module

Snap Creek Duplicator WordPress plugin code injection

Try Surface Command
Back to search
Disclosed
2018-08-29
Created
2019-03-19

Description

When the WordPress plugin Snap Creek Duplicator restores a backup, it
leaves dangerous files in the filesystem such as installer.php and
installer-backup.php. These files allow anyone to call a function that
overwrite the wp-config.php file AND this function does not sanitize
POST parameters before inserting them inside the wp-config.php file,
leading to arbitrary PHP code execution.
WARNING: This exploit WILL break the wp-config.php file. If possible try
to restore backups of the configuration after the exploit to make the
WordPress site work again.

Authors

Julien Legras julien.legras@synacktiv.com
Thomas Chauchefoin thomas.chauchefoin@synacktiv.com

Platform

PHP

Architectures

php

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands ‘show options’ or ‘show advanced’:


    msf > use exploit/multi/php/wp_duplicator_code_inject
    msf exploit(wp_duplicator_code_inject) > show targets
        ...targets...
    msf exploit(wp_duplicator_code_inject) > set TARGET < target-id >
    msf exploit(wp_duplicator_code_inject) > show options
        ...show and set options...
    msf exploit(wp_duplicator_code_inject) > exploit
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.

Try it today