Exploit Development Exercise [Beginner]

Exploit Development Exercise [Beginner] - Printable Version

+- Sinisterly (https://sinister.ly)
+-- Forum: Hacking (https://sinister.ly/Forum-Hacking)
+--- Forum: Website & Server Hacking (https://sinister.ly/Forum-Website-Server-Hacking)
+--- Thread: Exploit Development Exercise [Beginner] (/Thread-Exploit-Development-Exercise-Beginner)

Pages: 1 2

Exploit Development Exercise [Beginner] - Dyme - 03-25-2015

While bored in school today I came across an advisory on Sucuri for a relatively small wordpress plugin (~90k installs). The plugin allows unauthenticated users to obtain an admin session with only his username - a pretty ridiculous flaw to say the least. Since @Eclipse is always hitting me up for projects, and this vulnerability is as straight forward as it gets, I figured it would make a good exercise for individuals who want to get their feet wet in web app exploit development.

Sucuri Wrote:*Due to the severity we will not provide a Proof of Concept and will be very light on the technical details. Make sure to update asap!

Since Sucuri didn't release an exploit, and there are currently none available on the net atm, you have the perfect opportunity to create your own and practice basic exploit dev skills.

Advisory: http://blog.sucuri.net/2015/03/security-advisory-mainwp-child-wordpress-plugin.html
Download: https://downloads.wordpress.org/plugin/mainwp-child.2.0.9.1.zip
Goal: Make a fully functional exploit that achieves php/bash/sh command execution in some way or another.

Below is an example of my exploit for this vulnerability:

Spoiler:

l33ts, please refrain from shitting on this thread. This is meant to help beginners learn by using real world examples.

Feel free to post below if you need any help or would like my code.

RE: Exploit Development Exercise [Beginner] - Eclipse - 03-26-2015

Bookmarked. I'll get onto this when I have time.

RE: Exploit Development Exercise [Beginner] - Brawler - 03-26-2015

I enjoy things like this.

When I get home I will probably setup a barebone WP site and make something.

RE: Exploit Development Exercise [Beginner] - sys - 03-27-2015

Nice thanks a lot for the share m8.

RE: Exploit Development Exercise [Beginner] - Reiko - 03-27-2015

*nods in silent approval*

RE: Exploit Development Exercise [Beginner] - Null_Byte - 03-27-2015

*nods approvingly* Nice post all together. Let's hope that people will build on this and improve their skills.

RE: Exploit Development Exercise [Beginner] - Dyme - 04-07-2015

Well it's been 10+ days now; deciding to release my exploit code.

http://goo.gl/D2zr3R

RE: Exploit Development Exercise [Beginner] - Eclipse - 05-30-2016

https://gist.github.com/libeclipse/d1b3147850f1bc613c93f0d04d88c505

idk why I couldn't do this last year

RE: Exploit Development Exercise [Beginner] - Dyme - 05-30-2016

(05-30-2016, 07:48 PM)Eclipse Wrote: https://gist.github.com/libeclipse/d1b3147850f1bc613c93f0d04d88c505

idk why I couldn't do this last year

cause u were skid but now woah nice job thumbs up ????

RE: Exploit Development Exercise [Beginner] - blackhatcat - 05-31-2016

(05-30-2016, 07:48 PM)Eclipse Wrote: https://gist.github.com/libeclipse/d1b3147850f1bc613c93f0d04d88c505

idk why I couldn't do this last year

Hey, nice! I remember giving you advice over a year ago on Python with exactly this in mind (see; https://sinister.ly/Thread-Reverence-Python-Website-Recon-Tool?pid=298690#pid298690)

Glad to see that you actually got somewhere, keep at it.