> For the complete documentation index, see [llms.txt](https://kashz.gitbook.io/kashz-jewels/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kashz.gitbook.io/kashz-jewels/services/rconfig-management.md).

# rconfig management

## Default Creds

```
admin:admin
```

## Interesting Paths

```
[/home]/rconfig/config/config.inc.php
```

## Change Admin Pass (Auth Bypass)

v 3.9.3 | 3.9.4 | 3.9.5

```
# update vars in file
https://www.exploit-db.com/exploits/48878
# option 2 changes admin password admin:Testing1@
```

## Manual Reverse Shell

* <https://gist.github.com/farid007/9f6ad063645d5b1550298c8b9ae953ff>

1. Login > `/vendors.php` > Add Vendor > .php as Vendor Logo
2. Burp the `Content-Type` to `image/gif`
3. File is uploaded at /images/vendor/shell.php?cmd=whoami
4. revshell will auto invoke on page refresh

## Authenticated RCE

v3.9.4 | 3.9.3

* <https://www.exploit-db.com/exploits/48207>

## RCE to root <=3.9.4

* <https://github.com/v1k1ngfr/exploits-rconfig>

Performs chained execution to root

1. CVE-2019-19509 : authenticated RCE
2. CVE-2019-19585 : Local Privilege Escalation (root)
3. CVE-2020-10220 : unauthenticated SQLi