The “config -> load” feature from Viptela SSH shell uses “wget” to fetch remote “command” files over FTP. By hosting a malicious FTP server and replacing the local files created by wget with symlinks, an attacker can abuse the “root” privileges with which the commands are run to read the first line of arbitrary files.
By reading the secret from “/etc/confd/confd_etc_secret”, the attacker is able to obtain an interactive shell with “root” privileges on the machine.
The vendor's disclosure and fix for this vulnerability can be found here.
This vulnerability requires:
- Access to the Viptela shell (e.g. via SSH)
OR - Access to the local system
More details and the exploitation process can be found in this PDF.
Article by Johnny "straight_blast" Yu detailing how to use the "/etc/confd/confd_etc_secret" secret + GDB to gain a root shell
The original ftp_server script used and modified in this exploit was taken from here