Subrion CMS Pentesting

Subrion is a content management system (CMS).

File Upload to Reverse Shell (Credential Required)

1. Download Reverse Shell Payload

Get the PHP payload from php-reverse-shell. And change the file extension to '.phar'. Then start a listener.

nc -lvnp 4444

2. Upload the Payload in Subrion Panel

1. Login

2. Move to Content -> Uploads in Panel

3. Upload reverse-shell.phar

4. Access to /subrion/upload/reverse-shell.phar

Now you may get a shell.