wp-plugin-automation

WP-PLUGIN-AUTOMATION — 批量测试 WordPress 插件 CVE

适用场景

在完成初步 WordPress 检测侦察（hunt-wordpress Phase 1）后使用。你已有一份已确认的 WP 域名列表，需要找出哪些特定插件 CVE 可被利用。此技能可大规模自动检测插件、提取版本、匹配 CVE 并生成利用 PoC。

快速参考

# One-shot: detect all plugin versions on a target
cat targets.txt | while read t; do
  echo "=== $t ==="
  # Extract plugin readme versions
  for p in revslider elementskit elementor woocommerce gravityforms jetpack; do
    v=$(curl --max-time 30 --connect-timeout 10 -sk "https://$t/wp-content/plugins/$p/readme.txt" | grep -i "stable tag\|version" | head -1)
    [ -n "$v" ] && echo "PLUGIN: $p=$v"
  done
  # REST API namespace enumeration
  curl --max-time 30 --connect-timeout 10 -sk "https://$t/wp-json/" | python3 -c "import sys,json; d=json.load(sys.stdin); [print('REST:',n) for n in d.get('namespaces',[])]" 2>/dev/null
done

分步指南

阶段 1 — 自动检测插件

#!/bin/bash
# wp-plugin-scan.sh - Scan target list for WP plugin versions
TARGETS="$1"
PLUGINS=(
  "revslider:slider-revolution"
  "elementskit:elementskit-lite"
  "elementor:elementor"
  "woocommerce:woocommerce"
  "gravityforms:gravityforms"
  "contact-form-7:contact-form-7"
  "jetpack:jetpack"
  "wp-file-manager:wp-file-manager"
  "wordpress-seo:wordpress-seo"
  "give:give"  # Donation plugin
  "wp-sermons:wp-sermons"
  "simple-bible-embed:simple-bible-embed"
)

while read t; do
  echo "=== Scanning $t ==="
  for plugin_entry in "${PLUGINS[@]}"; do
    IFS=':' read -r slug dir <<< "$plugin_entry"
    readme=$(curl --max-time 30 --connect-timeout 10 -sk -o /dev/null -w "%{http_code}" "https://$t/wp-content/plugins/$dir/readme.txt")
    [ "$readme" != "404" ] && [ "$readme" != "000" ] && \
      version=$(curl --max-time 30 --connect-timeout 10 -sk "https://$t/wp-content/plugins/$dir/readme.txt" | grep -i "stable tag\|version" | head -1 | grep -Eo '[\d.]+') && \
      echo "  [+] $slug: v$version"
  done
done < "$TARGETS"

阶段 2 — CVE 匹配矩阵

#!/bin/bash
# cve-matcher.sh - Match plugin versions against known CVEs
# Usage: echo "revslider 6.6.19" | ./cve-matcher.sh

while read plugin version; do
  case "$plugin" in
    revslider)
      [ "$(printf '%s\n' '6.6.20' "$version" | sort -V | head -1)" != "$version" ] && \
        [ "$version" != "6.6.20" ] && echo "  [!] Revslider < 6.6.20 → CVE-2024-2534 RCE"
      [ "$(printf '%s\n' '6.5.8' "$version" | sort -V | head -1)" != "$version" ] && \
        [ "$version" != "6.5.8" ] && echo "  [!] Revslider < 6.5.8 → CVE-2022-2944 SQLi"
      ;;
    elementskit)
      [ "$(printf '%s\n' '2.9.4' "$version" | sort -V | head -1)" != "$version" ] && \
        [ "$version" != "2.9.4" ] && echo "  [!] ElementsKit < 2.9.4 → CVE-2023-6851 SQLi, CVE-2023-6853 File Upload"
      [ "$(printf '%s\n' '2.9.8' "$version" | sort -V | head -1)" != "$version" ] && \
        [ "$version" != "2.9.8" ] && echo "  [!] ElementsKit < 2.9.8 → CVE-2024-2117 XSS"
      ;;
    gravityforms)
      [ "$(printf '%s\n' '2.8.2' "$version" | sort -V | head -1)" != "$version" ] && \
        [ "$version" != "2.8.2" ] && echo "  [!] Gravity Forms < 2.8.2 → CVE-2024-6115 PHP Object Injection"
      ;;
    jetpack)
      [ "$(printf '%s\n' '13.1' "$version" | sort -V | head -1)" != "$version" ] && \
        [ "$version" != "13.1" ] && echo "  [!] Jetpack < 13.1 → CVE-2024-1782 SSRF"
      ;;
    contact-form-7)
      echo "  [!] CF7 < 5.6 → File upload bypass (no CVE)"
      ;;
    wp-file-manager)
      echo "  [!] WP File Manager → multiple CVEs (CVE-2020-25213 RCE, etc)"
      ;;
  esac
done

阶段 3 — 批量检查 CORS、XMLRPC 和调试日志

#!/bin/bash
# wp-bulk-vuln-check.sh - Multi-vuln sweep across all WP targets
TARGETS="$1"

while read t; do
  echo "=== $t ==="
  
  # CORS credential reflection
  cors=$(curl --max-time 30 --connect-timeout 10 -skI "https://$t/wp-json/wp/v2/users" -H "Origin: https://evil.com" 2>/dev/null | grep -c "Access-Control-Allow-Credentials: true")
  [ "$cors" -gt 0 ] && echo "  [CRIT] CORS credential reflection!"
  
  # XMLRPC
  xrpc=$(curl --max-time 30 --connect-timeout 10 -sk -o /dev/null -w "%{http_code}" "https://$t/xmlrpc.php" 2>/dev/null)
  [ "$xrpc" = "200" ] && echo "  [HIGH] XMLRPC active"
  
  # Debug log
  dlog=$(curl --max-time 30 --connect-timeout 10 -sk -o /dev/null -w "%{http_code}" "https://$t/wp-content/debug.log" 2>/dev/null)
  [ "$dlog" = "200" ] && echo "  [HIGH] Debug log exposed"
  
  # PHPInfo
  for p in /info.php /phpinfo.php /test.php; do
    code=$(curl --max-time 30 --connect-timeout 10 -sk -o /dev/null -w "%{http_code}" "https://$t$p" 2>/dev/null)
    [ "$code" = "200" ] && echo "  [HIGH] PHPInfo at $p"
  done
  
  # Open registration
  reg=$(curl --max-time 30 --connect-timeout 10 -sk "https://$t/wp-login.php?action=register" 2>/dev/null | grep -c "multipart")
  [ "$reg" -gt 0 ] && echo "  [HIGH] Open registration"
  
  echo "---"
done < "$TARGETS"

阶段 4 — 生成利用 PoC

# WooCommerce API discovery
for path in /wp-json/wc/v3/ /wp-json/wc/v3/products /wp-json/wc/v3/orders /wp-json/wc/v3/customers; do
  code=$(curl --max-time 30 --connect-timeout 10 -sk -o /dev/null -w "%{http_code}" "https://$TARGET$path")
  [ "$code" != "404" ] && echo "[+] $path — HTTP $code"
done

# Application Passwords endpoint
code=$(curl --max-time 30 --connect-timeout 10 -sk -o /dev/null -w "%{http_code}" "https://$TARGET/wp-admin/authorize-application.php")
[ "$code" != "404" ] && echo "[+] Application Passwords endpoint accessible"

# Check for REST API user enumeration
curl --max-time 30 --connect-timeout 10 -sk "https://$TARGET/wp-json/wp/v2/users?per_page=100" | jq '.[] | {id, name, slug}'

攻击面信号

• 可访问插件的 readme.txt：/wp-content/plugins/<slug>/readme.txt
• REST API 命名空间通过 /wp-json/ 反映已启用的插件
• 可访问插件资源（CSS、JS、图片）：/wp-content/plugins/<slug>/assets/
• WooCommerce 端点：/wp-json/wc/v3/

常见根本原因

1. 禁用了插件自动更新 — 管理员为避免自定义设置被破坏而关闭自动更新
2. 已弃用的插件 — 开发者停止维护，也没有针对 CVE 发布补丁
3. 破解版／高级插件 — 预算有限的网站安装了带有后门的盗版插件
4. 插件臃肿 — 安装了 50 多个插件，无法手动跟踪 CVE

实际案例

来自对 58 家公司的大规模侦察：

• 58 个目标中有 7 个使用了低于 2.9.4 版的 ElementsKit（存在 SQLi 和文件上传 CVE）
• 5 个目标安装了 Revslider（可能通过 CVE-2024-2534 实现 RCE）
• 7 个深度目标中有 5 个的 WP REST API 会反射 CORS 凭据
• 7 个目标中有 2 个开放了注册功能，且可通过 XMLRPC 上传 → 形成完整的 RCE 攻击链

验证

1. 插件检测 — 确认 WPScan 或手动检测结果：

   which wpscan 2>/dev/null && echo "PASS: wpscan installed" || echo "NOTE: wpscan not installed"
   

2. 版本提取 — 确认 readme.txt 解析结果：

   echo "Stable tag: 5.2.1" | grep -q "Stable tag" && echo "PASS: version tag recognized" || echo "FAIL"
   

所有测试均用于验证 WP 插件自动化是否就绪。

---

注意事项

• 自动扫描但不验证版本 — 检测到插件 slug 并不能确定其版本。使用 readme.txt、style.css 标头或变更日志获取版本。
• 插件检测产生误报 — 某些主题／插件会通过 HTML 注释被检测出来，但这可能是误报。至少通过 2 个独立信号进行验证。
• 批量扫描但不限制速率 — 扫描 1000 个站点以获取插件版本却不设置延迟，会触发 WAF 拦截和 IP 封禁。
• 未维护的插件不等于存在 CVE — 插件最后更新于 2018 年是风险信号，不代表存在漏洞。需要有 CVE 或已验证的利用方式。
• 猜测高级插件版本 — 高级插件没有公开的 SVN 仓库。版本检测需要采用其他方法（检查变更日志、readme 校验和）。

---

相关技能

• hunt-wordpress — WordPress 侦察的主要技能
• recon-sector — 针对特定行业的侦察（教会的网站插件漏洞率最高）
• hunt-rce — 插件 CVE 是 RCE 的主要攻击路径
• hunt-file-upload — 插件漏洞导致的文件上传 CVE
• hunt-sqli — 插件 SQLi 漏洞导致的 SQL 注入 CVE
• hunt-source-leak — debug.log 会泄露插件版本信息