Cisco - vmanage
Learn & practice AWS Hacking:
HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: 
HackTricks Training GCP Red Team Expert (GRTE)
Path 1
(Example from https://www.synacktiv.com/en/publications/pentesting-cisco-sd-wan-part-1-attacking-vmanage.html)
After digging a little through some documentation related to confd and the different binaries (accessible with an account on the Cisco website), we found that to authenticate the IPC socket, it uses a secret located in /etc/confd/confd_ipc_secret:
vmanage:~$ ls -al /etc/confd/confd_ipc_secret
-rw-r----- 1 vmanage vmanage 42 Mar 12 15:47 /etc/confd/confd_ipc_secretRemember our Neo4j instance? It is running under the vmanage user's privileges, thus allowing us to retrieve the file using the previous vulnerability:
GET /dataservice/group/devices?groupId=test\\\'<>\"test\\\\\")+RETURN+n+UNION+LOAD+CSV+FROM+\"file:///etc/confd/confd_ipc_secret\"+AS+n+RETURN+n+//+' HTTP/1.1
Host: vmanage-XXXXXX.viptela.net
[...]
"data":[{"n":["3708798204-3215954596-439621029-1529380576"]}]}The confd_cli program does not support command line arguments but calls /usr/bin/confd_cli_user with arguments. So, we could directly call /usr/bin/confd_cli_user with our own set of arguments. However it's not readable with our current privileges, so we have to retrieve it from the rootfs and copy it using scp, read the help, and use it to get the shell:
Path 2
(Example from https://medium.com/walmartglobaltech/hacking-cisco-sd-wan-vmanage-19-2-2-from-csrf-to-remote-code-execution-5f73e2913e77)
The blog¹ by the synacktiv team described an elegant way to get a root shell, but the caveat is it requires getting a copy of the /usr/bin/confd_cli_user which is only readable by root. I found another way to escalate to root without such hassle.
When I disassembled /usr/bin/confd_cli binary, I observed the following:
When I run “ps aux”, I observed the following (note -g 100 -u 107)
I hypothesized the “confd_cli” program passes the user ID and group ID it collected from the logged in user to the “cmdptywrapper” application.
My first attempt was to run the “cmdptywrapper” directly and supplying it with -g 0 -u 0, but it failed. It appears a file descriptor (-i 1015) was created somewhere along the way and I cannot fake it.
As mentioned in synacktiv’s blog(last example), the confd_cli program does not support command line argument, but I can influence it with a debugger and fortunately GDB is included on the system.
I created a GDB script where I forced the API getuid and getgid to return 0. Since I already have “vmanage” privilege through the deserialization RCE, I have permission to read the /etc/confd/confd_ipc_secret directly.
root.gdb:
Console Output:
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Last updated