diff --git a/modules/vulnerabilities/unix/webapp/wordpress/manifests/conf.pp b/modules/vulnerabilities/unix/webapp/wordpress/manifests/conf.pp index 1905901fd..76f6dd181 100644 --- a/modules/vulnerabilities/unix/webapp/wordpress/manifests/conf.pp +++ b/modules/vulnerabilities/unix/webapp/wordpress/manifests/conf.pp @@ -6,9 +6,9 @@ class wordpress::conf ($version){ mode => '0755', content => template('wordpress/wordpress_conf.sh.erb'), } - # - # exec { 'run wordpress config script': - # command => '/bin/bash /tmp/wordpress_conf.sh', - # require => File['/tmp/wordpress_conf.sh'], - # } + + exec { 'run wordpress config script': + command => '/bin/bash /tmp/wordpress_conf.sh', + require => File['/tmp/wordpress_conf.sh'], + } } \ No newline at end of file diff --git a/modules/vulnerabilities/unix/webapp/wordpress/secgen_metadata.xml b/modules/vulnerabilities/unix/webapp/wordpress/secgen_metadata.xml index 4c8c02c31..1974d5f9d 100644 --- a/modules/vulnerabilities/unix/webapp/wordpress/secgen_metadata.xml +++ b/modules/vulnerabilities/unix/webapp/wordpress/secgen_metadata.xml @@ -15,6 +15,7 @@ https version + ip port blog_title admin_email @@ -22,7 +23,6 @@ username - @@ -30,6 +30,10 @@ 4.9.4 + + 172.16.0.2 + + 80 @@ -39,7 +43,7 @@ - + admin@wordpress.org @@ -53,10 +57,6 @@ https://www.exploit-db.com/exploits/44101/ The authors of this website forgot to sanitise their database inputs! - - - - .*/handy_cli_tools diff --git a/modules/vulnerabilities/unix/webapp/wordpress/templates/wordpress_conf.sh.erb b/modules/vulnerabilities/unix/webapp/wordpress/templates/wordpress_conf.sh.erb index 164f09d48..3bd714de6 100644 --- a/modules/vulnerabilities/unix/webapp/wordpress/templates/wordpress_conf.sh.erb +++ b/modules/vulnerabilities/unix/webapp/wordpress/templates/wordpress_conf.sh.erb @@ -1,14 +1,12 @@ #!/bin/bash -<% $params = '' - $params += 'weblog_title=' + @blog_title - $url_email = @admin_email.gsub('@', '%40') - $params += '&admin_email=' + $url_email - +<% require 'uri' + $params = '' + $params += 'weblog_title=' + URI::encode(@blog_title) + $params += '&admin_email=' + URI::encode(@admin_email) if @version[0].to_i >= 3 - $params += '&user_name=' + @username - $params += '&admin_password=' + @admin_password - $params += '&admin_password2=' + @admin_password - + $params += '&user_name=' + @username + $params += '&admin_password=' + @admin_password + $params += '&admin_password2=' + @admin_password elsif (@version[0].to_i == 4) and (@version[2].to_i >= 3) $params += '&pw_weak=on' $params += '&pass1-text=' + @admin_password @@ -18,7 +16,9 @@ else $params += '&blog_public=1' $params += '&Submit=Install+WordPress' + $params += '&language=' end -%> - -curl -L --data '<%= $params %>' http://localhost:80/wp-admin/install.php?step=2 \ No newline at end of file +curl -L http://<%= @ip_address %>:<%= @port %>/ +sleep 10 +curl -L --data '<%= $params %>' http://<%= @ip_address %>:<%= @port %>/wp-admin/install.php?step=2 \ No newline at end of file diff --git a/modules/vulnerabilities/unix/webapp/wordpress/wordpress.pp b/modules/vulnerabilities/unix/webapp/wordpress/wordpress.pp index 6b2001143..419c15c26 100644 --- a/modules/vulnerabilities/unix/webapp/wordpress/wordpress.pp +++ b/modules/vulnerabilities/unix/webapp/wordpress/wordpress.pp @@ -4,6 +4,8 @@ $blog_title = $secgen_parameters['blog_title'][0] $admin_email = $secgen_parameters['admin_email'][0] $admin_password = $secgen_parameters['admin_password'][0] $username = $secgen_parameters['username'][0] +$ip_address = $secgen_parameters['IP_address'][0] +$port = $secgen_parameters['port'][0] class { 'mysql::server': } class { 'mysql::bindings': php_enable => true, } @@ -16,7 +18,7 @@ class { '::apache': apache::vhost { 'wordpress': docroot => '/var/www/wordpress', - port => '80', + port => $port, } class { 'wordpress': @@ -25,205 +27,4 @@ class { 'wordpress': } ~> class { 'wordpress::conf': version => $version, -} - -# TODO: -# Configuration -## Pass an account in? -# HTTPS true/false -# - -# wordpress conf - -# Older versions (1.2.1) - -# GET /wp-admin/install.php HTTP/1.1 -# Host: 172.16.0.2 -# User-Agent: Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:58.0) Gecko/20100101 Firefox/58.0 -# Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 -# Accept-Language: en-US,en;q=0.5 -# Accept-Encoding: gzip, deflate -# Referer: http://172.16.0.2/ -# Cookie: wp-settings-time-1=1521034877 -# Connection: close -# Upgrade-Insecure-Requests: 1 -# -# GET /wp-admin/install.php?step=1 HTTP/1.1 -# Host: 172.16.0.2 -# User-Agent: Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:58.0) Gecko/20100101 Firefox/58.0 -# Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 -# Accept-Language: en-US,en;q=0.5 -# Accept-Encoding: gzip, deflate -# Referer: http://172.16.0.2/wp-admin/install.php -# Cookie: wp-settings-time-1=1521034877 -# Connection: close -# Upgrade-Insecure-Requests: 1 -# -# GET /wp-admin/install.php?step=2 HTTP/1.1 -# Host: 172.16.0.2 -# User-Agent: Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:58.0) Gecko/20100101 Firefox/58.0 -# Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 -# Accept-Language: en-US,en;q=0.5 -# Accept-Encoding: gzip, deflate -# Referer: http://172.16.0.2/wp-admin/install.php?step=1 -# Cookie: wp-settings-time-1=1521034877 -# Connection: close -# Upgrade-Insecure-Requests: 1 -# -# POST /wp-admin/install.php?step=3 HTTP/1.1 -# Host: 172.16.0.2 -# User-Agent: Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:58.0) Gecko/20100101 Firefox/58.0 -# Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 -# Accept-Language: en-US,en;q=0.5 -# Accept-Encoding: gzip, deflate -# Referer: http://172.16.0.2/wp-admin/install.php?step=2 -# Content-Type: application/x-www-form-urlencoded -# Content-Length: 34 -# Cookie: wp-settings-time-1=1521034877 -# Connection: close -# Upgrade-Insecure-Requests: 1 -# -# step=3&url=http%3A%2F%2F172.16.0.2 - -# 1.5.1 -# -# POST /wp-admin/install.php?step=2 HTTP/1.1 -# Host: 172.16.0.2 -# User-Agent: Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:58.0) Gecko/20100101 Firefox/58.0 -# Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 -# Accept-Language: en-US,en;q=0.5 -# Accept-Encoding: gzip, deflate -# Referer: http://172.16.0.2/wp-admin/install.php?step=1 -# Content-Type: application/x-www-form-urlencoded -# Content-Length: 83 -# Cookie: wp-settings-time-1=1521034877 -# Connection: close -# Upgrade-Insecure-Requests: 1 -# -# weblog_title=test&admin_email=test%40test.com&Submit=Continue+to+Second+Step+%C2%BB - - -# 2.0 - -# 2.5 -# -# POST /wp-admin/install.php?step=2 HTTP/1.1 -# Host: 172.16.0.2 -# User-Agent: Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:58.0) Gecko/20100101 Firefox/58.0 -# Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 -# Accept-Language: en-US,en;q=0.5 -# Accept-Encoding: gzip, deflate -# Referer: http://172.16.0.2/wp-admin/install.php -# Content-Type: application/x-www-form-urlencoded -# Content-Length: 84 -# Cookie: wp-settings-time-1=1521034877 -# Connection: close -# Upgrade-Insecure-Requests: 1 -# -# weblog_title=test&admin_email=test%40test.com&blog_public=1&Submit=Install+WordPress - - -# 2.9 - -# POST /wp-admin/install.php?step=2 HTTP/1.1 -# Host: 172.16.0.2 -# User-Agent: Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:58.0) Gecko/20100101 Firefox/58.0 -# Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 -# Accept-Language: en-US,en;q=0.5 -# Accept-Encoding: gzip, deflate -# Referer: http://172.16.0.2/wp-admin/install.php -# Content-Type: application/x-www-form-urlencoded -# Content-Length: 84 -# Cookie: wp-settings-time-1=1521034877 -# Connection: close -# Upgrade-Insecure-Requests: 1 -# -# weblog_title=test&admin_email=test%40test.com&blog_public=1&Submit=Install+WordPress - -# 3.0 -# POST /wp-admin/install.php?step=2 HTTP/1.1 -# Host: 172.16.0.2 -# User-Agent: Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:58.0) Gecko/20100101 Firefox/58.0 -# Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 -# Accept-Language: en-US,en;q=0.5 -# Accept-Encoding: gzip, deflate -# Referer: http://172.16.0.2/wp-admin/install.php -# Content-Type: application/x-www-form-urlencoded -# Content-Length: 141 -# Cookie: wp-settings-time-1=1521034877 -# Connection: close -# Upgrade-Insecure-Requests: 1 -# -# weblog_title=test&user_name=admin&admin_password=test&admin_password2=test&admin_email=test%40test.com&blog_public=1&Submit=Install+WordPress - - -# 4.2 -# -# POST /wp-admin/install.php?step=2 HTTP/1.1 -# Host: 172.16.0.2 -# User-Agent: Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:58.0) Gecko/20100101 Firefox/58.0 -# Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 -# Accept-Language: en-US,en;q=0.5 -# Accept-Encoding: gzip, deflate -# Referer: http://172.16.0.2/wp-admin/install.php -# Content-Type: application/x-www-form-urlencoded -# Content-Length: 159 -# Cookie: wp-settings-time-1=1521034877 -# Connection: close -# Upgrade-Insecure-Requests: 1 -# -# weblog_title=test&user_name=user&admin_password=password&admin_password2=password&admin_email=test%40email.com&blog_public=1&Submit=Install+WordPress&language= - - -# 4.3 (default generated password) -# -# POST /wp-admin/install.php?step=2 HTTP/1.1 -# Host: 172.16.0.2 -# User-Agent: Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:58.0) Gecko/20100101 Firefox/58.0 -# Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 -# Accept-Language: en-US,en;q=0.5 -# Accept-Encoding: gzip, deflate -# Referer: http://172.16.0.2/wp-admin/install.php -# Content-Type: application/x-www-form-urlencoded -# Content-Length: 181 -# Cookie: wp-settings-time-1=1521034877 -# Connection: close -# Upgrade-Insecure-Requests: 1 -# -# weblog_title=test&user_name=test&admin_password=test&pass1-text=QjqKmEYBWqQ4LLTp5D&admin_password2=test&admin_email=test%40test.test&blog_public=1&Submit=Install+WordPress&language= - - -# 4.3 (user supplied weak password) -# secure password with pw_weak=on works! just always include the parameter. -# -# POST /wp-admin/install.php?step=2 HTTP/1.1 -# Host: 172.16.0.2 -# User-Agent: Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:58.0) Gecko/20100101 Firefox/58.0 -# Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 -# Accept-Language: en-US,en;q=0.5 -# Accept-Encoding: gzip, deflate -# Referer: http://172.16.0.2/wp-admin/install.php -# Content-Type: application/x-www-form-urlencoded -# Content-Length: 177 -# Cookie: wp-settings-time-1=1521034877 -# Connection: close -# Upgrade-Insecure-Requests: 1 -# -# weblog_title=test&user_name=user&admin_password=test&pass1-text=test&admin_password2=test&pw_weak=on&admin_email=test%40test.com&blog_public=1&Submit=Install+WordPress&language= - - -# 1.5.1 -# weblog_title=test&admin_email=test%40test.com&Submit=Continue+to+Second+Step+%C2%BB - -# 2.0 - 2.9 -# weblog_title=test&admin_email=test%40test.com&blog_public=1&Submit=Install+WordPress - -# 3.0 -# weblog_title=test&user_name=admin&admin_password=test&admin_password2=test&admin_email=test%40test.com&blog_public=1&Submit=Install+WordPress - -# 4.2 -# weblog_title=test&user_name=user&admin_password=password&admin_password2=password&admin_email=test%40email.com&blog_public=1&Submit=Install+WordPress&language= - -# 4.3 -# weblog_title=test&user_name=test&admin_password=test&pass1-text=QjqKmEYBWqQ4LLTp5D&admin_password2=test&admin_email=test%40test.test&blog_public=1&Submit=Install+WordPress&language= -# weblog_title=test&user_name=user&admin_password=test&pass1-text=test&admin_password2=test&pw_weak=on&admin_email=test%40test.com&blog_public=1&Submit=Install+WordPress&language= \ No newline at end of file +} \ No newline at end of file diff --git a/scenarios/examples/vulnerability_examples/wordpress_examples/wordpress_1x.xml b/scenarios/examples/vulnerability_examples/wordpress_examples/wordpress_1x.xml new file mode 100644 index 000000000..f0da56fbf --- /dev/null +++ b/scenarios/examples/vulnerability_examples/wordpress_examples/wordpress_1x.xml @@ -0,0 +1,40 @@ + + + + + wp_1x + + + + 172.16.0.12 + + + + + + + 1.5.2 + 1.5.1.3 + 1.5.1.2 + 1.5.1.1 + 1.5.1 + + + + + IP_addresses + + + + + + + IP_addresses + + + + + + diff --git a/scenarios/examples/vulnerability_examples/wordpress_examples/wordpress_2x.xml b/scenarios/examples/vulnerability_examples/wordpress_examples/wordpress_2x.xml new file mode 100644 index 000000000..71025d006 --- /dev/null +++ b/scenarios/examples/vulnerability_examples/wordpress_examples/wordpress_2x.xml @@ -0,0 +1,75 @@ + + + + + wp_2x + + + + 172.16.0.12 + + + + + + + 2.9.2 + 2.9.1 + 2.9 + 2.8.6 + 2.8.5 + 2.8.4 + 2.8.3 + 2.8.2 + 2.8.1 + 2.8 + 2.7.1 + 2.7 + 2.6.5 + 2.6.3 + 2.6.2 + 2.6.1 + 2.6 + 2.5.1 + 2.5 + 2.3.3 + 2.3.2 + 2.3.1 + 2.3 + 2.2.3 + 2.2.2 + 2.2.1 + 2.2 + 2.1.3 + 2.1.2 + 2.1.1 + 2.1 + 2.0.11 + 2.0.10 + 2.0.9 + 2.0.8 + 2.0.7 + 2.0.6 + 2.0.5 + 2.0.4 + 2.0.1 + 2.0 + + + + + IP_addresses + + + + + + + IP_addresses + + + + + \ No newline at end of file diff --git a/scenarios/examples/vulnerability_examples/wordpress_examples/wordpress_3x.xml b/scenarios/examples/vulnerability_examples/wordpress_examples/wordpress_3x.xml new file mode 100644 index 000000000..743d1c1bd --- /dev/null +++ b/scenarios/examples/vulnerability_examples/wordpress_examples/wordpress_3x.xml @@ -0,0 +1,136 @@ + + + + + wp_3x + + + + 172.16.0.12 + + + + + + + 3.9.23 + 3.9.22 + 3.9.21 + 3.9.20 + 3.9.19 + 3.9.18 + 3.9.17 + 3.9.16 + 3.9.15 + 3.9.14 + 3.9.13 + 3.9.12 + 3.9.11 + 3.9.10 + 3.9.9 + 3.9.8 + 3.9.7 + 3.9.6 + 3.9.5 + 3.9.4 + 3.9.3 + 3.9.2 + 3.9.1 + 3.9 + 3.8.25 + 3.8.24 + 3.8.23 + 3.8.22 + 3.8.21 + 3.8.20 + 3.8.19 + 3.8.18 + 3.8.17 + 3.8.16 + 3.8.15 + 3.8.14 + 3.8.13 + 3.8.12 + 3.8.11 + 3.8.10 + 3.8.9 + 3.8.8 + 3.8.7 + 3.8.6 + 3.8.5 + 3.8.4 + 3.8.3 + 3.8.2 + 3.8.1 + 3.8 + 3.7.25 + 3.7.24 + 3.7.23 + 3.7.22 + 3.7.21 + 3.7.20 + 3.7.19 + 3.7.18 + 3.7.17 + 3.7.16 + 3.7.15 + 3.7.14 + 3.7.13 + 3.7.12 + 3.7.11 + 3.7.10 + 3.7.9 + 3.7.8 + 3.7.7 + 3.7.6 + 3.7.5 + 3.7.4 + 3.7.3 + 3.7.2 + 3.7.1 + 3.7 + 3.6.1 + 3.6 + 3.5.2 + 3.5.1 + 3.5 + 3.4.2 + 3.4.1 + 3.4 + 3.3.3 + 3.3.2 + 3.3.1 + 3.3 + 3.2.1 + 3.2 + 3.1.4 + 3.1.3 + 3.1.2 + 3.1.1 + 3.1 + 3.0.6 + 3.0.5 + 3.0.4 + 3.0.3 + 3.0.2 + 3.0.1 + 3.0 + + + + + IP_addresses + + + + + + + IP_addresses + + + + + \ No newline at end of file diff --git a/scenarios/examples/vulnerability_examples/wordpress_examples/wordpress_48.xml b/scenarios/examples/vulnerability_examples/wordpress_examples/wordpress_48.xml new file mode 100644 index 000000000..9f17a8292 --- /dev/null +++ b/scenarios/examples/vulnerability_examples/wordpress_examples/wordpress_48.xml @@ -0,0 +1,31 @@ + + + + + wp_48 + + + + 172.16.0.12 + + + + + 4.8 + + + IP_addresses + + + + + + + IP_addresses + + + + + \ No newline at end of file diff --git a/scenarios/examples/vulnerability_examples/wordpress_examples/wordpress_4x.xml b/scenarios/examples/vulnerability_examples/wordpress_examples/wordpress_4x.xml new file mode 100644 index 000000000..a831f5aea --- /dev/null +++ b/scenarios/examples/vulnerability_examples/wordpress_examples/wordpress_4x.xml @@ -0,0 +1,177 @@ + + + + + wp_4x + + + + 172.16.0.12 + + + + + + + 4.9.4 + 4.9.3 + 4.9.2 + 4.9.1 + 4.9 + 4.8.5 + 4.8.4 + 4.8.3 + 4.8.2 + 4.8.1 + 4.8 + 4.7.9 + 4.7.8 + 4.7.7 + 4.7.6 + 4.7.5 + 4.7.4 + 4.7.3 + 4.7.2 + 4.7.1 + 4.7 + 4.6.10 + 4.6.9 + 4.6.8 + 4.6.7 + 4.6.6 + 4.6.5 + 4.6.4 + 4.6.3 + 4.6.2 + 4.6.1 + 4.6 + 4.5.13 + 4.5.12 + 4.5.11 + 4.5.10 + 4.5.9 + 4.5.8 + 4.5.7 + 4.5.6 + 4.5.5 + 4.5.4 + 4.5.3 + 4.5.2 + 4.5.1 + 4.5 + 4.4.14 + 4.4.13 + 4.4.12 + 4.4.11 + 4.4.10 + 4.4.9 + 4.4.8 + 4.4.7 + 4.4.6 + 4.4.5 + 4.4.4 + 4.4.3 + 4.4.2 + 4.4.1 + 4.4 + 4.3.15 + 4.3.14 + 4.3.13 + 4.3.12 + 4.3.11 + 4.3.10 + 4.3.9 + 4.3.8 + 4.3.7 + 4.3.6 + 4.3.5 + 4.3.4 + 4.3.3 + 4.3.2 + 4.3.1 + 4.3 + 4.2.19 + 4.2.18 + 4.2.17 + 4.2.16 + 4.2.15 + 4.2.14 + 4.2.13 + 4.2.12 + 4.2.11 + 4.2.10 + 4.2.9 + 4.2.8 + 4.2.7 + 4.2.6 + 4.2.5 + 4.2.4 + 4.2.3 + 4.2.2 + 4.2.1 + 4.2 + 4.1.22 + 4.1.21 + 4.1.20 + 4.1.19 + 4.1.18 + 4.1.17 + 4.1.16 + 4.1.15 + 4.1.14 + 4.1.13 + 4.1.12 + 4.1.11 + 4.1.10 + 4.1.9 + 4.1.8 + 4.1.7 + 4.1.6 + 4.1.5 + 4.1.4 + 4.1.3 + 4.1.2 + 4.1.1 + 4.1 + 4.0.22 + 4.0.21 + 4.0.20 + 4.0.19 + 4.0.18 + 4.0.17 + 4.0.16 + 4.0.15 + 4.0.14 + 4.0.13 + 4.0.12 + 4.0.11 + 4.0.10 + 4.0.9 + 4.0.8 + 4.0.7 + 4.0.6 + 4.0.5 + 4.0.4 + 4.0.3 + 4.0.2 + 4.0.1 + 4.0 + + + + + IP_addresses + + + + + + + IP_addresses + + + + + \ No newline at end of file diff --git a/scenarios/test_scenario.xml b/scenarios/test_scenario.xml deleted file mode 100644 index 3ee7ac19c..000000000 --- a/scenarios/test_scenario.xml +++ /dev/null @@ -1,34 +0,0 @@ - - - - - - - escalation - - - - - - - - - - - 4.3 - - - - - - - - - - - - - - \ No newline at end of file