Moodle RCE (CVE-2024-43425) Module #19430
Conversation
placeholder for CVE-2024-43425
| end | ||
| print_good('Server reachable.') | ||
|
|
||
| moodlesession = res.get_cookies.scan(/MoodleSession=([^;]+)/).flatten[0] |
There was a problem hiding this comment.
Would you be able use 'keep_cookies' => true instead of manually extracting moodlesession?
There was a problem hiding this comment.
In this case I had issues getting it to work with keep_cookies, as sometimes an expected cookie was not present in the order the requests are being sent to the server, if I remember correctly.
| 'mform_isexpanded_id_multitriesheader' => '0', | ||
| 'mform_isexpanded_id_tagsheader' => '0', | ||
| 'category' => "#{category},#{course_context_id}", | ||
| 'name' => 'XXXXXXXXXXXXXXXX', |
There was a problem hiding this comment.
Could this, and maybe some of the other values being sent here, be randomized?
There was a problem hiding this comment.
Yes, I used hardcoded values to get an initial PoC working. I'll see which ones I can randomize and update the code accordingly.
|
Hello teacher, I found that the 6.4.26 version of msfconsole does not integrate this vulnerability library, where can I get this vulnerability library? |
|
@ABC20236 It hasn't been merged yet. If you'd like to use it already, you can add it yourself by copying the files from this PR (located at https://github.com/rapid7/metasploit-framework/pull/19430/files). The module is still a draft, but should work. @jheysel-r7 Thank you for your feedback! Hopefully I have more time in the coming days to work through your comments (as well as for the other pending PRs) and update the module(s) accordingly. |
|
Teacher, thank you so much for your help, I used the file you provided to test locally, but I encountered the following problem, due to limited ability, I hope to get your help. |
|
Thank you for reporting the bug. Can you please enter As this module is still a draft, it has a couple issues with handling error cases, missing code optimizations, etc. |
Awesome, let us know if you need any help getting it over the line for landing 🎉 |
|
@adfoster-r7 Thank you, I appreciate it. I'll try to provide an update this week. |
|
Finally pushed some (minor) updates. @adfoster-r7 If you or someone else from your team has some cycles to help get this merged, that would be great. I probably won't have much time left this year to work on modules. |
h4x-x0r
changed the title
This is a new module which exploits a command injection vulnerability in Moodle (CVE-2024-43425) to obtain remote code execution. By default, the application will run in the context of www-data, so only a limited shell can be obtained.
Valid credentials are required to exploit this vulnerability. Moreover, the user must be authorized to either add a new or modify an existing quiz, in order to reach the vulnerable function and trigger the bug. User roles that fall into this category include
TeacherandAdministrator, but might differ depending on the specific deployment and configuration.Verification Steps
Teacher) and assign it to the previously created course.<IP>/moodle/course/view.php?id=3).IP>/moodle/mod/quiz/edit.php?cmid=4).msfconsoleuse exploit/linux/http/moodle_rceset USERNAME <USER>set PASSWORD <PASSWORD>set CMID <ID>set COURSEID <ID>set RHOSTS <IP>set LHOST <IP>exploitNotes
Obtaining the course ID and course module ID has to be done manually by the user running the module. While it could be automated, there are too many variables to consider (multiple courses, multiple quizzes, specific configurations of these, specific permissions assigned to the given user, etc.). Since it is fairly trivial to obtain these from the address bar while browsing Moodle, it shouldn't be a big burden for the user.
I played around with different timeouts and similar properties, but the current draft of the module always results in a shell that isn't directly caught when the module is executed:
While it's not a big issue to manually select the session, it would be nicer if it gets caught while running the module. Is there a specific MSF directive or property I can add to make this more reliable in my module?
Currently no
checkmethod is implemented, as I didn't see an endpoint that returns the version details to an unauthenticated user.I'm leaving it as a draft for now, as I still want to do some cleanup and improvements, as well as incorporate some of the feedback that I got in other PRs that apply here too. However, the current code should work in the majority of cases as is, in case someone would like to test it already.