пятница, 4 января 2013 г.

WordPress XMLRPC pingback additional issues

Vulnerability in WordPress XMLRPC pingback function was recently published:

Basically this vuln can be used to scan opened ports on localhost and intranet:

But in fact, this vulnerability is much wider!

First, look at "SSRF bible. Cheatsheet":
and our ZeroNights 0x02 presentation:

Lets try to exploit this bug as a SSRF!
By default WP try to use cURL (libcurl) to make a requests:

 4988       $linea = wp_remote_fopen( $pagelinkedfrom );

 749 function wp_remote_fopen( $uri ) {
 758         $response = wp_remote_get( $uri, $options );

 74 function wp_remote_get($url, $args = array()) {
 75         $objFetchSite = _wp_http_get_object();
 76         return $objFetchSite->get($url, $args);  ...
 22 function &_wp_http_get_object() {
 23         static $http;
 25         if ( is_null($http) )
 26                 $http = new WP_Http();

 294         function get($url, $args = array()) {
 295                 $defaults = array('method' => 'GET');
 296                 $r = wp_parse_args( $args, $defaults );
 297                 return $this->request($url, $r);
 298         }

 81         function request( $url, $args = array() ) {
 191                 return $this->_dispatch_request($url, $r);
 243         private function _dispatch_request( $url, $args ) {
 244                 static $transports = array();
 246                 $class = $this->_get_first_available_transport( $args, $url
 205         public function _get_first_available_transport( $args, $url = null )
 206                 $request_order = array( 'curl', 'streams', 'fsockopen' );

Now you know that using file:// gopher:// dict:// ldap:// and other schemas do this bug really dangerous.
It is easy to exploit local services and host-based auth by dict/gopher.

Try to read data from response. It is may be response with local file content (file://) or data from intranet/services (http://wiki.internal.local, gopher://localhost:11211/1get%20secretkey%0aquit).

Look at WP code again:

 4988   $linea = wp_remote_fopen( $pagelinkedfrom );
 4989   if ( !$linea )
 4999   preg_match('|<title>([^<]*?)</title>|is', $linea, $matchtitle);
 5000   $title = $matchtitle[1];
 5001   if ( empty( $title ) )
 5002      return new IXR_Error(32, __('We cannot find a title on that page.'));
 5004   $linea = strip_tags( $linea, '<a>' ); // just keep the tag we need
 5006   $p = explode( "\n\n", $linea );
 5008   $preg_target = preg_quote($pagelinkedto, '|');
 5009   foreach ( $p as $para ) {
 5010      if ( strpos($para, $pagelinkedto) !== false ) { // it exists, but is it a link?
 5011         preg_match("|<a[^>]+?".$preg_target."[^>]*>([^>]+?)</a>|", $para, $context);
 5013         // If the URL isn't in a link context, keep looking
 5014         if ( empty($context) )
 5015            continue;


 5019         $excerpt = preg_replace('|\</?wpcontext\>|', '', $para);
 5021         // prevent really long link text
 5022         if ( strlen($context[1]) > 100 )
 5023            $context[1] = substr($context[1], 0, 100) . '...';

Data between "<titile>" and "</title>" strings will be put in author field of comment (255 bytes limited by DB field).
Data between "<a >" and "</a>" strings will be put in content field of comment (100 bytes limited by line 5022).

Now it is clear that you can read 355 bytes of arbitrary data.

Let's try to read data from access.log.
First inject markers into access.log by following requests:
http://localhost/tests/wordpress/#<a http://localhost/tests/wordpress/?p=1>

Send requests with markers by manually crafted HTTP packets like this (browsers create HTTP requests w/o anchors):
GET /tests/wordpress/#<a>marker1 HTTP/1.1
Host: localhost

Now you can add comment with arbitrary data between your markers using simple XMLRPC request (see slides 20-23 from our presentation about ProcFS way to read access.log):

For fun - reading output of stats memcached command:

45 комментариев:

  1. Wordpress pingback requires back link to origin post and we cannot read info from resources where we cannot put this link.
    It's just a notice for another readers, because about this is not wrote in article. We cannot read /etc/passwd or same files (Only if they contains link to post WTF).

    Research is intresting, thank you :)

  2. Thanks for sharing, nice post! Post really provice useful information!

    Hương Lâm chuyên cung cấp bán máy photocopy và dịch vụ cho thuê máy photocopy giá rẻ, uy tín TP.HCM với dòng máy photocopy toshiba và dòng máy photocopy ricoh uy tín, giá rẻ.

  3. Trường hợp này có thể được bác sĩ tư vấn sử dụng hoạt huyết dưỡng não trị mất ngủ nhằm hoạt huyết, tăng cường tuần hoàn não.

  4. You can go for the writer of students assignment help and ask them for cheap essay assignment services to write a plagiarism-free paper on your given topic. They will deliver the paper to you on even the urgent basis.

  5. It is undisputed that Sociology Assignment Writing Services pose challenges for students because preparation takes into consideration a lot of details needed for Sociology Coursework Writing Services and in-depth knowledge on the topic in order to come up with award winning Custom Sociology Research Paper Writing Services.


  6. رش مبيدات بالمدينة المنورة رش مبيدات بالمدينة المنورة
    رش مبيدات بالدمام رش مبيدات بالدمام
    مكافحة الحمام بالمدينة المنورة مكافحة الحمام بالمدينة المنورة

    غسيل خزانات بمكة غسيل خزانات بمكة
    غسيل خزانات بجدة غسيل خزانات بجدة
    غسيل خزانات بالدمام غسيل خزانات بالدمام

  7. In some rehab centers chores are assigned, which means that a group of patients might be responsible for preparing meals as part of their assigned chores. In other cases patients are permitted to prepare whatever food they like for themselves during certain times, and everyone eats in the same common area.
    Still other treatment facilities may provide a kitchen within the room, allowing patients to cook and eat as they please during free time. In most cases this also means that people attending rehab will be required to shop for themselves during supervised group outings to the grocery store.
    recovery quotes
    addiction recovery quotes

  8. Healthcare research paper writing services are essential and it has become very popular for those seeking healthcare essay writing services since most of them seek Healthcare Assignment Writing Services.

  9. Thuốc xoang Nhật Bản là sản phẩm điều trị bệnh viêm xoang rất phổ biến hiện nay. Có đủ các loại từ dạng xịt đến dạng uống. Nhưng được sử dụng phổ biến nhất chính là viên uống trị xoang Kunihiro Nhật Bản.

  10. دانلود خلاصه کتاب اندیشه های سیاسی قرن بیستم PDF
    ممنون ازتون. کتاب اندیشه سیاسی رو از دکان فایل دانلود کنید

  11. How to Transfer Money From Google Pay to Cash App
    It is not actually possible to directly transfer money from Google Pay to Cash App. However, there are other ways by which you can transfer money from Google Pay. But before jumping to that process, first, you need to set up Google pay on your mobile.
    cash app customer service

  12. Этот комментарий был удален автором.

  13. I read your blog frequently and I just thought I’d say keep up the amazing work if you want to restore your accounting files contact us call us on QuickBooks technical support number.Quickbooks Support

  14. The ultimate goal of criminology assignment writing services is to provide Criminology Essay Writing Services and criminology coursework writing services since criminology assignments help service seekers lack time to complete their criminology research writing services.

  15. Hello, I would like to thank you for sharing this interesting information. I appreciate reading it. The material you have provided here will be useful for a lot of people. I was actually looking for someone who can write my reaction paper, nevertheless, thanks.

  16. There is a reliable Healthcare Assignment Writing Service that is very popular for students in search of healthcare coursework writing services and nursing essay writing help services.

  17. The ultimate goal of entrepreneurship coursework writing services is to provide Entrepreneurship Writing Services and entrepreneurship essay writing services since entrepreneurship assignments writing service seekers lack time to complete their entrepreneurship term paper writing services.

  18. Этот комментарий был удален автором.

  19. This is very educational content and written well for a change. It's nice to see that some people still understand how to write a quality post.!
    Primary School Tutor

  20. This is really fascinating, You’re an excessively skilled blogger. I have joined your feed and stay up for searching for more of your wonderful post. Additionally, I’ve shared your website in my social networks
    SPSS Help

  21. WAJA sauna is specialist manufacturer of top quality sauna products. Products include sauna rooms, steam rooms, barrel saunas, wooden hot tubs, and all kinds of sauna accessories.

    steam room

  22. Order fresh flowers Online from best online florist in bangalore. Send unique design flowers to bangalore for all special occasions to your loved ones

    send flowers to bangalore

  23. Thanks for your article. It was interesting and informative. Here I also want to suggest your reader who usually travels. one place to another they must visit Air Albania that offer best deals to book your seat on Air Albania Reservations. So do hurry and avail the best deals and get rid of to check different websites for offers. Get more help on => wm365.bet <=> respect55.com <=> xonlythai.com <=> xvideo66.com <=> หนังโป๊คลิป.com <=> engfinity.co.th

  24. Hey there, I need an Statistics Homework Help expert to help me understand the topic of piecewise regression. In our lectures, the concept seemed very hard, and I could not understand it completely. I need someone who can explain to me in a simpler way that I can understand the topic. he/she should explain to me which is the best model, the best data before the model and how to fit the model using SPSS. If you can deliver quality work then you would be my official Statistics Assignment Help partner.

  25. I don’t have time to look for another expert and therefore I am going to hire you with the hope that I will get qualityeconomics assignment help. .Being aneconomics homework help professor I expect that your solutions are first class. All I want to tell you is that if the solutions are not up to the mark I am going to cancel the project.

  26. That is a huge number of students. Are they from the same country or different countries? I also want your math assignment help. I want to perform in my assignments and since this is what you have been doing for years, I believe you are the right person for me. Let me know how much you charge for your math homework help services.

  27. Hello. Please check the task I have just sent and reply as soon as possible. I want an adjustment assignment done within a period of one week. I have worked with an Accounting Homework Help tutor from your team and therefore I know it’s possible to complete it within that period. Let me know the cost so that I can settle it now as your Accounting Assignment Help experts work on it.

  28. How much do you charge for a Statistics Assignment Help task? Take, for my case, where I need you to provide me with the Statistics Homework Help on plotting a scatter plot with a regression line? How much should that cost? Do you charge on the basis of the workload or have a constant payment?

  29. I have submitted my assignment to your website without any challenges. The economics assignmenthelp expert handling my assignment has already contacted me and I am certain that my work is underway. I am just hoping that I will get quality economics homework help. I have a lot of hopes in you and I am just hoping that you will not disappoint me.

  30. As much as there are discouragements, it is true that mathematics is hard. Like in my case, I was never discouraged by anyone about math but I still find it very hard and that is why I am requesting your Math assignment help. I am tired of struggling with mathematics and spending sleepless nights trying to solve sums that I still don’t get right. Having gone through your Math homework help, I am sure that I will get the right help through you. Please tell me what I need to be able to hire you.

  31. Just what I was looking for. I am struggling with my accounting assignment. I want an Accounting Assignment Help tutor to offer me two services. One is to complete my accounting assignments and the other is to provide me with online classes. I believe you are experienced enough to offer both Accounting Homework Help and online classes. I know you charge assignments based on the bulk. Tell me how much you charge for the online classes per hour.

  32. samudra slot merupakan situs judi slot online terpercaya Indonesia yang menyediakan permainan slot games terlengkap bet kecil jackpot besar sangat mudah menang free spin dan bigwin online 24 Jam.

  33. Watch movies online sa-movie.com, watch new movies, series Netflix HD 4K, watch free movies on your mobile phone, Tablet, watch movies on the web. ดูหนังออนไลน์

    SEE4K Watch movies, watch movies, free series, load without interruption, sharp images in HD FullHD 4k, all matters, all tastes, see anywhere, anytime, on mobile phones, tablets, computers. ดูหนังใหม่

    GangManga read manga, read manga, read manga online for free, fast loading, clear images in HD quality, all titles, anywhere, anytime, on mobile, tablet, computer. อ่านการ์ตูน

    Watch live football live24th, watch football online, link to watch live football, watch football for free. ผลบอลสดa