No 1. - wp-members: Interesting peristant XSS leading to remote code execution.

Posted on March 15, 2013 in Security • Tagged with Security, Programming • 8 min read

Hey you there!

Type: Stored cross site scripting
Risk: Medium to high
Affecting: http://wordpress.org/extend/plugins/wp-members/ Vendor site: http://rocketgeek.com

Preface

It has been quite some time since I took concern of my blog, although I would have had some content ready (maybe even worth) to be published. Around six weeks ago, I rummaged (wow - new word!) through endless lines of wordpress plugin code, in the hope to get my hands on some low hanging fruits (In the likely case you don't have a clue what I am talking about: I was searching for easyily detectable security bugs in plugin applications written for wordpress). After analysing for several hours the architecture and design of a randomly chosen target - wp-members, a plugin providing the site owner with the functionality to password protect content on his wordpress site - I was able to detect a pretty nasty bug.

The bug

Alongside with the access restriction mechanism, the plugin furthermore allows users to register. The potential user is presented a nice form, which would transfer an array of registration data to the web server when submitted. Considering this, there is only one possibile location for a sink source and therefore …


Continue reading

Linux/Unix privileges from a blackhats perspective

Posted on December 30, 2012 in Security • Tagged with Privilegeescalation, Unix, Security, Filepermissions • 1 min read

Hey folks!

Had some difficulties understanding UNIX file permissions in all it's variations and eternal predisposition to misuse as adminman! Made a little PDF, the independent blog article will follow soon. It's just a pain in the ass to format all that LibreOffice into a nice wordpress format. Next time, I will just do it in plain ASCII 7 Bit style, goddamnit...

Hell, it's time to read some phrack stuff again :)

Download PDF here: blackhats_view