What this version changes

The original EDB-49973 requires manually editing hardcoded values in the script. This version adds:

• Command-line arguments for target, LHOST, LPORT
• Automatic base64 encoding of the reverse shell payload
• Custom command support (-c)
• Error handling and status output

These are usability changes to an existing exploit. No vulnerability research is claimed.

Vulnerability

The Grav Admin plugin fails to verify authentication on certain admin routes, allowing unauthenticated users to write arbitrary YAML configuration. This exploit abuses the scheduler configuration to create a cron job that executes arbitrary PHP code.

Usage

Examples

Requirements

How It Works

1. Fetches /admin to extract the admin-nonce token (no auth required due to vulnerability)
2. Sends POST to /admin/config/scheduler with malicious cron job configuration
3. Scheduler executes PHP payload via /usr/bin/php -r eval(base64_decode(...))
4. PHP writes base64-decoded reverse shell to /tmp/rev.sh and executes it

The cron job runs every minute (* * * * *), so shell arrives within 60 seconds.

Timeline

• 2021-03-18 - Vulnerability found by Mehmet Ince during a penetration test
• 2021-03-29 - Disclosed
• 2021-04-01 - Patched in Grav Admin Plugin 1.10.8

References

• NVD Entry
• GitHub Security Advisory GHSA-6f53-6qgv-39pj
• Original writeup by Mehmet Ince (Pentest Blog)
• Original PoC - Exploit-DB EDB-49973

Licence

MIT, applying only to the modifications in this repository. The upstream PoC carries no licence, so it remains all rights reserved by its author. See LICENSE for the full attribution notice.

Disclaimer

For authorized security testing only. Ensure you have written permission before testing against any system.