("\x00", 2).first |
There was a problem hiding this comment.
To a potential reviewer, it's worth double checking if we'll always have access to read this file.
There was a problem hiding this comment.
Let's use the most common default binary path as a fallback if we don't have the ability to confirm the binary cmdline as expected
There was a problem hiding this comment.
To a potential reviewer, it's worth double checking if we'll always have access to read this file.
/proc/PID/cmdline is world-readable unless the /proc filesystem is manually mounted with the hidepid option. Not certain how common it is to do that though.
adfoster-r7
reviewed
Oct 28, 2021
adfoster-r7
reviewed
Oct 28, 2021
adfoster-r7
reviewed
Oct 28, 2021
|
Converted to a draft because I noticed an issue that will take me a bit to address. Will undraft once it's unblocked. |
|
Docker setup: For a manual setup on Ubuntu 20, I'm getting the following output: That may be due to an error in my installation though. Code and docs look good to me! |
|
And it was my installation: |
Release NotesThis adds a local exploit module that targets versions less than |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This is an exploit for CVE-2021-38648 which is an authentication bypass within Microsoft's OMI management interface. Unlike the semi-related CVE-2021-38647 (see PR #15800) this vulnerability must be leveraged locally and can be exploited in the default configuration. Exploitation results in OS command execution as the root user.
The vulnerability works by replaying the messages necessary to execute an OS command but without the initial authentication exchange. The messages are in an OMI-specific binary protocol format. The included Python exploit uses hard-coded messages but limits the OS command that's executed to 256 characters max. When the Linux Dropper target is used though, the space is irrelevant because the command is just used to execute the payload ELF file that is written to disk.
A Python script is used for maximum compatibility in Metaspoit's current state. In theory, railgun could be used to perform the exploit entirely in memory but that would limit it to use with only Python Meterpreter sessions. Likewise, Rex could maybe be used to forward an AF_UNIX socket, but is currently limited to TCP/IP right now. Python is pretty widely available and included on many distros as part of the base. The exploit will automatically find and execute an appropriate Python binary.
Verification
While developing this module, I noticed an issue whereby the Python Meterpreter for some reason fails to identify a Python executable using
command_exists?while Mettle succeeds. I suspect this is an issue with the Python Meterpreter and will investigate/fix it in a separate PR. In the meantime, don't use the Python Meterpreter for testing this exploit.docker build . -t ms-omi:cve-2021-38648docker run -it --entrypoint /bin/bash ms-omi:cve-2021-38648/etc/init.d/omid restartmsfconsoleexploit/multi/script/web_deliveryworks well for this purposeuse exploit/linux/local/cve_2021_38648_omigodexploitExample