Exploit & Auxiliary modules for CVE-2023-20198 and CVE-2023-20273 (Cisco IOS XE) #18507
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…ugs (CVE-2023-20198 and CVE-2023-20273). This allows for unauthenticated remote CLI or OS command execution.
… of print_status for cleaner output.
jvoisin
reviewed
Nov 3, 2023
documentation/modules/auxiliary/admin/http/cisco_ios_xe_cli_exec_cve_2023_20198.md
Outdated
Show resolved
Hide resolved
documentation/modules/auxiliary/admin/http/cisco_ios_xe_os_exec_cve_2023_20273.md
Outdated
Show resolved
Hide resolved
| <wsse:Security xmlns:wsse="http://schemas.xmlsoap.org/ws/2002/04/secext"> | ||
| <wsse:UsernameToken SOAP:mustUnderstand="false"> | ||
| <wsse:Username>#{username}</wsse:Username> | ||
| <wsse:Password>*****</wsse:Password> |
There was a problem hiding this comment.
Suggested change
| <wsse:Password>*****</wsse:Password> | |
| <wsse:Password>#{Rex::Text.rand_text_alpha(8)}</wsse:Password> |
There was a problem hiding this comment.
The string ***** comes from how the Cisco Lua code expects to pass the password, and a comment in the Lua code notes its purpose:
-- Mask the password. It is for audit purposes only and it doesnt use it for authentication
FString = string.gsub(FString,"#password","*****")With this in mind I don't think we should change the string to a random alpha text. It makes more sense to leave it as the expected value.
There was a problem hiding this comment.
Wow, amazing. In a bad way. But still, amazing.
|
|
||
| register_options( | ||
| [ | ||
| OptString.new('CMD', [ true, 'The Global configuration CLI command to execute. To drop to Privileged EXEC mode, preface your CMD with exit\\\\n, e.g "exit\\\\nshow version"', 'exit\\nshow version']) |
There was a problem hiding this comment.
I think it'd be easier for users to have a "PrivilegedExec" boolean instead of having to manually add a prefix, wouldn't it?
There was a problem hiding this comment.
Yes, this is a good idea. I have implemented this via b286687
Co-authored-by: Julien Voisin <[email protected]>
Co-authored-by: Julien Voisin <[email protected]>
…. If set these admin creds are used to leverage CVE-2023-20273. If not set, then CVE-2023-20198 is used to create a new temp admin account before leveraging CVE-2023-20273
…'privileged', and 'global'.
|
Converting this pull request to a draft as I have figured out how to run a payload, so can write an additional exploit module |
|
I have added an RCE exploit module and tested it against IOS XE 17.3.2 and 16.12.3. I added support for both a Linux target (IOS XE is Linux based), but also Unix target, so a broader array of payloads are available (like python meterpreter or a bash shell). Native Linux Meterpreter (via fetch payloads)Unix bash reverse shell |
sfewer-r7
changed the title
jvoisin
reviewed
Nov 7, 2023
Comment on lines
101
to
103
| return false unless res&.code == 200 | ||
|
|
||
| true |
There was a problem hiding this comment.
Suggested change
| return false unless res&.code == 200 | |
| true | |
| return res&.code == 200 |
There was a problem hiding this comment.
good catch, thanks. resolved via 7024d4e (the trailing return can be removed also)
| # (as the above call to run_cli_command succeeded), however maybe this firmware version uses a different format | ||
| # for the version information so our regex wont work. | ||
| # Note: Version numbers can have letters in them, e.g. 17.11.99SW or 16.12.1z2 | ||
| if res =~ /(Cisco IOS XE Software, Version [\d\S]+\.[\d\S]+\.[\d\S]+)/ |
There was a problem hiding this comment.
Suggested change
| if res =~ /(Cisco IOS XE Software, Version [\d\S]+\.[\d\S]+\.[\d\S]+)/ | |
| if res =~ /(Cisco IOS XE Software, Version [^.]+\.[^.]+\.[\^.]+)/ |
There was a problem hiding this comment.
Thanks Julien. Looking at the current expression, the \d is redundant so I think /(Cisco IOS XE Software, Version \S+\.\S+\.\S+)/ is probably the best expression. Using ^\. will also include whitespace chars which I was trying to avoid.
I have removed the redundant \d via 2a56c3f.
Testing (Cisco IOS XE Software, Version \S+\.\S+\.\S+):
Testing (Cisco IOS XE Software, Version [^\.]+\.[^\.]+\.[^\.]+):
Co-authored-by: Julien Voisin <[email protected]>
|
bwatters-r7
reviewed
Nov 7, 2023
documentation/modules/auxiliary/admin/http/cisco_ios_xe_os_exec_cve_2023_20273.md
Outdated
Show resolved
Hide resolved
| ensure | ||
| vprint_status("Removing user '#{admin_username}'") | ||
|
|
||
| unless run_cli_command("no username #{admin_username}", Mode::GLOBAL_CONFIGURATION) |
There was a problem hiding this comment.
Would it ever be worthwhile to leave the user as a backdoor?
There was a problem hiding this comment.
Perhaps, I think as the aux module cisco_ios_xe_cli_exec_cve_2023_20198 would allow the creation of a new admin account via a CLI command, that is also an option.
|
…O_ADMINUSERNAME and CISCO_ADMIN_PASSWORD in the show options command output Co-authored-by: Brendan <[email protected]>
Release NotesThis PR adds three modules: |
bwatters-r7
added
the
rn-modules
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This pull request add two auxiliary modules for the recent Cisco IOS XE vulnerabilities that have been exploited in the wild.
The module
auxiliary/admin/http/cisco_ios_xe_cli_exec_cve_2023_20198leverages CVE-2023-20198 to perform unauthenticated remote CLI command execution. Horizion3ai have a two part writeup with technical details on the vuln.The module
auxiliary/admin/http/cisco_ios_xe_os_exec_cve_2023_20273leverages both CVE-2023-20198 and CVE-2023-20273 to perform unauthenticated remote OS command execution. Leakix has a writeup with technical details on the second CVE. The reason this module is an aux module and not an exploit module is that, even though we get OS command execution, the OS seems to be hardened and running a Metasploit payload is non trivial (at least from some early testing on the device I have). I am investigating this further.Example Usage (CVE-2023-20198)
Example Usage (CVE-2023-20198 + CVE-2023-20273)