feat: Allow explicit SSL configuration in start_service method #19330

heyder · 2024-07-19T10:41:14Z

The start_service method now allows users to specify their SSL preferences directly through the opts parameter. If the ssl option is not provided in opts, it will default to the value in datastore['SSL'].

This change enhances the flexibility and usability of the start_service method, preventing unintended behavior when users need to control the SSL setting explicitly.

Closes #19329

The start_service method now allows users to specify their SSL preferences directly through the opts parameter. If the ssl option is not provided in opts, it will default to the value in datastore['SSL']. This change enhances the flexibility and usability of the start_service method, preventing unintended behavior when users need to control the SSL setting explicitly. Closes rapid7#19329

heyder · 2024-07-19T13:17:24Z

The following modules might benefit from this feature:

$  git grep   'ssl_restore = true'
modules/exploits/linux/http/dlink_diagnostic_exec_noauth.rb:        ssl_restore = true
modules/exploits/linux/http/dlink_dir615_up_exec.rb:        ssl_restore = true
modules/exploits/linux/http/dlink_hnap_login_bof.rb:        ssl_restore = true
modules/exploits/linux/http/linksys_e1500_apply_exec.rb:        ssl_restore = true
modules/exploits/linux/http/linksys_wrt54gl_apply_exec.rb:        ssl_restore = true
modules/exploits/linux/http/netgear_dgn1000b_setup_exec.rb:        ssl_restore = true
modules/exploits/linux/http/netgear_dgn2200b_pppoe_exec.rb:        ssl_restore = true
modules/exploits/linux/http/trendmicro_websecurity_exec.rb:      ssl_restore = true
modules/exploits/linux/http/vestacp_exec.rb:      ssl_restore = true
modules/exploits/linux/http/vestacp_exec.rb:      ssl_restore = true
modules/exploits/linux/smtp/exim4_dovecot_exec.rb:        ssl_restore = true
modules/exploits/multi/http/bassmaster_js_injection.rb:      ssl_restore = true
modules/exploits/multi/http/mutiny_subnetmask_exec.rb:      ssl_restore = true
modules/exploits/multi/http/rails_dynamic_render_code_exec.rb:      ssl_restore = true
modules/exploits/multi/http/struts_default_action_mapper.rb:      ssl_restore = true
modules/exploits/multi/http/trendmicro_threat_discovery_admin_sys_time_cmdi.rb:      ssl_restore = true
modules/exploits/multi/misc/ibm_tm1_unauth_rce.rb:      ssl_restore = true
modules/exploits/multi/sap/sap_mgmt_con_osexec_payload.rb:        ssl_restore = true
modules/exploits/windows/http/manageengine_adaudit_plus_cve_2022_28219.rb:      ssl_restore = true

lib/msf/core/exploit/remote/http_server.rb

Co-authored-by: Simon Janusz <[email protected]>

jheysel-r7

Thank you @heyder for taking the time to fix this properly and for going back and refactoring all the modules that shared the same pattern, much appreciated.

After running the same grep command as you I just have one suggestion but agree that the ssl_restore instances in trendmicro_websecurity_exec and vestacp_exec.rb are unaffected by this change.

Before:

msf6 auxiliary(gather/magento_xxe_cve_2024_34102) > set ssl false
ssl => false
msf6 auxiliary(gather/magento_xxe_cve_2024_34102) > set rport 80
rport => 80
msf6 auxiliary(gather/magento_xxe_cve_2024_34102) > set rhost localhost
rhost => localhost
msf6 auxiliary(gather/magento_xxe_cve_2024_34102) > run
[*] Running module against 127.0.0.1

[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. Detected Magento Community edition version 2.4 which is vulnerable
[*] Using URL: http://172.16.199.1:8080/
[+] File read succeeded!
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/bin/bash
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
_apt:x:42:65534::/nonexistent:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin

msf6 auxiliary(gather/magento_xxe_cve_2024_34102) > set ssl true
[!] Changing the SSL option's value may require changing RPORT!
ssl => true
msf6 auxiliary(gather/magento_xxe_cve_2024_34102) > set rport 443
rport => 443
msf6 auxiliary(gather/magento_xxe_cve_2024_34102) > run
[*] Running module against 127.0.0.1

[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. Detected Magento Community edition version 2.4 which is vulnerable
[*] Using URL: http://172.16.199.1:8080/
[+] File read succeeded!
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/bin/bash
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
_apt:x:42:65534::/nonexistent:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin

After

msf6 auxiliary(gather/magento_xxe_cve_2024_34102) > reload_lib lib/msf/core/exploit/remote/http_server.rb
[*] Reloading /Users/jheysel/rapid7/metasploit-framework/lib/msf/core/exploit/remote/http_server.rb

msf6 auxiliary(gather/magento_xxe_cve_2024_34102) > run
[*] Running module against 127.0.0.1

[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. Detected Magento Community edition version 2.4 which is vulnerable
[*] Using URL: http://172.16.199.1:8080/
[+] File read succeeded!
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/bin/bash
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
_apt:x:42:65534::/nonexistent:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin

msf6 auxiliary(gather/magento_xxe_cve_2024_34102) > set ssl false
[!] Changing the SSL option's value may require changing RPORT!
ssl => false
msf6 auxiliary(gather/magento_xxe_cve_2024_34102) > set rport 80
rport => 80
msf6 auxiliary(gather/magento_xxe_cve_2024_34102) > run
[*] Running module against 127.0.0.1

[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. Detected Magento Community edition version 2.4 which is vulnerable
[*] Using URL: http://172.16.199.1:8080/
[+] File read succeeded!
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/bin/bash
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
_apt:x:42:65534::/nonexistent:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin

jheysel-r7 · 2024-09-04T22:44:32Z

modules/exploits/linux/http/dlink_hnap_login_bof.rb

-      }})
+      },
+      'ssl' => false # do not use SSL
+      })

      datastore['SSL'] = true if ssl_restore


Suggested change

datastore['SSL'] = true if ssl_restore

jheysel-r7 · 2024-09-05T16:09:24Z

Release Notes

The start_service method in the http_server.rb library now allows users to specify their SSL preferences directly through the opts parameter. If the ssl option is not provided in opts, it will default to the value in datastore["SSL"]

heyder added 2 commits July 19, 2024 12:33

Cleanup

dc282f5

sjanusz-r7 reviewed Jul 25, 2024

View reviewed changes

lib/msf/core/exploit/remote/http_server.rb Outdated Show resolved Hide resolved

heyder and others added 2 commits July 25, 2024 19:05

Update lib/msf/core/exploit/remote/http_server.rb

10e4668

Co-authored-by: Simon Janusz <[email protected]>

Removed "ssl_restore = true"

a812617

jheysel-r7 self-assigned this Sep 4, 2024

jheysel-r7 added the enhancement label Sep 4, 2024

jheysel-r7 reviewed Sep 5, 2024

View reviewed changes

Suggestion and rubocop fixes

434593d

jheysel-r7 added the rn-enhancement release notes enhancement label Sep 5, 2024

jheysel-r7 merged commit 1527104 into rapid7:master Sep 5, 2024
63 checks passed

heyder deleted the feature/19329 branch September 12, 2024 07:34

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: Allow explicit SSL configuration in start_service method #19330

feat: Allow explicit SSL configuration in start_service method #19330

heyder commented Jul 19, 2024

heyder commented Jul 19, 2024

jheysel-r7 left a comment

jheysel-r7 Sep 4, 2024

jheysel-r7 commented Sep 5, 2024 •

edited

Loading

feat: Allow explicit SSL configuration in start_service method #19330

feat: Allow explicit SSL configuration in start_service method #19330

Conversation

heyder commented Jul 19, 2024

heyder commented Jul 19, 2024

jheysel-r7 left a comment

Choose a reason for hiding this comment

Before:

After

jheysel-r7 Sep 4, 2024

Choose a reason for hiding this comment

jheysel-r7 commented Sep 5, 2024 • edited Loading

Release Notes

jheysel-r7 commented Sep 5, 2024 •

edited

Loading