PiHole RCE - The Full Shell Puzzle

In my quest to get better with code review I decided to look at applications I run on my network. PiHole was a perfect target because PHP is relatively easy to read and is often riddled with issues. While reviewing the code I noticed something strange. PiHole uses quite a bit of shell commands and often with user input. The approach they've taken to prevent malicious payloads is to check against regular expressions. This is a solid approach if the regex is strict enough.

CVE: CVE-2021-32706

note: The version in the screenshots is v5.5

POC: Pihole POC

The Mistake

On the settings -> API / Web interface when you save you hit this block of code:

1//savesettings.php line 444
2case "API":
3
4	// Explode the contents of the textareas into PHP arrays
5	// \n (Unix) and \r\n (Win) will be considered as newline
6	// array_filter( ... ) will remove any empty lines
7	$domains = array_filter(preg_split('/\r\n|[\r\n]/', $_POST["domains"]));
8	$clients = array_filter(preg_split('/\r\n|[\r\n]/', $_POST["clients"]));
9
10	$domainlist = "";
11	$first = true;
12	foreach($domains as $domain)
13	{
14  		if(!validDomainWildcard($domain) || validIP($domain))
15		{
16			$error .= "Top Domains/Ads entry ".htmlspecialchars($domain)." is invalid (use only domains)!<br>";
17		}
18		if(!$first)
19		{
20			$domainlist .= ",";
21		}
22		else
23		{
24			$first = false;
25		}
26		$domainlist .= $domain;
27	}
28
29	$clientlist = "";
30	$first = true;
31	foreach($clients as $client)
32	{
33  		if(!validDomainWildcard($client) && !validIP($client))
34		{
35			$error .= "Top Clients entry ".htmlspecialchars($client)." is invalid (use only host names and IP addresses)!<br>";
36		}
37		if(!$first)
38		{
39			$clientlist .= ",";
40		}
41		else
42		{
43			$first = false;
44		}
45		$clientlist .= $client;
46	}

The user input we care about comes in the form of $_POST["domains"] and $_POST["clients"] and you can see the only meaningful check performed on it is the validDomainWildcard check. Taking a look at that code will introduce the first issue:

1function validDomainWildcard($domain_name)
2{
3	// There has to be either no or at most one "*" at the beginning of a line
4  	$validChars = preg_match("/^((\*.)?[_a-z\d](-*[_a-z\d])*)(\.([_a-z\d](-*[a-z\d])*))*(\.([_a-z\d])*)*$/i", $domain_name);
5	$lengthCheck = preg_match("/^.{1,253}$/", $domain_name);
6	$labelLengthCheck = preg_match("/^[^\.]{1,63}(\.[^\.]{1,63})*$/", $domain_name);
7	return ( $validChars && $lengthCheck && $labelLengthCheck ); //length of each label
8}

This is a pretty simple check with one big flaw. The regular expression is checking to see if the user is passing in some form of *.foobar.com ( regex101 is super helpful) with the only special chars allowed being -_, except the developer forgot to escape the period in the $validChars check! So what does this mean?

If we pass this check we land inside this code where $domainlist is user controlled input.

1				// Set Top Lists options
2if(!strlen($error))
3{
4	// All entries are okay
5	pihole_execute("-a setexcludedomains ".$domainlist);
6	pihole_execute("-a setexcludeclients ".$clientlist);
7	$success .= "The API settings have been updated<br>";
8}

The implementation of pihole_execute is pretty simple, it escapes the argument string, and runs sudo pihole + argument. In our case it would look like sudo pihole -a setexcludedomains USERINPUT

Unfortunately since user input is escaped we will only be able to supply arguments. This is a pretty common thing though when executing system commands in code. That just means we need to look at what that command is doing

Remote Code Execution By Source

To dive deeper we need to see what the pihole shell command does with our input. The important chain of code our input follows:

1#webpage.sh line 340
2SetExcludeDomains() {
3    change_setting "API_EXCLUDE_DOMAINS" "${args[2]}"
4}

1change_setting() {
2    delete_setting "${1}"
3    add_setting "${1}" "${2}"
4}

1add_setting() {
2 echo "${1}=${2}" >> "${setupVars}"
3}

TLDR: our user input gets echoed to the /etc/pihole/setupVars.conf file. So far we haven't seen a way to actually execute commands yet, but looking through the files it becomes apparent this file gets sourced often. This means we can have valid bash inside a file and when it is sourced, it will execute that bash! Perfect. You can intentionally trigger this at the /admin/gravity.php endpoint. Interestingly enough you actually get the output from the command running as well.

This will run sudo pihole -g so it will execute your payloads with root privileges. So with a payload like: *;ls we will list the directory.

The Massive Hurdle

Yay! Remote code execution! Now of course it's time to get a reverse shell...but we can only enter one command at a time. Oh no. So what we know:

1. Can enter one special character per domain
2. Can chain domains I.E

   1	*;ls
   2	*;whoami
   

   gets turned into API_EXCLUDE_DOMAINS=*;ls,*;whoami
3. Can change our directory context to /root by exploiting both $_POST params and setting first to *;cd.
4. Can write/overwrite files >
5. The magic of * ?
6. Set to other env vars.

These were the things I was able to figure out through trial and error but unfortunately nothing allowed more than one command at a time. The most interesting functionality was the *. If you run * as a command it will expand all the files in your current directory into the command line.

All in all I was unable to figure out a way to get it working but if you are able to figure it out please let me know. Thanks for reading.