Craft CMS register_argc_argv Remote Code Execution

This repository contains a single Metasploit module (modules/exploits/linux/http/craftcms_ftp_template.rb) that exploits a Twig template injection vulnerability (CVE-2024-56145) in Craft CMS. The exploit abuses the --templatesPath argument to force the CMS to load templates from an attacker-controlled FTP server. The module sets up an FTP server, serves a malicious Twig template that executes arbitrary system commands, and triggers the vulnerability via an HTTP GET request to the target. The payload is customizable and allows for remote code execution on the target server. The module is weaponized, supporting custom payloads and full integration with the Metasploit framework. The main attack vectors are network-based, involving both HTTP and FTP protocols. The module references the CVE, relevant research, and is structured according to Metasploit conventions.

This repository is a functional exploit tool targeting CVE-2024-56145, a Remote Code Execution (RCE) vulnerability in Craft CMS (notably version 5.5.0). The exploit is implemented in Python (exploit.py) and provides both vulnerability checking and exploitation capabilities via a command-line interface. The tool can: - Check if a target Craft CMS instance is vulnerable by sending a crafted HTTP GET request with a special parameter (--configPath). - Exploit the vulnerability by: 1. Generating a malicious template file containing a reverse shell payload (with options for bash, nc, or mkfifo shells). 2. Hosting these files on a local FTP server. 3. Triggering the target Craft CMS to fetch the malicious template via the --templatesPath parameter, pointing to the attacker's FTP server. 4. Starting a listener to catch the reverse shell connection from the target. The repository contains two main code files: exploit.py (the main Python exploit) and exploit.gyat (an obfuscated or alternative version, possibly for use with a custom interpreter). The requirements.txt lists necessary Python dependencies. The README.md provides detailed usage instructions, setup guidance for a vulnerable lab, and command-line options. The exploit requires the attacker to control an FTP server and a listener for the reverse shell. The main attack vector is network-based, leveraging HTTP(S) and FTP protocols. The tool is operational and provides a working reverse shell payload, but is not part of a larger exploitation framework.

This repository contains two main Python scripts (poc.py and poc-2.py) and a README.md. The primary exploit (poc.py) is a multi-threaded, multi-process tool designed to identify and exploit a Server-Side Template Injection (SSTI) vulnerability in CraftCMS (using the Twig template engine). The exploit works by: 1. Setting up a malicious FTP server (on port 6666 by default) that serves specially crafted Twig template payloads capable of executing arbitrary commands on the target server. 2. Scanning a list of target URLs (provided via a file) and attempting to trigger the vulnerability by making HTTP requests with the --templatesPath parameter pointing to the attacker's FTP server. 3. If the target is vulnerable, the script can execute arbitrary commands (default: 'id') and records the output in 'vulnerable.txt'. The secondary script (poc-2.py) is a simplified FTP server for manual testing, serving a basic SSTI payload. The README provides usage instructions, including how to run the scripts, configure the attacker's IP, and interpret results. The exploit requires the attacker to have a public-facing server to host the FTP service and targets CraftCMS instances that allow remote template loading via the --templatesPath parameter. The attack vector is network-based, leveraging both HTTP and FTP protocols. The repository is operational, providing real command execution on vulnerable targets.