Added module auxiliary/admin/cisco/cisco_asa_extrabacon #7353

ghost · 2016-09-22T18:10:59Z

We've added a module for ExtraBacon. We are adding patches for most versions of 8.x and 9.x in the near future after we test all versions on real hardware.

This is using improved shellcode, has less stages than the Equation Group version making it more reliable. This makes the SNMP payload packet ~150 less bytes. Also, the leaked version only supports 8.x, we have it working on 9.x versions.

If anyone wants to help test more version specific offsets, we have a Lina file offset finder at:

https://github.com/RiskSense-Ops/CVE-2016-6366

Supported Versions (will update list as we go):

All of the leaked versions are now in the module.

8.x

8.0(2)
8.0(3)
8.0(3)6
8.0(4)
8.0(4)32
8.0(5)
8.2(1)
8.2(2)
8.2(3)
8.2(4)
8.2(5)
8.2(5)33 *
8.2(5)41 *
8.3(1)
8.3(2)
8.3(2)39 *
8.3(2)40 *
8.3(2)-npe * **
8.4(1)
8.4(2)
8.4(3)
8.4(4)
8.4(4)1 *
8.4(4)3 *
8.4(4)5 *
8.4(4)9 *
8.4(6)5 *
8.4(7) *

9.x

9.0(1) *
9.1(1)4 *
9.2(1) *
9.2(2)8 *
9.2(3) *
9.2(4) *
9.2(4)13 *

* new version support not part of the original Shadow Brokers leak
** We currently can't distinguish between normal and NPE versions from the SNMP strings. We've commented out the NPE offsets, as NPE is very rare (it is for exporting to places where encryption is crappy), but in the future, we'd like to incorporate these versions. Perhaps as a bool option?

Verification

List the steps needed to make sure this thing works

This module patches the authentication functions of a Cisco ASA
to allow uncredentialed logins. Uses improved shellcode for payload.

This module patches the authentication functions of a Cisco ASA to allow uncredentialed logins. Uses improved shellcode for payload.

busterb · 2016-09-23T01:29:53Z

modules/auxiliary/admin/cisco/cisco_asa_extrabacon.rb

+
+  end
+
+  def setup


do these need to exist?

Removed these

busterb · 2016-09-23T01:30:32Z

modules/auxiliary/admin/cisco/cisco_asa_extrabacon.rb

+    return Exploit::CheckCode::Detected
+  end
+
+  def build_offsets(vers_string, mode)


looks like you're switching between 2 and 4 character indents through the module

Fixed this up

busterb · 2016-09-23T01:34:07Z

modules/auxiliary/admin/cisco/cisco_asa_extrabacon.rb

+  def run()
+
+    begin
+      mode = datastore['MODE']


this is a bit more readable if it's collapsed more IMO

busterb · 2016-09-23T01:34:42Z

modules/auxiliary/admin/cisco/cisco_asa_extrabacon.rb

+      end
+
+    rescue ::Rex::ConnectionError, ::SNMP::RequestTimeout, ::SNMP::UnsupportedVersion
+      print_error("SNMP Error, Cisco ASA may have crashed :/")


I'm not sure if UnsupportedVersion would really indicate a crash on the ASA

Made the exception handling better

bcook-r7 · 2016-09-23T11:32:22Z

Awesome work simplifying the shell code and improving reliability. Did you happen to see the exploit module in the queue from a couple of weeks ago as well? I'd like to see how we can merge these a bit so they share where they can and we end up with the best attributes of both.

ghost · 2016-09-23T13:58:31Z

@bcook-r7: @jlee-r7 told us to get in contact with @wwebb-r7, I tried contacting him on Twitter about a week ago to collaborate but he hasn't been active there. I honestly didn't even see his pull request until after we submitted this one. It seems his version is a straightforward port of the original code from Python to Ruby.

I've crashed 8.2(3) in the lab running the original leaked shellcode when it failed to properly find the third stage. This new shellcode does everything in the second stage. The first -> second stage is always the same code. In the original exploit, second -> third stage required them to craft two packets and re-calculate. I have a blog post detailing why the original shellcode was so large/verbose, and easy to reduce in size: http://zerosum0x0.blogspot.com/2016/09/reverse-engineering-cisco-asa-for.html

Also, going from the second to third stage to support 9.x versions also requires fiddling with a stack offset to a pointer I'm still unsure of how to calculate (for the lina.elf auto-offset finder script). I stopped trying to figure out because it was unnecessary.

We owe William credit, without his blog post on debugging ASAs ours would still be collecting dust. I am open to any way you see fit to merge the two. I hope William will help us test new versions using the offset finder script as well.

We currently can't distinguish between 8.3(2) and 8.3(2)-npe versions from the SNMP strings. We've commented out the 8.3(2)-npe offsets, but in the future, we'd like to incorporate this version.

This version of the ASA is patched and our offsets do not work currently. We may do more work on this to find a solution.

bcook-r7 · 2016-09-24T09:05:19Z

Thanks @zerosum0x0. Yeah, it's a bummer to have competing modules, but I see what you mean on reliability after doing some comparison testing as well.

bcook-r7 · 2016-09-24T09:14:25Z

I don't have any more complaints here, this looks good. I'm going to give @wwebb-r7 some credit here though.

bcook-r7 · 2016-09-24T09:55:40Z

A couple of nits before we continue. First, I'm sending you a PR with some docs. Second, can I request that you move all of this to a feature branch, and re-PR from there? When you send a PR from your local master branch, and then you later update your master branch, it breaks all of the history in this PR in github.

Add module docs, credit

ghost · 2016-09-24T14:04:41Z

Created #7359 which merges @bcook-r7 pull request and as requested is in a feature branch

zerosum0x0 and others added 19 commits September 22, 2016 18:06

Added module auxiliary/admin/cisco/cisco_asa_extrabacon

3c7fc49

This module patches the authentication functions of a Cisco ASA to allow uncredentialed logins. Uses improved shellcode for payload.

Replaced global vars, made 'patched_code' value static

c180451

added always_return_true variable

4288c3f

Added offsets for 8.4(3)

022189c

Fix whitespace per msftidy

a0ba8b7

Added offsets for 8.2(3)

e8d1f6d

Added offsets for 9.2(2)8

c22a2a1

Removing redundant version check

b77adc9

Fixed problem with 9.2(2)8 offsets

5ca6563

Added offsets for 9.0(1)

4e9459d

Adding offsets for 9.1(1)4

961524d

Added RiskSense contributor repo to references

064aed8

Added offsets for 8.3(1)

7762f42

stupid comment

28a09c2

Added offsets for 8.4(7)

f525c24

Merge branch 'master' of github.com:RiskSense-Ops/metasploit-framework

48f024d

Replaced '+=' with '<<'

df25f07

Moved required datastore option into constructor

cf07085

Added basic error handling for unsupported ASA versions

dda6b67

busterb reviewed Sep 23, 2016

View reviewed changes

zerosum0x0 and others added 8 commits September 23, 2016 14:46

numerous fixes as per @busterb

2591d0b

fix merge conflicts

1868371

Changed 'build_offsets' to 'build_payload'

98cf5d8

added all leaked versions

480e973

Merge branch 'master' of github.com:RiskSense-Ops/metasploit-framework

455936e

offset for 8.0(3)6

6c5271c

Adding new version offsets

f19ed43

Merge branch 'master' of github.com:RiskSense-Ops/metasploit-framework

9cbd84d

TheNaterz added 13 commits September 23, 2016 13:15

Added offsets for version 8.2(5)33

d36e16f

Added offsets for version 9.2(1)

b4d3e8e

Added offsets for version 8.2(5)41

926e5fa

Added offsets for verion 8.3(2)-npe

64df7b0

We currently can't distinguish between 8.3(2) and 8.3(2)-npe versions from the SNMP strings. We've commented out the 8.3(2)-npe offsets, but in the future, we'd like to incorporate this version.

Added offsets for version 8.3(2)39

ba4505b

Added offsets for 8.3(2)40

19caff2

Added offsets for version 8.4(4)1

8840af0

Added offsets for version 8.4(4)3

19fe093

Added offsets for version 8.4(4)5

368fd1a

Added offsets for version 8.4(4)9

352946d

Added offsets for version 8.4(6)5

3f985d9

Added offsets for version 9.2(4)13

087e946

Added offsets for version 9.2(4)14

cd4299b

This version of the ASA is patched and our offsets do not work currently. We may do more work on this to find a solution.

bcook-r7 mentioned this pull request Sep 24, 2016

Add CVE-2016-6366 Cisco ASA SNMP Exploit (EXTRABACON) #7282

Closed

11 tasks

bcook-r7 self-assigned this Sep 24, 2016

Brent Cook added 2 commits September 24, 2016 05:48

Add module documentation

6f4c943

Add credit to wwebb-r7 for the initial module and ASA hacking notes

df28e2a

Merge pull request #1 from bcook-r7/land-7353-bacon-too

90bd2a9

Add module docs, credit

ghost mentioned this pull request Sep 24, 2016

Added module auxiliary/admin/cisco/cisco_asa_extrabacon #7359

Merged

ghost closed this Sep 24, 2016

bcook-r7 added module feature labels Sep 30, 2016

This pull request was closed.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Added module auxiliary/admin/cisco/cisco_asa_extrabacon #7353

Added module auxiliary/admin/cisco/cisco_asa_extrabacon #7353

ghost commented Sep 22, 2016 •

edited by bcook-r7

Loading

busterb Sep 23, 2016

ghost Sep 23, 2016

busterb Sep 23, 2016

ghost Sep 23, 2016

busterb Sep 23, 2016

ghost Sep 23, 2016

busterb Sep 23, 2016

ghost Sep 23, 2016

bcook-r7 commented Sep 23, 2016 •

edited

Loading

ghost commented Sep 23, 2016 •

edited by ghost

Loading

bcook-r7 commented Sep 24, 2016

bcook-r7 commented Sep 24, 2016 •

edited

Loading

bcook-r7 commented Sep 24, 2016

ghost commented Sep 24, 2016

Added module auxiliary/admin/cisco/cisco_asa_extrabacon #7353

Added module auxiliary/admin/cisco/cisco_asa_extrabacon #7353

Conversation

ghost commented Sep 22, 2016 • edited by bcook-r7 Loading

Supported Versions (will update list as we go):

Verification

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

bcook-r7 commented Sep 23, 2016 • edited Loading

ghost commented Sep 23, 2016 • edited by ghost Loading

bcook-r7 commented Sep 24, 2016

bcook-r7 commented Sep 24, 2016 • edited Loading

bcook-r7 commented Sep 24, 2016

ghost commented Sep 24, 2016

ghost commented Sep 22, 2016 •

edited by bcook-r7

Loading

bcook-r7 commented Sep 23, 2016 •

edited

Loading

ghost commented Sep 23, 2016 •

edited by ghost

Loading

bcook-r7 commented Sep 24, 2016 •

edited

Loading