Selecting the Vulnerability and Fixing the
Let’s consider the following scenario:
during an assessment, we discover a Linux host with an exposed apache2 server.
After enumerating the web server,
we discover an installation of CMS Made Simple listening on TCP port 443.
This version appears to be vulnerable to remote code execution
with a public exploit available on Exploit-DB.
Although this vulnerability is post-authentication,
we’ll assume we’ve discovered valid application credentials on another machine
during the enumeration process.
Our plan then is to adapt the generic public exploit to our target,
obtain remote code execution,
and ultimately upload a web shell that gives us control of the server.
As we inspect the code, we realize the base_url variable needs to be changed
to match our environment.
Let’s modify the IP address and the protocol to HTTPS
to reflect our Debian VM target:
We also notice that, while browsing the target website,
we’re presented with a certificate error.
This error indicates that the certificate on the remote host cannot be validated.
We’ll need to account for this in the exploit code.
Specifically, the exploit is using the requests Python library
to communicate with the target.
The code makes POST requests on lines 34, 55,
And on 80.
The official documentation indicates that the SSL certificate
will be ignored if we set the verify parameter to “False”.
Finally, we also need to change the credentials used in the original exploit
to match those found during the enumeration process.
These are defined in the username and password variables at lines 15 and 16,
respectively.
We can easily replace these credentials.
In this case, we do not need to update the simple payload
since it only executes system commands passed in clear text
within the GET request.
We’ll run the exploit with Python.
Running the exploit generates an unexpected error.
An exception was triggered during the execution of the parse_csrf_token function
on line 24 of the code.
The error indicates that the code tried to access a non-existent element
of a Python list via its second element.
We’ll discuss how to circumvent this issue in the next section.