Ignite

Fuel CMS

The Version of Fuel CMS 1.4 has a RCE Vulnerability (CVE-2018-16763).

---

Privilege Escalation

• Used Exploit EDB-ID: 49487
• We can catch the Reverse Shell Using netcat

www-data@ubuntu:/var/www/html$ id
uid=33(www-data) gid=33(www-data) groups=33(www-data)

• The Database located in /var/www/html/fuel/application/config/database.php exposes the ROOT Password in Plain-Text.
• root : mememe

$db['default'] = array(
	'dsn'	=> '',
	'hostname' => 'localhost',
	'username' => 'root',
	'password' => 'mememe',
	[...]
);

• Using the Password found in database.php to login as ROOT

root@ubuntu:~$ id
uid=0(root) gid=0(root) groups=0(root)