Rapid7 Vulnerability & Exploit Database

Rconfig 3.x Chained Remote Code Execution

Back to Search

Rconfig 3.x Chained Remote Code Execution

Disclosed
03/11/2020
Created
03/16/2020

Description

This module exploits multiple vulnerabilities in rConfig version 3.9 in order to execute arbitrary commands. This module takes advantage of a command injection vulnerability in the `path` parameter of the ajax archive file functionality within the rConfig web interface in order to execute the payload. Valid credentials for a user with administrative privileges are required. However, this module can bypass authentication via SQLI. This module has been successfully tested on Rconfig 3.9.3 and 3.9.4. The steps are: 1. SQLi on /commands.inc.php allows us to add an administrative user. 2. An authenticated session is established with the newly added user 3. Command Injection on /lib/ajaxHandlers/ajaxArchiveFiles.php allows us to execute the payload. 4. Remove the added admin user. Tips : once you get a shell, look at the CVE-2019-19585. You will probably get root because rConfig install script add Apache user to sudoers with nopasswd ;-)

Author(s)

  • Jean-Pascal Thomas
  • Orange Cyberdefense

Platform

Linux,Unix

Architectures

cmd

Development

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':

msf > use exploit/linux/http/rconfig_ajaxarchivefiles_rce
msf exploit(rconfig_ajaxarchivefiles_rce) > show targets
    ...targets...
msf exploit(rconfig_ajaxarchivefiles_rce) > set TARGET < target-id >
msf exploit(rconfig_ajaxarchivefiles_rce) > show options
    ...show and set options...
msf exploit(rconfig_ajaxarchivefiles_rce) > exploit

Metasploit

Penetration testing software for offensive security teams.
Key Features
Free Metasploit Pro Trial View All Features

Time is precious, so I don’t want to do something manually that I can automate. Leveraging the Metasploit Framework when automating any task keeps us from having to re-create the wheel as we can use the existing libraries and focus our efforts where it matters.

– Jim O’Gorman | President, Offensive Security

;