A write up on the THM room Vulnerability Capstone & Exploit script for CVE-2018-16763.
A write up on the THM room Vulnerability Capstone & Exploit script for CVE-2018-16763.
I do not take credit for the discovery of this vulnerability. Thank you to the following people.
Vulnerability Discovery:
0xd0ff9
TryHackMe Room & Author:
https://tryhackme.com/room/vulnerabilitycapstone
https://tryhackme.com/p/cmnatic
References:
https://github.com/noraj/fuelcms-rce/blob/master/exploit.rb
https://github.com/daylightstudio/FUEL-CMS/issues/478
https://packetstormsecurity.com/files/164756/Fuel-CMS-1.4.1-Remote-Code-Execution.html
1. Remote Code Execution
Fuel CMS is a content management system for web applications. In version 1.4.1, There is an RCE vulnerability that allows arbitrary PHP code to be evaluated/executed via two different pathways. The first path to RCE is a get request to /fuel/pages/select/ with the filter data parameter. The second pathway is a post request to /fuel/preview with the data parameter. I searched the internet for a while and unfortunately, i was not able to come up with source code showing where the vulnerability was. I suck, I know.....lol. We will now continue to the write up!
Lets start off with some port scans to get a layout of our attack surface. I like rustscan to get a broad overview of the the target before doing a narrowed and focused scan with nmap.
Looks pretty standard. I believe its gonna be SSH & HTTP on these ports however we will run some more scans with nmap to get a more specific idea.
So we have SSH & HTTP running their standard ports. Lets look into the webpage and see what we got!
The webserver is hosting Fuel CMS version 1.4. This version is vulnerable to command injection via PHP code evaluation. Lets have a look at the CVE from NVD below.
There are multiple exploits available for this software. I have provided an exploit in python however its crap. I call it crap because we will have to manually parse the response from the web request to see our commands output. I was unsuccessful in my attempts to cut out the fat. Lets have a look!
I ran the ls -al command. As we can see, the output from the command is between the HTML div elements.
I wont reveal the flag, however ill give a hint! You can start by looking into the home directory. Thank you for reading this write-up. Have fun!
