Tonggy T0NG-J

This Gist provides a Proof-of-Concept (POC) for CVE-2023-41892, a Craft CMS vulnerability that allows Remote Code Execution (RCE).

Overview

CVE-2023-41892 is a security vulnerability discovered in Craft CMS, a popular content management system. Craft CMS versions affected by this vulnerability allow attackers to execute arbitrary code remotely, potentially compromising the security and integrity of the application.

POC

This POC is depending on writing webshell, so finding a suitable folder with writable permission is necessary.

FCC: Technical Documentation Page

A Pen by freeCodeCamp.org on CodePen.

License.

	# Backup the existing system certificates to the user certs folder
	cp /system/etc/security/cacerts/* /data/misc/user/0/cacerts-added/

	# Create the in-memory mount on top of the system certs folder
	mount -t tmpfs tmpfs /system/etc/security/cacerts

	# copy all system certs and our user cert into the tmpfs system certs folder
	cp /data/misc/user/0/cacerts-added/* /system/etc/security/cacerts/

	# Fix any permissions & selinux context labels

	# Create a separate temp directory, to hold the current certificates
	# Otherwise, when we add the mount we can't read the current certs anymore.
	mkdir -p -m 700 /data/local/tmp/tmp-ca-copy

	# Copy out the existing certificates
	cp /apex/com.android.conscrypt/cacerts/* /data/local/tmp/tmp-ca-copy/

	# Create the in-memory mount on top of the system certs folder
	mount -t tmpfs tmpfs /system/etc/security/cacerts

	set -g mouse on

	#set-window-option -g mode-keys vi
	#set -g status-keys vi

	#tmux copy vi mode
	setw -g mode-keys vi

	set -g @tmux_power_user_icon '㉿'