AttackDefense.com [RCE] - CVE-2018-9037 Exploit
Mission
An attacker might get administrative access to a web application. However, this does not automatically mean that the web server can be compromised. In cases where a SaaS application is made available to users, it is routine to give each user admin access to their own instance of the web application, e.g. a managed hosted WordPress site. In such a scenario, an attacker who starts out accessing the application as a managed administrative user will have to figure out how to exploit the administrative interface to get a shell on the server. In some cases, it might be possible to do privilege escalation as well.
In the exercise below, the attacker has administrative access to the web application and needs to find a remote code execution attack to run arbitrary commands on the server.
Monstra CMS is a free and open source lightweight content management system written in PHP.
Monstra CMS (3.0.4) is vulnerable to a Remote Code Execution documented in CVE-2018-9037.
The following username and password may be used to explore the application and/or find a vulnerability which might require authenticated access:
- Username: admin
- Password: password
Level difficulty: Intermediate
Category: Webapps CVEs > Remote Code Execution
Solution
In this lab, I got a basic installation of Monstra CMS (3.0.4), which is known to be affected by multiple vulnerabilities.
The version of the application is shown on the admin panel login page.
After researching this specific vulnerability and all its details on the internet, I discovered this exploit:
As stated in the exploit, I logged in with the provided lab credentials:
I accessed the file manager on the following page:
I created and uploaded my backdoor according to the public exploit:
When I tried to execute the uploaded backdoor, I encountered the following issue:
The current server does not recognize the .PHP file extension as an executable .php file. Unfortunately, not all exploits work as expected across different systems or server configurations. At this point I decided to take a look at the current theme:
As expected, the theme files can be edited and can execute custom PHP code, so I inserted my backdoor as follows:
Wherever the theme files are executed, an attacker can send custom payloads in order to execute local system commands. For example:
