Description
This module exploits multiple vulnerabilities in Bolt CMS version 3.7.0 and 3.6.* in order to execute arbitrary commands as the user running Bolt.
This module first takes advantage of a vulnerability that allows an authenticated user to change the username in /bolt/profile to a PHP `system($_GET[""])` variable. Next, the module obtains a list of tokens from `/async/browse/cache/.sessions` and uses these to create files with the blacklisted `.php` extention via HTTP POST requests to `/async/folder/rename`. For each created file, the module checks the HTTP response for evidence that the file can be used to execute arbitrary commands via the created PHP $_GET variable. If the response is negative, the file is deleted, otherwise the payload is executed via an HTTP get request in this format: `/files/<rogue_PHP_file>?<$_GET_var>=<payload>`
Valid credentials for a Bolt CMS user are required. This module has been successfully tested against Bolt CMS 3.7.0 running on CentOS 7.
Module options
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
msf > use exploit/unix/webapp/bolt_authenticated_rcemsf undefined(bolt_authenticated_rce) > show actions ...actions...msf undefined(bolt_authenticated_rce) > set ACTION < action-name >msf undefined(bolt_authenticated_rce) > show options ...show and set options...msf undefined(bolt_authenticated_rce) > runPrioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub