{"action":"opened","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6056","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6056/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6056/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6056/events","html_url":"https://github.com/rapid7/metasploit-framework/issues/6056","id":110168057,"number":6056,"title":"WordPress Plugins Backup Scanner - Search for backups installed by insecures plugins ","user":{"login":"Wad-Deek","id":15005059,"avatar_url":"https://avatars.githubusercontent.com/u/15005059?v=3","gravatar_id":"","url":"https://api.github.com/users/Wad-Deek","html_url":"https://github.com/Wad-Deek","followers_url":"https://api.github.com/users/Wad-Deek/followers","following_url":"https://api.github.com/users/Wad-Deek/following{/other_user}","gists_url":"https://api.github.com/users/Wad-Deek/gists{/gist_id}","starred_url":"https://api.github.com/users/Wad-Deek/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Wad-Deek/subscriptions","organizations_url":"https://api.github.com/users/Wad-Deek/orgs","repos_url":"https://api.github.com/users/Wad-Deek/repos","events_url":"https://api.github.com/users/Wad-Deek/events{/privacy}","received_events_url":"https://api.github.com/users/Wad-Deek/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-10-07T07:39:16Z","updated_at":"2015-10-07T07:39:16Z","closed_at":null,"body":"#============================================\r\n# /opt/metasploit-framework/modules/auxiliary/scanner/http/\r\n#============================================\r\n\r\n#-------------------------------------------------------------------------------------------------------------\r\nrequire('msf/core')\r\n#-------------------------------------------------------------------------------------------------------------\r\nclass Metasploit3 < Msf::Auxiliary\r\ninclude Msf::Exploit::Remote::HttpClient\r\n#-------------------------------------------------------------------------------------------------------------\r\ndef initialize(info = {})\r\nsuper(\r\nupdate_info(\r\ninfo,\r\n\"Name\" => \"WordPress Plugins Backup Scanner\",\r\n\"Description\" => %q{Search for backups installed by insecures plugins},\r\n\"Author\" => [\"Wad.Deek\"],\r\n\"Privileged\" => false,\r\n\"License\" => MSF_LICENSE\r\n)\r\n)\r\nregister_options(\r\n[\r\nOptString.new(\"TARGETURI\", [true, \"The path of wordpress core\", \"/\"])\r\n], self.class())\r\nend\r\n#-------------------------------------------------------------------------------------------------------------\r\ndef run()\r\nbackups = <<BACKUPS\r\nbak/\r\nback/\r\nbackup/\r\nbackups/\r\ndbbkp/\r\ndownloadBkp/\r\nsimple-backup/\r\nadministrator/backups/\r\nwp-content/backup/\r\nwp-content/backups/\r\nwp-content/as3b_backups/\r\nwp-content/updraft/\r\nwp-content/wpadm_backups/\r\nwp-content/easy-backup-storage/\r\nwp-content/wpclone-temp/wpclone_backup/\r\nwp-content/backupbuddy_backups/\r\nwp-content/backupbuddy_temp/\r\nwp-content/wpbackitup_backups/\r\nwp-content/wpbackitup_restore/\r\nwp-content/wp-backup-bank/\r\nwp-content/backup-db/\r\nwp-content/wprecovery_backup/\r\nwp-content/bps-backup/\r\nwp-content/s3bubblebackups/\r\nwp-content/CentroraBackup/\r\nwp-content/infinitewp/backups/\r\nwp-content/aiowps_backups/\r\nwp-content/backup-wp/\r\nwp-content/managewp/backups/\r\nwp-content/cache/supercache/\r\nwp-content/uploads/backup/\r\nwp-content/uploads/backups/\r\nwp-content/uploads/wpbu-backups/\r\nwp-content/uploads/SQL_Backups/\r\nwp-content/uploads/wp-backup-plus/\r\nwp-content/uploads/wp-backup-plus/temp/\r\nwp-content/uploads/wp-backup-plus-backups/\r\nwp-content/uploads/wpbu-backups/\r\nwp-content/uploads/backwpup/\r\nwp-content/uploads/p3/backup/\r\nwp-content/uploads/snapshots/\r\nwp-content/uploads/aiowps_backups/\r\nwp-content/uploads/backwp_backups_db/\r\nwp-content/uploads/wp-clone/\r\nwp-content/uploads/backupcreator/\r\nwp-content/uploads/wp-migrate-db/\r\nwp-content/plugins/wp-auto-backup/WordPress_BackUps/\r\nwp-content/plugins/complete-central-backup/backups/\r\nwp-content/plugins/wp-complete-backup/storage/\r\nwp-content/plugins/db-backup/\r\nwp-snapshots/\r\nBACKUPS\r\nbackups.split(\"\\n\").each() do |backup|\r\nbegin\r\nuri = target_uri.path()\r\nmalicious = uri+backup\r\nres = send_request_cgi({\"method\" => \"GET\", \"uri\" => malicious})\r\nrescue Exception => e\r\nprint_error(e.message())\r\nelse\r\nif(res and res.code() == 200 and res.to_s().include?(\"<title>Index of /\") and res.to_s().include?(\"<h1>Index of /\"))\r\nprint_status(\"{\"+malicious+\"}\")\r\nres.body().scan(/<a href=\\\"(.+?)\\\">/).each() do |line|\r\nprint_good(line.inspect())\r\nend\r\nelse()\r\nprint_error(\"{\"+malicious+\"}\")\r\nend\r\nend\r\nend\r\nend\r\nend\r\n#-------------------------------------------------------------------------------------------------------------\r\n"}}