HELLO v3!!!

app/controllers/aliases.rb

@@ -0,0 +1,13 @@
+module WPScan
+  module Controller
+    # Controller to add the aliases in the CLI
+    class Aliases < CMSScanner::Controller::Base
+      def cli_options
+        [
+          OptAlias.new(['--stealthy'],
+                       alias_for: '--random-user-agent --detection-mode passive --plugins-version-detection passive')
+        ]
+      end
+    end
+  end
+end

app/controllers/core.rb

@@ -0,0 +1,104 @@
+module WPScan
+  module Controller
+    # Specific Core controller to include WordPress checks
+    class Core < CMSScanner::Controller::Core
+      # @return [ Array<OptParseValidator::Opt> ]
+      def cli_options
+        [OptURL.new(['--url URL', 'The URL of the blog to scan'],
+                    required_unless: %i[update help version], default_protocol: 'http')] +
+          super.drop(1) + # delete the --url from CMSScanner
+          [
+            OptChoice.new(['--server SERVER', 'Force the supplied server module to be loaded'],
+                          choices: %w[apache iis nginx],
+                          normalize: %i[downcase to_sym]),
+            OptBoolean.new(['--force', 'Do not check if the target is running WordPress']),
+            OptBoolean.new(['--[no-]update', 'Wether or not to update the Database'],
+                           required_unless: %i[url help version])
+          ]
+      end
+
+      # @return [ DB::Updater ]
+      def local_db
+        @local_db ||= DB::Updater.new(DB_DIR)
+      end
+
+      # @return [ Boolean ]
+      def update_db_required?
+        if local_db.missing_files?
+          raise MissingDatabaseFile if parsed_options[:update] == false
+
+          return true
+        end
+
+        return parsed_options[:update] unless parsed_options[:update].nil?
+
+        return false unless user_interaction? && local_db.outdated?
+
+        output('@notice', msg: 'It seems like you have not updated the database for some time.')
+        print '[?] Do you want to update now? [Y]es [N]o, default: [N]'
+
+        Readline.readline =~ /^y/i ? true : false
+      end
+
+      def update_db
+        output('db_update_started')
+        output('db_update_finished', updated: local_db.update, verbose: parsed_options[:verbose])
+
+        exit(0) unless parsed_options[:url]
+      end
+
+      def before_scan
+        @last_update = local_db.last_update
+
+        maybe_output_banner_help_and_version # From CMS Scanner
+
+        update_db if update_db_required?
+        setup_cache
+        check_target_availability
+        load_server_module
+        check_wordpress_state
+      end
+
+      # Raises errors if the target is hosted on wordpress.com or is not running WordPress
+      # Also check if the homepage_url is still the install url
+      def check_wordpress_state
+        raise WordPressHostedError if target.wordpress_hosted?
+
+        if Addressable::URI.parse(target.homepage_url).path =~ %r{/wp-admin/install.php$}i
+
+          output('not_fully_configured', url: target.homepage_url)
+
+          exit(WPScan::ExitCode::VULNERABLE)
+        end
+
+        raise NotWordPressError unless target.wordpress? || parsed_options[:force]
+      end
+
+      # Loads the related server module in the target
+      # and includes it in the WpItem class which will be needed
+      # to check if directory listing is enabled etc
+      #
+      # @return [ Symbol ] The server module loaded
+      def load_server_module
+        server = target.server || :Apache # Tries to auto detect the server
+
+        # Force a specific server module to be loaded if supplied
+        case parsed_options[:server]
+        when :apache
+          server = :Apache
+        when :iis
+          server = :IIS
+        when :nginx
+          server = :Nginx
+        end
+
+        mod = CMSScanner::Target::Server.const_get(server)
+
+        target.extend mod
+        WPScan::WpItem.include mod
+
+        server
+      end
+    end
+  end
+end

app/controllers/custom_directories.rb

@@ -0,0 +1,23 @@
+module WPScan
+  module Controller
+    # Controller to ensure that the wp-content and wp-plugins
+    # directories are found
+    class CustomDirectories < CMSScanner::Controller::Base
+      def cli_options
+        [
+          OptString.new(['--wp-content-dir DIR']),
+          OptString.new(['--wp-plugins-dir DIR'])
+        ]
+      end
+
+      def before_scan
+        target.content_dir = parsed_options[:wp_content_dir] if parsed_options[:wp_content_dir]
+        target.plugins_dir = parsed_options[:wp_plugins_dir] if parsed_options[:wp_plugins_dir]
+
+        return if target.content_dir
+
+        raise 'Unable to identify the wp-content dir, please supply it with --wp-content-dir'
+      end
+    end
+  end
+end

app/controllers/enumeration.rb

@@ -0,0 +1,27 @@
+require_relative 'enumeration/cli_options'
+require_relative 'enumeration/enum_methods'
+
+module WPScan
+  module Controller
+    # Enumeration Controller
+    class Enumeration < CMSScanner::Controller::Base
+      def before_scan
+        DB::DynamicFinders::Plugin.create_versions_finders
+        DB::DynamicFinders::Theme.create_versions_finders
+      end
+
+      def run
+        enum = parsed_options[:enumerate] || {}
+
+        enum_plugins if enum_plugins?(enum)
+        enum_themes  if enum_themes?(enum)
+
+        %i[timthumbs config_backups db_exports medias].each do |key|
+          send("enum_#{key}".to_sym) if enum.key?(key)
+        end
+
+        enum_users if enum_users?(enum)
+      end
+    end
+  end
+end

app/controllers/enumeration/cli_options.rb

@@ -0,0 +1,163 @@
+module WPScan
+  module Controller
+    # Enumeration CLI Options
+    class Enumeration < CMSScanner::Controller::Base
+      def cli_options
+        cli_enum_choices + cli_plugins_opts + cli_themes_opts +
+          cli_timthumbs_opts + cli_config_backups_opts + cli_db_exports_opts +
+          cli_medias_opts + cli_users_opts
+      end
+
+      # @return [ Array<OptParseValidator::OptBase> ]
+      # rubocop:disable Metrics/MethodLength
+      def cli_enum_choices
+        [
+          OptMultiChoices.new(
+            ['--enumerate [OPTS]', '-e', 'Enumeration Process'],
+            choices: {
+              vp:  OptBoolean.new(['--vulnerable-plugins']),
+              ap:  OptBoolean.new(['--all-plugins']),
+              p:   OptBoolean.new(['--plugins']),
+              vt:  OptBoolean.new(['--vulnerable-themes']),
+              at:  OptBoolean.new(['--all-themes']),
+              t:   OptBoolean.new(['--themes']),
+              tt:  OptBoolean.new(['--timthumbs']),
+              cb:  OptBoolean.new(['--config-backups']),
+              dbe: OptBoolean.new(['--db-exports']),
+              u:   OptIntegerRange.new(['--users', 'User IDs range. e.g: u1-5'], value_if_empty: '1-10'),
+              m:   OptIntegerRange.new(['--medias', 'Media IDs range. e.g m1-15'], value_if_empty: '1-100')
+            },
+            value_if_empty: 'vp,vt,tt,cb,dbe,u,m',
+            incompatible: [%i[vp ap p], %i[vt at t]],
+            default: { all_plugins: true, config_backups: true }
+          ),
+          OptRegexp.new(
+            [
+              '--exclude-content-based REGEXP_OR_STRING',
+              'Exclude all responses matching the Regexp (case insensitive) during parts of the enumeration.',
+              'Both the headers and body are checked. Regexp delimiters are not required.'
+            ], options: Regexp::IGNORECASE
+          )
+        ]
+      end
+      # rubocop:enable Metrics/MethodLength
+
+      # @return [ Array<OptParseValidator::OptBase> ]
+      def cli_plugins_opts
+        [
+          OptSmartList.new(['--plugins-list LIST', 'List of plugins to enumerate']),
+          OptChoice.new(
+            ['--plugins-detection MODE',
+             'Use the supplied mode to enumerate Plugins, instead of the global (--detection-mode) mode.'],
+            choices: %w[mixed passive aggressive], normalize: :to_sym, default: :passive
+          ),
+          OptBoolean.new(
+            ['--plugins-version-all',
+             'Check all the plugins version locations according to the choosen mode (--detection-mode, ' \
+             '--plugins-detection and --plugins-version-detection)']
+          ),
+          OptChoice.new(
+            ['--plugins-version-detection MODE',
+             'Use the supplied mode to check plugins versions instead of the --detection-mode ' \
+             'or --plugins-detection modes.'],
+            choices: %w[mixed passive aggressive], normalize: :to_sym, default: :mixed
+          )
+        ]
+      end
+
+      # @return [ Array<OptParseValidator::OptBase> ]
+      def cli_themes_opts
+        [
+          OptSmartList.new(['--themes-list LIST', 'List of themes to enumerate']),
+          OptChoice.new(
+            ['--themes-detection MODE',
+             'Use the supplied mode to enumerate Themes, instead of the global (--detection-mode) mode.'],
+            choices: %w[mixed passive aggressive], normalize: :to_sym
+          ),
+          OptBoolean.new(
+            ['--themes-version-all',
+             'Check all the themes version locations according to the choosen mode (--detection-mode, ' \
+             '--themes-detection and --themes-version-detection)']
+          ),
+          OptChoice.new(
+            ['--themes-version-detection MODE',
+             'Use the supplied mode to check themes versions instead of the --detection-mode ' \
+             'or --themes-detection modes.'],
+            choices: %w[mixed passive aggressive], normalize: :to_sym
+          )
+        ]
+      end
+
+      # @return [ Array<OptParseValidator::OptBase> ]
+      def cli_timthumbs_opts
+        [
+          OptFilePath.new(
+            ['--timthumbs-list FILE-PATH', 'List of timthumbs\' location to use'],
+            exists: true, default: File.join(DB_DIR, 'timthumbs-v3.txt')
+          ),
+          OptChoice.new(
+            ['--timthumbs-detection MODE',
+             'Use the supplied mode to enumerate Timthumbs, instead of the global (--detection-mode) mode.'],
+            choices: %w[mixed passive aggressive], normalize: :to_sym
+          )
+        ]
+      end
+
+      # @return [ Array<OptParseValidator::OptBase> ]
+      def cli_config_backups_opts
+        [
+          OptFilePath.new(
+            ['--config-backups-list FILE-PATH', 'List of config backups\' filenames to use'],
+            exists: true, default: File.join(DB_DIR, 'config_backups.txt')
+          ),
+          OptChoice.new(
+            ['--config-backups-detection MODE',
+             'Use the supplied mode to enumerate Config Backups, instead of the global (--detection-mode) mode.'],
+            choices: %w[mixed passive aggressive], normalize: :to_sym
+          )
+        ]
+      end
+
+      # @return [ Array<OptParseValidator::OptBase> ]
+      def cli_db_exports_opts
+        [
+          OptFilePath.new(
+            ['--db-exports-list FILE-PATH', 'List of DB exports\' paths to use'],
+            exists: true, default: File.join(DB_DIR, 'db_exports.txt')
+          ),
+          OptChoice.new(
+            ['--db-exports-detection MODE',
+             'Use the supplied mode to enumerate DB Exports, instead of the global (--detection-mode) mode.'],
+            choices: %w[mixed passive aggressive], normalize: :to_sym
+          )
+        ]
+      end
+
+      # @return [ Array<OptParseValidator::OptBase> ]
+      def cli_medias_opts
+        [
+          OptChoice.new(
+            ['--medias-detection MODE',
+             'Use the supplied mode to enumerate Medias, instead of the global (--detection-mode) mode.'],
+            choices: %w[mixed passive aggressive], normalize: :to_sym
+          )
+        ]
+      end
+
+      # @return [ Array<OptParseValidator::OptBase> ]
+      def cli_users_opts
+        [
+          OptSmartList.new(
+            ['--users-list LIST',
+             'List of users to check during the users enumeration from the Login Error Messages']
+          ),
+          OptChoice.new(
+            ['--users-detection MODE',
+             'Use the supplied mode to enumerate Users, instead of the global (--detection-mode) mode.'],
+            choices: %w[mixed passive aggressive], normalize: :to_sym
+          )
+        ]
+      end
+    end
+  end
+end

app/controllers/enumeration/enum_methods.rb

@@ -0,0 +1,178 @@
+module WPScan
+  module Controller
+    # Enumeration Methods
+    class Enumeration < CMSScanner::Controller::Base
+      # @param [ String ] type (plugins or themes)
+      #
+      # @return [ String ] The related enumration message depending on the parsed_options and type supplied
+      def enum_message(type)
+        return unless %w[plugins themes].include?(type)
+
+        details = if parsed_options[:enumerate][:"vulnerable_#{type}"]
+                    'Vulnerable'
+                  elsif parsed_options[:enumerate][:"all_#{type}"]
+                    'All'
+                  else
+                    'Most Popular'
+                  end
+
+        "Enumerating #{details} #{type.capitalize}"
+      end
+
+      # @param [ String ] type (plugins, themes etc)
+      #
+      # @return [ Hash ]
+      def default_opts(type)
+        mode = parsed_options[:"#{type}_detection"] || parsed_options[:detection_mode]
+
+        {
+          mode: mode,
+          exclude_content: parsed_options[:exclude_content_based],
+          show_progression: user_interaction?,
+          version_detection: {
+            mode: parsed_options[:"#{type}_version_detection"] || mode,
+            confidence_threshold: parsed_options[:"#{type}_version_all"] ? 0 : 100
+          }
+        }
+      end
+
+      # @param [ Hash ] opts
+      #
+      # @return [ Boolean ] Wether or not to enumerate the plugins
+      def enum_plugins?(opts)
+        opts[:plugins] || opts[:all_plugins] || opts[:vulnerable_plugins]
+      end
+
+      def enum_plugins
+        opts = default_opts('plugins').merge(
+          list: plugins_list_from_opts(parsed_options),
+          sort: true
+        )
+
+        output('@info', msg: enum_message('plugins')) if user_interaction?
+        # Enumerate the plugins & find their versions to avoid doing that when #version
+        # is called in the view
+        plugins = target.plugins(opts)
+
+        output('@info', msg: 'Checking Plugin Versions') if user_interaction? && !plugins.empty?
+
+        plugins.each(&:version)
+
+        plugins.select!(&:vulnerable?) if parsed_options[:enumerate][:vulnerable_plugins]
+
+        output('plugins', plugins: plugins)
+      end
+
+      # @param [ Hash ] opts
+      #
+      # @return [ Array<String> ] The plugins list associated to the cli options
+      def plugins_list_from_opts(opts)
+        # List file provided by the user via the cli
+        return opts[:plugins_list] if opts[:plugins_list]
+
+        if opts[:enumerate][:all_plugins]
+          DB::Plugins.all_slugs
+        elsif opts[:enumerate][:plugins]
+          DB::Plugins.popular_slugs
+        else
+          DB::Plugins.vulnerable_slugs
+        end
+      end
+
+      # @param [ Hash ] opts
+      #
+      # @return [ Boolean ] Wether or not to enumerate the themes
+      def enum_themes?(opts)
+        opts[:themes] || opts[:all_themes] || opts[:vulnerable_themes]
+      end
+
+      def enum_themes
+        opts = default_opts('themes').merge(
+          list: themes_list_from_opts(parsed_options),
+          sort: true
+        )
+
+        output('@info', msg: enum_message('themes')) if user_interaction?
+        # Enumerate the themes & find their versions to avoid doing that when #version
+        # is called in the view
+        themes = target.themes(opts)
+
+        output('@info', msg: 'Checking Theme Versions') if user_interaction? && !themes.empty?
+
+        themes.each(&:version)
+
+        themes.select!(&:vulnerable?) if parsed_options[:enumerate][:vulnerable_themes]
+
+        output('themes', themes: themes)
+      end
+
+      # @param [ Hash ] opts
+      #
+      # @return [ Array<String> ] The themes list associated to the cli options
+      def themes_list_from_opts(opts)
+        # List file provided by the user via the cli
+        return opts[:themes_list] if opts[:themes_list]
+
+        if opts[:enumerate][:all_themes]
+          DB::Themes.all_slugs
+        elsif opts[:enumerate][:themes]
+          DB::Themes.popular_slugs
+        else
+          DB::Themes.vulnerable_slugs
+        end
+      end
+
+      def enum_timthumbs
+        opts = default_opts('timthumbs').merge(list: parsed_options[:timthumbs_list])
+
+        output('@info', msg: 'Enumerating Timthumbs') if user_interaction?
+        output('timthumbs', timthumbs: target.timthumbs(opts))
+      end
+
+      def enum_config_backups
+        opts = default_opts('config_backups').merge(list: parsed_options[:config_backups_list])
+
+        output('@info', msg: 'Enumerating Config Backups') if user_interaction?
+        output('config_backups', config_backups: target.config_backups(opts))
+      end
+
+      def enum_db_exports
+        opts = default_opts('db_exports').merge(list: parsed_options[:db_exports_list])
+
+        output('@info', msg: 'Enumerating DB Exports') if user_interaction?
+        output('db_exports', db_exports: target.db_exports(opts))
+      end
+
+      def enum_medias
+        opts = default_opts('medias').merge(range: parsed_options[:enumerate][:medias])
+
+        output('@info', msg: 'Enumerating Medias') if user_interaction?
+        output('medias', medias: target.medias(opts))
+      end
+
+      # @param [ Hash ] opts
+      #
+      # @return [ Boolean ] Wether or not to enumerate the users
+      def enum_users?(opts)
+        opts[:users] || (parsed_options[:passwords] && !parsed_options[:username] && !parsed_options[:usernames])
+      end
+
+      def enum_users
+        opts = default_opts('users').merge(
+          range: enum_users_range,
+          list: parsed_options[:users_list]
+        )
+
+        output('@info', msg: 'Enumerating Users') if user_interaction?
+        output('users', users: target.users(opts))
+      end
+
+      # @return [ Range ] The user ids range to enumerate
+      # If the --enumerate is used, the default value is handled by the Option
+      # However, when using --passwords alone, the default has to be set by the code below
+      def enum_users_range
+        parsed_options[:enumerate][:users] || cli_enum_choices[0].choices[:u].validate(nil)
+      end
+    end
+  end
+end

app/controllers/main_theme.rb

@@ -0,0 +1,27 @@
+module WPScan
+  module Controller
+    # Main Theme Controller
+    class MainTheme < CMSScanner::Controller::Base
+      def cli_options
+        [
+          OptChoice.new(
+            ['--main-theme-detection MODE',
+             'Use the supplied mode for the Main theme detection, instead of the global (--detection-mode) mode.'],
+            choices: %w[mixed passive aggressive],
+            normalize: :to_sym
+          )
+        ]
+      end
+
+      def run
+        output(
+          'theme',
+          theme: target.main_theme(
+            mode: parsed_options[:main_theme_detection] || parsed_options[:detection_mode]
+          ),
+          verbose: parsed_options[:verbose]
+        )
+      end
+    end
+  end
+end

app/controllers/password_attack.rb

@@ -0,0 +1,108 @@
+module WPScan
+  module Controller
+    # Password Attack Controller
+    class PasswordAttack < CMSScanner::Controller::Base
+      def cli_options
+        [
+          OptFilePath.new(
+            ['--passwords FILE-PATH', '-P',
+             'List of passwords to use during the password attack.',
+             'If no --username/s option supplied, user enumeration will be run.'],
+            exists: true
+          ),
+          OptSmartList.new(['--usernames LIST', '-U', 'List of usernames to use during the password attack.']),
+          OptInteger.new(['--multicall-max-passwords MAX_PWD',
+                          'Maximum number of passwords to send by request with XMLRPC multicall'],
+                         default: 500),
+          OptChoice.new(['--password-attack ATTACK',
+                         'Force the supplied attack to be used rather than automatically determining one.'],
+                        choices: %w[wp-login xmlrpc xmlrpc-multicall],
+                        normalize: %i[downcase underscore to_sym])
+        ]
+      end
+
+      def run
+        return unless parsed_options[:passwords]
+
+        if user_interaction?
+          output('@info',
+                 msg: "Performing password attack on #{attacker.titleize} against #{users.size} user/s")
+        end
+
+        attack_opts = {
+          show_progression: user_interaction?,
+          multicall_max_passwords: parsed_options[:multicall_max_passwords]
+        }
+
+        begin
+          found = []
+
+          attacker.attack(users, passwords(parsed_options[:passwords]), attack_opts) do |user|
+            found << user
+
+            attacker.progress_bar.log("[SUCCESS] - #{user.username} / #{user.password}")
+          end
+        ensure
+          output('users', users: found)
+        end
+      end
+
+      # @return [ CMSScanner::Finders::Finder ] The finder used to perform the attack
+      def attacker
+        @attacker ||= attacker_from_cli_options || attacker_from_automatic_detection
+      end
+
+      # @return [ WPScan::XMLRPC ]
+      def xmlrpc
+        @xmlrpc ||= target.xmlrpc
+      end
+
+      # @return [ CMSScanner::Finders::Finder ]
+      def attacker_from_cli_options
+        return unless parsed_options[:password_attack]
+
+        case parsed_options[:password_attack]
+        when :wp_login
+          WPScan::Finders::Passwords::WpLogin.new(target)
+        when :xmlrpc
+          WPScan::Finders::Passwords::XMLRPC.new(xmlrpc)
+        when :xmlrpc_multicall
+          WPScan::Finders::Passwords::XMLRPCMulticall.new(xmlrpc)
+        end
+      end
+
+      # @return [ CMSScanner::Finders::Finder ]
+      def attacker_from_automatic_detection
+        if xmlrpc&.enabled? && xmlrpc.available_methods.include?('wp.getUsersBlogs')
+          wp_version = target.wp_version
+
+          if wp_version && wp_version < '4.4'
+            WPScan::Finders::Passwords::XMLRPCMulticall.new(xmlrpc)
+          else
+            WPScan::Finders::Passwords::XMLRPC.new(xmlrpc)
+          end
+        else
+          WPScan::Finders::Passwords::WpLogin.new(target)
+        end
+      end
+
+      # @return [ Array<Users> ] The users to brute force
+      def users
+        return target.users unless parsed_options[:usernames]
+
+        parsed_options[:usernames].reduce([]) do |acc, elem|
+          acc << CMSScanner::User.new(elem.chomp)
+        end
+      end
+
+      # @param [ String ] wordlist_path
+      #
+      # @return [ Array<String> ]
+      def passwords(wordlist_path)
+        @passwords ||= File.open(wordlist_path).reduce([]) do |acc, elem|
+          acc << elem.chomp
+        end
+      end
+    end
+  end
+end

app/controllers/wp_version.rb

@@ -0,0 +1,34 @@
+module WPScan
+  module Controller
+    # Wp Version Controller
+    class WpVersion < CMSScanner::Controller::Base
+      def cli_options
+        [
+          OptBoolean.new(['--wp-version-all', 'Check all the version locations']),
+          OptChoice.new(
+            ['--wp-version-detection MODE',
+             'Use the supplied mode for the WordPress version detection, ' \
+             'instead of the global (--detection-mode) mode.'],
+            choices: %w[mixed passive aggressive],
+            normalize: :to_sym
+          )
+        ]
+      end
+
+      def before_scan
+        WPScan::DB::DynamicFinders::Wordpress.create_versions_finders
+      end
+
+      def run
+        output(
+          'version',
+          version: target.wp_version(
+            mode: parsed_options[:wp_version_detection] || parsed_options[:detection_mode],
+            confidence_threshold: parsed_options[:wp_version_all] ? 0 : 100,
+            show_progression: user_interaction?
+          )
+        )
+      end
+    end
+  end
+end