środa, 22 kwietnia 2015

plupload - Same-Origin Method Execution [Wordpress 3.9 - 4.1.1]

This January I've found and reported XSS vulnerability in plupload, that affects Wordpress from 3.9 to 4.1.1.  As far as there was no ability to control arguments of function called - the "only" thing we could do with this issue was Same-Origin Method Execution.

Before you start reading technical details - you should update your Wordpress / plupload first.

If you will dig a bit in Flash plupload 2.1.2 source code, you can notice interesting thing in _init() function:


...and _fireEvent()


So we can manipulate with target GET parameter to execute javascript functions, but we can use only alphanumeric characters and dot. Still can be useful, the scenario goes like this:

1. In first tab create new window with target _blank and URL http://hostname/proxy.php
2. Then redirect first tab to http://target-wordpress/wp-admin/plugin-install.php?tab=plugin-information&plugin=google-analytics-dashboard-for-wp&section=description - of course you can use any other plugin install page.
3. The second's tab proxy.php sleeps for few seconds and then redirect to vulnerable plupload on target-wordpress calling this function:


window.opener.document.body.lastChild.previousElementSibling.previousElementSibling.previousElementSibling.lastChild.click()

4. ....aaaand plugin is installed now. ;-)

This one can be of course more automated and faster to install malicious, vulnerable plugins, that after successful exploit will give us webshell or anything we need to own the machine. In my opinion - this can be really dangerous.

PoC: http://ropchain.org/poc/wordpress/

108 komentarzy:

  1. Ten komentarz został usunięty przez autora.

    OdpowiedzUsuń
  2. where is the proxy.php script please ?

    OdpowiedzUsuń
    Odpowiedzi
    1. As mentioned - it just sleeps for few seconds and do redirect.



      Simple as that. :)

      Usuń
    2. http://pastebin.com/WuJxSgBH

      Usuń
  3. Ten komentarz został usunięty przez autora.

    OdpowiedzUsuń
  4. Odpowiedzi
    1. Which browser do you use?

      I belive that you're logged in as admin in Wordpress during the test? ;-)

      Usuń
  5. I use FF
    Im not logged :) I thought this was a fail to 'hack' a WP website ...

    OdpowiedzUsuń
  6. Can i get the vulnerable flash file. I am not able to reproduce this.

    OdpowiedzUsuń
    Odpowiedzi
    1. You can find it by downloading archive Wordpress version (like 4.1.1)

      Usuń
    2. i tried on that older versions of wordpress only, but is not working, also i noticed little changes those flash file compared to the snippet given above in your blog. So thought may be the flash file is changed. Can you share your email ID please.

      Usuń
    3. It opens two tabs but the plugin is not getting installed, not sure what am i missing.

      Usuń
    4. DD - try to DM me at twitter or visit http://ropchain.org/ for my e-mail.

      Usuń
  7. How would this look if i wanted to install a shell lets say
    shell c99?
    https://r57.gen.tr/1464020527-c99.html

    OdpowiedzUsuń
  8. https://r57.gen.tr/1464020527-c99.html
    wp-admin/plugin-install.php?tab=plugin-information&plugin=google-analytics-dashboard-for-wp&section=description

    How to make it upload a php shell? thats not listen wordpress plugins website lol?

    OdpowiedzUsuń
  9. Agilestorelocator.com is the professional in wordpress plugin and store locator wordpress. Here is also options available for the plugin is for WordPress.

    OdpowiedzUsuń
  10. Hello, we provide you with variety of webshells which are asp, aspx and php web backdoors, such as b374k, c99, r57, pouya, wso etc. https://webshell.co

    OdpowiedzUsuń
  11. We are providing the services in wordpress to store locator plugin. You can get store locator wordpress through this and also store locator wordpress. We are giving the administrations in wordpress to store locator module. You can get store locator wordpress through this furthermore google store locator.

    OdpowiedzUsuń
  12. A befuddling web diary I visit this blog, it's incredibly grand. Strangely, in this present blog's substance made motivation behind fact and sensible. The substance of information is instructive
    Oracle Fusion Financials Online Training
    Oracle Fusion HCM Online Training
    Oracle Fusion SCM Online Training

    OdpowiedzUsuń
  13. An astounding web diary I visit this blog, it's inconceivably magnificent. Strangely, in this current blog's substance made point of fact and sensible. The substance of information is instructive.
    Oracle Fusion Financials Online Training
    Oracle Fusion HCM Online Training
    Oracle Fusion SCM Online Training

    OdpowiedzUsuń
  14. A befuddling web diary I visit this blog, it's incredibly grand. Strangely, in this present blog's substance made motivation behind fact and sensible. The substance of information is instructive
    Oracle Fusion Financials Online Training
    Oracle Fusion HCM Online Training
    Oracle Fusion SCM Online Training

    OdpowiedzUsuń
  15. A befuddling web diary I visit this blog, it's incredibly grand. Strangely, in this present blog's substance made motivation behind fact and sensible. The substance of information is instructive
    Oracle Fusion Financials Online Training
    Oracle Fusion HCM Online Training
    Oracle Fusion SCM Online Training

    OdpowiedzUsuń
  16. An overwhelming web journal I visit this blog, it's unfathomably amazing. Unusually, in this present blog's substance made inspiration driving truth and reasonable. The substance of data is enlightening
    Oracle Fusion Financials Online Training
    Oracle Fusion HCM Online Training
    Oracle Fusion SCM Online Training

    OdpowiedzUsuń

  17. If you are looking for Call Center jobs in mohali .We are the leader in career and job-search advice. It is free to register on our site and take great benefits of our complete range of services.

    OdpowiedzUsuń
  18. Thanks for provide great informatic and looking beautiful blog, really nice required information & the things i never imagined and i would request, wright more blog and blog post like that for us. Thanks you once agianMarriage certificate in delhi
    Marriage certificate in ghaziabad
    Marriage registration in gurgaon
    Marriage registration in noida
    special marriage act
    Marriage certificate online
    Marriage certificate in mumbai
    Marriage certificate in faridabad
    Marriage certificate in bangalore
    Marriage certificate in hyderabad thanks once again to all.

    OdpowiedzUsuń
  19. Le hair steamer permet de lutter contre la sécheresse, la chute des cheveux et leur mauvaise santé , dans le confort de votre domicile. Le hair steamer est un casque vapeur qui apporte une dose d'hydratation pour les cheveux crépus.
    hair steamer
    Le hair steamer pas cher livraison sur paris.
    Le hair steamer france livraison sur paris.
    La sciatique commence généralement par une hernie discale dans la colonne lombaire
    Le traitement de la sciatique
    soulager la douleur sciatique

    les symptômes de la sciatique
    la sciatique que faire
    veilleuse coranique pas chere

    OdpowiedzUsuń
  20. I love the information you shared. We can learn a lot from this. www.buycubii.com

    OdpowiedzUsuń

  21. Thank you for sharing such a nice and interesting blog with us. I have seen that all will say the same thing repeatedly. But in your blog, I had a chance to get some useful and unique information.
    Digital Marketing Training in Hyderabad
    Best Digital Marketing institute in Hyderabad

    OdpowiedzUsuń
  22. Nice Post thanks for the information, good information & very helpful for others,Thanks for Fantasctic blog and its to much informatic which i never think ..Keep writing and grwoing your self

    rc transfer in delhi
    rc transfer in ghaziabad
    rc transfer in noida
    rc transfer in gurgaon
    rc transfer in faridabad
    rc transfer in bangalore
    rc transfer in greater noida
    rc transfer in mumbai
    rc transfer in ranchi
    rc transfer in chennai

    OdpowiedzUsuń
  23. Great Information and good article nice blog. Thanks for sharing this useful information article. online computer store

    OdpowiedzUsuń
  24. Thanks for Sharing This Article.It is very so much valuable content. I hope these Commenting lists will help to my website
    workday studio online training
    best workday studio online training
    top workday studio online training

    OdpowiedzUsuń
  25. Download your favorite Latest Mp3 Lyrics which are available in English, Hindi, Bangla, Telugu, Latin, Arabic, Russian, etc.

    Click Here

    Click Here

    Click Here

    Click Here

    Click Here

    OdpowiedzUsuń
  26. Looking for best English to Tamil Translation online, make use of our site to enjoy Tamil typing and directly share on your social media handle. Tamil Romantic Novels

    OdpowiedzUsuń
  27. Buy Ritalin Online Ritalin (methylphenidate) is a central nervous system stimulant. It affects chemicals in the brain and nerves that contribute to hyperactivity and impulse control. Ritalin is used to treat attention deficit disorder (ADD), attention deficit hyperactivity disorder (ADHD), and narcolepsy. Here at Global Research Chems, you can safely and securely Buy ritalin 10mg online without prescription. Products are of the best quality and about 98.98% pure and FDA approved. Packaging is safe and shipping is 100% discreet and delivery is very fast. We ship with DHL, FedEx and UPS for now . Buy ritalin 10mg Online Here.

    OdpowiedzUsuń
  28. Great Information and good article nice blog. Thanks for sharing this useful information article. Best Online Computer Store Australia | All in One Pc

    OdpowiedzUsuń
  29. Hi There,
    Thank you for sharing the knowledgeable blog with us I hope that you will post many more blog with us:-
    Buy Methylone (bk-MDMA) Online,Methylone is a chemical drug which is very similar in structure to MDMA and has comparable effects.
    Email:info@bestonlinepainpharma.com
    Click here for more information:- more info/

    OdpowiedzUsuń
  30. Legit Online Drug Supplier Welcome legit online drugstore buy all your pills here, cocaine for sale online, buy ecstasy, amphetamine pills, crack, cocaine.

    Link: Buy Cocaine online

    Link: Buy Pure Grade Heroin online

    Link: Buy Fentanyl online

    Link: Buy GHB Powder online

    Link: Buy Amphetamine Powder online

    Link: Buy Marijuana online

    Link: Buy Tapentadol Tablets online

    Link: Cocaine Wholesale online

    OdpowiedzUsuń
  31. Legit Online Drug Supplier Welcome legit online drugstore buy all your pills here, cocaine for sale online, buy ecstasy, amphetamine pills, crack, cocaine.

    Link: Buy Cocaine online

    Link: Buy Pure Grade Heroin online

    Link: Buy Fentanyl online

    Link: Buy GHB Powder online

    Link: Buy Amphetamine Powder online

    Link: Buy Marijuana online

    Link: Buy Tapentadol Tablets online

    Link: Cocaine Wholesale online

    OdpowiedzUsuń
  32. Legit Online Drug Supplier Welcome legit online drugstore buy all your pills here, cocaine for sale online, buy ecstasy, amphetamine pills, crack, cocaine.

    Link: Buy Cocaine online

    Link: Buy Pure Grade Heroin online

    Link: Buy Fentanyl online

    Link: Buy GHB Powder online

    Link: Buy Amphetamine Powder online

    Link: Buy Marijuana online

    Link: Buy Tapentadol Tablets online

    Link: Cocaine Wholesale online

    OdpowiedzUsuń
  33. Oh my goodness! Impressive article dude! Thanks, However I am going through troubles with your RSS. I don’t know the reason why I cannot join it. Is there anybody else getting similar RSS problems? Anyone that knows the solution will you kindly respond? Thanks!!
    Click here to get More information.

    OdpowiedzUsuń
  34. Thanks for provide great informatic and looking beautiful blog, really nice required information & the things i never imagined and i would request, wright more blog and blog post like that for us. Thanks you once agian

    court marriage in delhi ncr
    court marriage in delhi
    court marriage in noida
    court marriage in ghaziabad
    court marriage in gurgaon
    court marriage in faridabad
    court marriage in greater noida
    name change online
    court marriage in chandigarh
    court marriage in bangalore

    OdpowiedzUsuń
  35. This article is interesting, if you want to know more visit

    our website

    e-biblio

    WebTV

    OdpowiedzUsuń
  36. Awesome article, it was exceptionally helpful! I simply began in this and I'm becoming more acquainted with it better. The post is written in very a good manner and it contains many useful information for me. Thank you very much and will look for more postings from you.


    digital marketing blog
    digital marketing bloggers
    digital marketing blogs
    digital marketing blogs in india
    digital marketing blog 2020
    digital marketing blog sites
    skartec's digital marketing blog
    skartec's blog
    digital marketing course
    digital marketing course in chennai
    digital marketing training
    skartec digital marketing academy

    OdpowiedzUsuń
  37. Buy highest quality generic drugs, xanax online, SSD chemical solution Online, with fast & free services.

    OdpowiedzUsuń
  38. Very great post and very useful thanks for sharing
    We are manufacturing the best thermal paper rolls in Bangalore and thermal ribbon rolls in Bangalorewith with the best quality paper material.
    barcode label rolls in Bangalore

    OdpowiedzUsuń
  39. Find the best Crystal Meth, U-47700 Online, Fentanyl Online. Our service is fast dispatch and on time delivery.

    OdpowiedzUsuń
  40. Buy cbd and high thc concentration products from a trusted and reliable online legal cannabis shop with discreet overnight shipment services with no marijuana card needed.
    dankwoods for sale
    packwoods for sale
    buy packwoods online
    backwoods for sale
    barewoods for sale
    prerolls for sale
    medical marijuana for sale
    how to buy marijuana online
    where to buy medical marijuana online
    buy 1g cannabis cartridge
    buy weed online
    pre filled hash oil cartridges for sale
    cannabis for sale
    cannabis oil for sale
    where to buy cannabis online
    thc cartridges for sale
    Have you been searching online for a trusted online cannabis shop where you can find Backwoods for sale? Dankwoods for sale? Buy edibles online ship anywhere? OG Kush seeds for sale? Then we have all that answered here and more at TCH shop.

    OdpowiedzUsuń
  41. Buy cbd and high thc concentration products from a trusted and reliable online legal cannabis shop with discreet overnight shipment services with no marijuana card needed.
    dankwoods for sale
    packwoods for sale
    buy packwoods online
    backwoods for sale
    barewoods for sale
    prerolls for sale
    medical marijuana for sale
    how to buy marijuana online
    where to buy medical marijuana online
    buy 1g cannabis cartridge
    buy weed online
    pre filled hash oil cartridges for sale
    cannabis for sale
    cannabis oil for sale
    where to buy cannabis online
    thc cartridges for sale
    Have you been searching online for a trusted online cannabis shop where you can find Backwoods for sale? Dankwoods for sale? Buy edibles online ship anywhere? OG Kush seeds for sale? Then we have all that answered here and more at TCH shop.

    OdpowiedzUsuń