Umbraco - 80

Browsing through, this is the only page that's interesting. There was also a /intranet page that's empty so I ran directory fuzzing.

Visiting them seems like they are still under development. I get runtime errors:

Using the credentials found earlier I was able to log in:

Before I look for exploits, I need to footprint the CMS for version numbers. Clicking on help:

We know its version 7.12.4

There is an authenticated code execution vulnerability on this exact CMS version in exploit-db.

This deep dive explains the vulnerability in details which I think is important to understand instead of blindly just exploiting the vulnerability.

There are some modifications that needs to be done to the PoC.

First lets create a shell.ps1 file. I copied the Shells/Invoke-PowerShellTcp.ps1 file and added this line at the bottom

Started a listener:

And the modified part of the PoC:

This will make a GET request for shell.ps1:

And it will execute it and we get a shell.

PreviousNFS - 2049NextFoothold

Last updated