-Pluck-CMS-RCE-CVE-2023-50564

exploit.py 🐍💥

⚠️ Legal / ethical notice: this script is only for authorized environments ✅ (CTFs, labs, pentesting with permission). Do not use it against systems without authorization ❌.

🧾 What does this script do?

exploit_greenhorn.py automates a typical exploitation chain on a web panel:

✅ Logs into the panel (valid password required) ✅ Creates a ZIP in memory (without writing local files) 📦 ✅ Inserts a rev.php with a reverse shell inside 🔁🐚 ✅ Uploads the ZIP as a "module" to the panel 🧩⬆️ ✅ "Detonates" the payload by opening the uploaded PHP URL 🚀

📌 The module name is randomly generated to avoid conflicts (e.g.: abcdefg, xqpmzui, etc.) 🎲

🧰 Requirements

Python 3.8+ 🐍

Dependency: requests 📌

Installation: install the requests library with pip (pip install requests) ✅

⚙️ Configuration (IMPORTANT 🔧)

Inside the script there is a "TUS DATOS" section that you must adjust:

RHOST_DOMAIN 🌐 → target URL (include http:// or https://)

LHOST_IP 🧭 → your IP where you want to receive the shell (usually the VPN/tun0 one)

LHOST_PORT 🔌 → port you will listen on

PASSWORD 🔑 → panel password (the script does not brute force)

✅ Tip: the most common failure is LHOST_IP (put the correct IP of your VPN interface) 😅

🎧 Listener (before running)

Before launching the exploit, open a listener to receive the reverse shell 👂🐚

Example: netcat listening on the same port you set in LHOST_PORT (e.g. 4444). If you are not listening, nothing arrives 📭.

▶️ Usage

Configure RHOST_DOMAIN, LHOST_IP, LHOST_PORT and PASSWORD ✅

Open your listener 🎧

Run the script with Python 🐍

Typical output you might see:

[] Target: http://greenhorn.htb

[] Creating clean module: xqpmzui [] Logging in... [+] Login OK. [] Uploading payload... [*] Detonating at: http://greenhorn.htb/data/modules/xqpmzui/rev.php

[+] Timeout! (Good sign, check your netcat)

😎 Note: the "Timeout! (Good sign)" is usually NORMAL ✅ Because when the PHP opens the reverse shell, the web request may "hang" while the interactive session is alive 🔁

🧠 How does it work internally? (explained simply)

Generates a random module name 🎲

Creates a ZIP in memory 📦 (flat structure, no internal folders)

Inside it places rev.php with a reverse shell that connects to your LHOST_IP:LHOST_PORT 📡

Logs in at /login.php 🔑 (includes Referer for compatibility)

Uploads the ZIP to /admin.php?action=installmodule ⬆️🧩

Executes the payload by accessing /data/modules/<module_name>/rev.php 🚀🐚

🧪 Troubleshooting (if something fails)

❌ Login failed

Check PASSWORD 🔑

Confirm that the endpoint is /login.php

Sometimes in labs you need to restart the machine/service 🔄

❌ Shell does not arrive

Verify LHOST_IP 🧭 (the correct IP, usually tun0)

Confirm you are listening on the correct port 🔌🎧

Try another port if there is filtering (e.g. 443 or 9001) 🚧

❌ 404 when detonating

The module may not have been installed 🧩

Some installations change paths; check the /data/modules/ structure 📁

🛡️ Notes

No ZIP left on local disk (everything is in memory) ✅

Imports sys but does not use it (you can clean it up if you want) 🧹

Use it wisely 🧠😄

✅ Final disclaimer

No warranty. For educational and authorized use only. If you use it without permission, it's your responsibility 🚫⚖️