Playing with Exploits - OMIGod

Key Takeaways

what's going on youtube this is ipsec and i just want to put out a quick video on omi god which is the latest exploit to hit all the headlines that targets mainly linux machines running in azure infrastructure it's an exploit against omi which is open management infrastructure and that's a microsoft package it's primarily used to manage azure linux machines or if you are crazy and want to do dsc desired state configuration i believe on linux i believe you'd install this application as well but the main reason i want to create this video is to show people how to install omi and configure it to be vulnerable on their own local machine because everyone that's been talking about it has been mentioning azure how it's installed by default and not really install instructions in case you wanted to do it on your own to get ircs or just play with the exploit in general and you could always just go and install it from azure but i hate giving microsoft my credit card and spinning something up in the cloud because i always forget to power something down and get a larger build than expected so with all that being said let's jump in there's already a lot of great information out there on the omi exploit so i'm not going to go explaining it first instead i'm going to do what i think is new that i haven't read is how to install omi without azure so the very first thing i did was kind of just googled omi and i added github in it and discovered that it's just a open source application from microsoft and then i went over to the release tab because chances are the most recent version is going to be the one that is patched and we can see release notes security related fix so of course this is the patched one so i'm going to go to an old one this is april 9th it is currently september 17th so this is several months old chances are there's going to be vulnerable so i'm just going to go here and look at the version i actually downloaded this one first so if i just uh let's see copy link and do well first let's actually ssh to a fresh machine so i installed ubuntu on this ip so you can just install ubuntu yourself log into it and then we can w get this package and we can try to install it with the package-i and we see it doesn't work because of ssl so this ssl underscore 100 is meant for ssl version zero point zero i'm on one one one so i'm gonna go here get the other ssl version even though this is one one zero it's still going to work so download this d package dash i again uh actually that was the rpm i clicked definitely want to make sure you get the deb package so uh where is copy link wget d package dash i or my110 and we install this service now if i try to exploit it so let's just go to google oh my god github and pull a exploit script so get clone this awesome go in here and if we python python3 or mygod.pi we can say dasht 192.168.30.136 dash c id and we get an error it's not listening on port 5986 if i do ss lntp because maybe it's the firewall i don't see it listening on 5986 so i'm going to like ps ef grep for omi to make sure it's running we see yep it is indeed running so the next thing to do is look in my configuration so i'm going to go to find and then period for current directory grep omi to see where this configuration is and it looks like it's an etsy opt which is a weird directory but etsy opt omi and then comp and i'm probably going to start with omi server.configuration or myserver.com and we can see um https port is set to zero it says default is 59.86 so i'm going to put that and then save this file and we're going to see what happens if we just restart this so service omid restart i'm assuming it restarted sslntp and now we are listening on port 5986 so i'm going to go back over to my exploit i'm going to run this and we get nothing back so the next step was to look at logs so i'm going to go back into this search the log level i'm going to change this over to debug and the reason why is if i find this i think it's in ver log verilog maybe not see grep log on omi server.com it's probably inver opt omnilog or my log so this is where it is if i cap this file we don't really have anything so let's restart the service again cut the file and oh boy we have quite a bit so let's just try running this exploit again to see what happens looking at this i'm going to do last capital s so um it doesn't do line wrapping if i want to read left i can or read write uh this was kind of gibberish to me so i decided let's take a look at the omi god script itself and we can see it's just sending a big soap payload and if we look right here i just decided to do like print r.text to get the payload or get the result so let's do python3 oh my god actually we have to specify the command and now we're printing the output of the web server and we see the error message the target namespace does not exist i'm going to copy this error message and i'm going to go back to google and let's add omi linux and see what we get there's a lot of dsc stuff which is um desired date controller it's a microsoft technology like um design state configuration to like bootstrap machines and build them think of it like ansible kind of but for powershell and windows so i was looking around here and this one's talking about installing powershell dsc for linux and this doesn't install the namespace we want so if i can find the namespace let's see namespace we get this cim namespace root scx so i added this to my search so let's see where is this root slash s c x and we i think find a package somewhere let's see oh my fails because it doesn't exist scx user that's a weird one let's just try something different let's try scx namespace and what do we get not was expecting i wonder if main space scx gives something different omi here we go so namespace scxomi is eventually what i ended up googling and found this technet article and this is old instructions for installing the system center cross platform which is scx i guess and somewhere on this it gave me a file and i was looking for this agent a lot if i actually went to like the actual um post on oh my god i think they kind of explained it i never got i never tried installing from source i just looked around for this agent and i was searching for like sex deb package and it took me to like a lot of shady sites well i guess maybe if i just click here hindsight's 20 20. i could have just got this package uh so what i had ended up doing is i had trouble finding this package i'm not sure why all of a sudden i can find it so quickly but i did end title index of and i use this a lot when i got to go over to google for this but i use this a lot when i'm looking for things because if i do this it's just going to search for open directory listings so that's not a good one but it's just a good google door to find open directory listings i did scxdeb and it leads me over to this debian package where on microsoft's um repository where i can download it i'm going to try downloading this one since it's on the github i'm just going to copy link and we can try installing this so go back to my machine oh let's go into root wget d package dash i scx and it looks like it is now started i'm going to run the command again and we get output as root so this is essentially how you configure omi or um yeah configure rmi and if you use the outdated version you are vulnerable so if you are vulnerable i'd highly recommend going to the github page and pulling the latest version to update i'm sure maybe it's in a package manager somewhere something but i know this would work if i could actually search google google.com oh man this is getting annoying there we go search google for google okay so oh my github you can just go over to the releases and download the latest one i'm sure it's probably in your package manager hopefully but if not this would fix it so with all this said we should just jump into how this vulnerability works so all it's doing is sending this packet or this http request so let's send the target let's see let's set a proxy and then intercept it in burp suite so let's do proxies is equal to http [Music] 127.01 i think this is how we can do it let me fix that quote there we go and then proxies is equal to proxies on the request let's open up burp suite i hit alt f2 there that's like a unix or a general linux thing in most things to open a thing that will run applications but let's start this and see if i proxied correctly that's one of like the snippets of code that i get wrong quite often it looks like i got wrong right there because intercept is on but not enabled port 8080 is not available oh i have burp suite listening let's intercept and see if it works does not so let's go back here to figure out what i did wrong let's see i wonder if i need to https probably do connection refused uh we probably have to set this to 8080. proxy scheme not supported maybe it's http there we go finally got it so we can see all it's doing is sending a post request and this cert packet and here the command is id and the key thing about this vulnerability is there's no authorization header so let's go and find this blog post and kind of explain what is happening so let's go to oh my god search it on google and it's going to be the one with wiz.io in the domain that you want because this is the original one that has the most details and i'm kind of just going to skim it and go to my understanding you should read this entire thing but the very first bug this article is saying everything could be fixed if they just add these two lines this auth info uid equals invalid id and this would fix it because not sending the authorization header creates two bugs one bug that leads to the rce and the other one that leads to code executing as root so because the authorization header is not sent the variables aren't fully initialized and this uid and gid default to zero if you set it to this invalid id i think it actually gets set to negative one which is invalid user so if you get to the code execution spot it gets to negative one and says oh this isn't a user i'm not going to execute code but because this one isn't initialized and it defaults to zero when we get to the code execution spot it will run as root so this is vulnerability one if it fixes it it indirectly fixes the rce because that code execution will fail if you keep going down they talk about the next piece let's see where the code snippet is come on where is it not there okay right here and they're highlighting out the good pieces i wonder if i can just okay this is just a text block but this if then is going to fail obviously because it's going to receive headers and looking for the authorization one authorization does not exist so this isn't true it goes down to the else and then here it's checking if the auth is failed well the auth didn't happen so it's in a weird state it's not failed so it's going to not hit this check because it doesn't hit this check it goes to this process authorized message which is where the code execution happens so again if uid was initialized to be an invalid user it goes to process authorized message and then down where it does the syscall to execute code it fails because it doesn't have a user but because that uid is uninitialized it defaults to zero and when you get here it will actually execute the code as root so yeah hope that all makes sense and uh yeah the last thing i want to talk about is how these people may have found this bug i don't know i've never talked to them so no idea if this is true or not but they did mention that it was posted on some issue months ago um let's see search for month yeah so another disturbing issue they found is that the commit had been available in the omi github repo for over a month so either they were just fuzzing this application by themselves or they saw something in git and decided to take a look at it so if we just went and googled like omi github oh man erasing my like default to google has started like causing issues if we just google oh my github pull up their page look at the recent commits we can see one on august 12th so this is like over a month ago uh let's go to google days since august 12th 2021 36 days ago and this post was when was the post that's why i was scrolling up come on september 14th so three days ago so for 33 days it kind of went unnoticed and where is the commit so we can just look at this commit to see the kind of things it changed um i wish there was like a side-by-side comparison i did that before let's browse at this time oh well uh oh split this is the way i like viewing it this is the old this is the new so we can kind of see what they change and where is something so here is the code they are changing to um validate that um the user is authorized so let's see can i get up again if we look here maybe i should take this off split view it's around line six thirty two so i can do unified view it's always tough to know what the best way to view it for a video is that's invalid id here we go so right here they're checking hey is this authorization set we went over this no it's not set and then if the office failed well it's actually not set so it's x is out of here anyways and we get here and before this is where it just executed so now they have a second if then check to check if the client is authorized and if they are authorized they now go to the handler additionally we have this set the invalid id and we can go to the actual thing and see let's see view file is it invalid is it set here yeah we can see invalid is a uid set to negative one so yep that is potentially how they found it i'm kind of curious if they found it on their own and then went to github to report it and like oh my they found this like 30 days ago and just didn't notify anyone and it's like extra scary because microsoft themselves aren't going and patching it it's a customer required update so yeah or a customer initiated update whatever you want to say uh you have to update it yourself they installed the software and it's vulnerable or maybe that'll change by the time you watch this video but that's enough of me rambling take care guys and i'll see you next time