Postauth RCE in Centreon 19.10

Few hours ago I decided to check latest version of Centreon Monitoring Tool (19.10). Below you will find few notes from the journey. Here we go...
Today we will start here:

I downloaded 'latest available version' (of VM):

After a while I decided to check log files of webserver (sometimes we can find interesting hints there;)):

Hm... ;] Looks interesting, isn't it? ;)

Next step:

Still nothing...

When I was looking for the reason, this line appeared in the log file:

Well... ;] Again Neo!

Good! We got it. ;] So the last stage was to prepare a valid reverse shell. I used base64'd version of one of the bash-oneliners available here.

Checking:

If you are looking for a root - try here:

Maybe you'll find it useful. ;)

See you next time.

Cheers