Fixes store_valid_credential conditional logic for unix/webapp/wp_admin_shell_upload module

[cgranleese-r7]

Note

This PR fixes #18916

This PR updates the conditional logic for unix/webapp/wp_admin_shell_upload module. Previously store_valid_credential was added to the wrong conditional branch in d69bfd5.

The new fix will now return return CheckCode::Safe when an invalid login (cookie returns nil) is used by the module. CheckCode::Safe is return when a target is safe and is therefore not exploitable.

metasploit-framework/lib/msf/core/exploit.rb

Line 124 in d64ed33

# The target is safe and is therefore not exploitable. This is recommended after the check

When a valid login is used by the module, the module will now store the creds to the database and return CheckCode::Appears. CheckCode::Appears is return when the target appears to be vulnerable.

metasploit-framework/lib/msf/core/exploit.rb

Line 136 in d64ed33

# The target appears to be vulnerable. This is recommended if the vulnerability is determined

Example

Target

Guide I followed: https://github.com/docker/awesome-compose/tree/master/wordpress-mysql
Example file when targeting Wordpress version 4.8.2:

File name: compose.yaml

services:
  db:
    # We use a mariadb image which supports both amd64 & arm64 architecture
    image: mariadb:10.6.4-focal
    # If you really want to use MySQL, uncomment the following line
    #image: mysql:8.0.27
    command: '--default-authentication-plugin=mysql_native_password'
    volumes:
      - db_data:/var/lib/mysql
    restart: always
    environment:
      - MYSQL_ROOT_PASSWORD=somewordpress
      - MYSQL_DATABASE=wordpress
      - MYSQL_USER=wordpress
      - MYSQL_PASSWORD=wordpress
    expose:
      - 3306
      - 33060
  wordpress:
    image: wordpress:4.8.2
    ports:
      - 80:80
    restart: always
    environment:
      - WORDPRESS_DB_HOST=db
      - WORDPRESS_DB_USER=wordpress
      - WORDPRESS_DB_PASSWORD=wordpress
      - WORDPRESS_DB_NAME=wordpress
volumes:
  db_data:

Command to run that Docker compose image:

docker compose up

Verification

• Start msfconsole
• use unix/webapp/wp_admin_shell_upload
• Get a Wordpress target - see Target section above for setup steps
• Verify when a valid login is used that the module returns The target appears to be vulnerable. and the creds are added to the DB via the creds command
• Verify when an invalid login is used that it returns The target is not exploitable.

[dwelch-r7]

Release Notes

Fixes store_valid_credential conditional logic for unix/webapp/wp_admin_shell_upload module