CVE-2018-6389 PoC node js multisite with proxy

This script is based on CVE-2018-6389, a rather insidious problem in Wordpress, which unfortunately will likely not be fixed by the team developing the platform, even though it has been known for quite some time.

!!! IMPORTANT BEFORE YOU CONTINUE !!! The entire repo and information shared here is free to use in any form - copying, upgrading, modifying for the purpose of improvement or other purposes, as well as sharing. Using the shared information for purposes other than educational, for experimentation and/or to protect your own Wordpress-based platform is likely in conflict with a number of laws with which I am not familiar. Do not use the script to attack websites! I am not responsible for your actions. By using it you agree to these terms. A DDoS attack (denial of service) directed at a website that is not your own property may be perceived as a terrorist attack. !!! MAKE SURE YOU ARE ABSOLUTELY CERTAIN OF YOUR ACTIONS AND THINK CAREFULLY BEFORE YOU PROCEED !!!

I wrote the script a long time ago, but since I know you are very cool, I decided to share it with you. Use it as intended! Really...

What it's about

There is a lot of information on the topic on the web, as well as several ready-made scripts, most often written in Python like Shiva and this one, from which I drew a lot of inspiration when I wrote it, and with which you can also test this "weakness" in an isolated environment, but because I am a "sairdzhia", I decided to add a few "goodies".

You can read an interesting blog on the topic here

In short, if you load https://your-wordpress-site.com/wp-admin/load-scripts.php?c=1&load=editor,common,user-profile,media-widgets,media-gallery (of course changing the link to point to your instance) and what appears on the screen is "some js dude", then the site has a problem. Each listed parameter in the query string is a filename that is not cached. That is, it performs an IO operation for each file from the disk, collects them into one, and returns it to the client. But the files are quite a lot. Many more than the resources required to request it a few times. Let's say that with one laptop and about 50 mb downlink, about 30 sites of average quality - hosting, they hold out 20-30 seconds before finally dying.

Other requirements

• NodeJS 8.11.2
• Working Wordpress instance(s).
• You need to perform a very simple check of the individual proxies, on a machine that is accessible via the internet. A GET request that returns the IP address from which your server sees the request as a string. Not all proxy servers are "anonymous"! Also, this procedure validates that the proxy is working before starting the attack itself.

Structure:

• The file websites.js contains a list of sites - "victims", from which I accidentally forgot to remove a few leftovers that I am certain are vulnerable when in contact with the script. I swear I never tried it, I just think so.

• The file userAgents.js contains a list of user-agents that are randomly selected for each individual request to the victims.

• fileList.js contains a list of individual files to be loaded from the "victim", so that when Wordpres is updated, they can easily be added or corrected.

• The execution script itself is in index.js.

Parameters

• countries is an array of countries from which to search for proxies. (which countries the attacks should come from, through the proxies)
• wanCheckUrl is the full address that the script will query and "look" to see if it is through a transparent proxy.
• requestTimeout is the time in milliseconds for which a proxy will be considered non-working if it has not connected.
• maxRequests is the limit of requests from the machine to the "victims". A number that is too large can significantly load your machine as well. About 30 parallel requests are needed for one site on mid-level hosting.

Procedure:

• The script queries the automatic proxy check and records the IP address with which it is visible in public space.
• It starts searching for free proxies from various public lists.
• When each one appears, a request is made to the automatic proxy check and if the address with which our service responds is different from the first time, the proxy is saved in an array and the attack execution begins.
• Roughly, the script rotates the victims through each proxy on a round-robin basis and there is nothing special in the logic, it just makes as many requests as possible, through as many different and working proxies as possible.

Information about each "victim" is displayed in color in the console, and those under DDoS are colored in red.

npm install
//редактирай webstites.js
node index.js

Google Dork for "victims"

inurl: “wp-admin/load-scripts.php”

I decided to dedicate this script to my favorite TV station tvsz, because I know they are big "fans" of mine and most of all, because they will find the link to their site in my list. Meaning I will boost their rating a bit, to return an old "favor". Also, I take the opportunity to greet dad, who had a name day yesterday, but I didn't have time to call him.