Cisco - vmanage
Cisco - vmanage
Njia 1
(Mfano kutoka https://www.synacktiv.com/en/publications/pentesting-cisco-sd-wan-part-1-attacking-vmanage.html)
Baada ya kuchunguza kidogo kupitia nyaraka zinazohusiana na confd na programu za binary tofauti (zinazopatikana kwa akaunti kwenye tovuti ya Cisco), tuligundua kuwa ili kuthibitisha soketi ya IPC, inatumia siri iliyoko katika /etc/confd/confd_ipc_secret:
Kumbuka kifaa chetu cha Neo4j? Inaendeshwa chini ya mamlaka ya mtumiaji 'vmanage', hivyo kuturuhusu kupata faili kwa kutumia udhaifu uliopita:
Programu ya confd_cli haiungi mkono hoja za mstari wa amri lakini inaita /usr/bin/confd_cli_user na hoja. Kwa hivyo, tunaweza kuita moja kwa moja /usr/bin/confd_cli_user na seti yetu ya hoja. Hata hivyo, haionekani kwa urahisi na mamlaka yetu ya sasa, kwa hivyo tunapaswa kuipata kutoka kwenye rootfs na kuikopy kupitia scp, kusoma msaada, na kuitumia ili kupata kikao cha amri:
Njia 2
(Mfano kutoka https://medium.com/walmartglobaltech/hacking-cisco-sd-wan-vmanage-19-2-2-from-csrf-to-remote-code-execution-5f73e2913e77)
Blogi¹ ya timu ya synacktiv ilielezea njia nzuri ya kupata kikao cha root, lakini shida ni kwamba inahitaji kupata nakala ya /usr/bin/confd_cli_user ambayo inaweza kusomwa tu na root. Nilipata njia nyingine ya kuongeza hadi kwa root bila usumbufu kama huo.
Nilipovunja vipande vipande faili ya /usr/bin/confd_cli, niliona yafuatayo:
Nilipokimbia "ps aux", niliona yafuatayo (note -g 100 -u 107)
Nilidhani programu ya "confd_cli" inapitisha kitambulisho cha mtumiaji na kikundi ambacho kilikusanywa kutoka kwa mtumiaji aliyeingia kwenye programu ya "cmdptywrapper".
Jaribio langu la kwanza lilikuwa kukimbia moja kwa moja programu ya "cmdptywrapper" na kuiwezesha na -g 0 -u 0, lakini lilishindikana. Inaonekana kuna kitambulisho cha faili (-i 1015) kilichoundwa mahali fulani njiani na siwezi kukidanganya.
Kama ilivyotajwa katika blogu ya synacktiv (mfano wa mwisho), programu ya confd_cli haikubali vigezo vya amri ya mstari, lakini naweza kuathiri kwa kutumia kisakuzi na bahati nzuri GDB imejumuishwa kwenye mfumo.
Niliumba skripti ya GDB ambapo nililazimisha API ya getuid na getgid kurudisha 0. Tangu tayari nina ruhusa ya "vmanage" kupitia RCE ya deserialization, nina idhini ya kusoma moja kwa moja /etc/confd/confd_ipc_secret.
root.gdb:
Cisco vManage
Description
Cisco vManage is a cloud-based network management platform that provides centralized control and visibility for Cisco SD-WAN devices. It allows network administrators to monitor, configure, and troubleshoot their SD-WAN infrastructure.
Privilege Escalation
Exploiting Misconfigurations
Default Credentials
Some versions of Cisco vManage may have default credentials that can be used to gain unauthorized access. Attackers can try common default usernames and passwords to exploit this misconfiguration.
Weak Passwords
If weak passwords are used for the Cisco vManage platform, attackers can use brute-force or dictionary attacks to guess the password and gain unauthorized access.
Exploiting Vulnerabilities
Remote Code Execution
If a vulnerability exists in the Cisco vManage platform that allows remote code execution, attackers can exploit it to execute arbitrary commands with elevated privileges.
SQL Injection
If the Cisco vManage platform is vulnerable to SQL injection attacks, attackers can manipulate database queries to gain unauthorized access or escalate privileges.
Exploiting Misconfigured Permissions
If the permissions on the Cisco vManage platform are misconfigured, attackers can exploit this to gain unauthorized access or escalate privileges. This can include misconfigured file or directory permissions, allowing attackers to read, write, or execute files they shouldn't have access to.
Mitigation
To mitigate privilege escalation risks in Cisco vManage, follow these best practices:
Change default credentials immediately after installation.
Use strong passwords that are resistant to brute-force or dictionary attacks.
Regularly update the Cisco vManage platform to patch any known vulnerabilities.
Implement proper access controls and permissions to prevent unauthorized access.
Regularly review and audit the configuration of Cisco vManage to identify and fix any misconfigurations.
By following these best practices, you can reduce the risk of privilege escalation attacks on your Cisco vManage platform.
Last updated