CVE-2024-25600 PoC — WordPress Bricks Theme <= 1.9.6 - Unauthenticated Remote Code Execution (RCE) vulnerability

Description

Repository for internship test task. 

Readme

# test-task-CVE-2024-25600
Repository for internship test-task. 

### Step 0: Clone this git repo
```
git clone https://github.com/Sibul-Dan-Glokta/test-task-CVE-2024-25600
```

### Step 1: Create docker containers

#### Start Docker daemon

```
sudo systemctl start docker.service
```

#### Start Docker Containers
To start the docker container navigate to the wp_container directory
```
cd path/to/wp_container
```
Start the docker containers
```
sudo docker compose up -d
```

#### (optional) Check if the wordpress page started
The WP site may take roughly 30 seconds to get working properly. To validate if the WP page started issue the following command:
```
curl http://127.0.0.1:8080
```
The output should display HTML code. and no errors


### Step 2: Exploit the website
#### (If necessary) create a python virtual environment
```
python -m venv /path/to/new/virtual/environment
```

#### Install the necessary dependencies
To install the necessary dependencies navigate to the exploit directory and run the following command:
```
path/to/new/virtual/environment/bin/pip install -r requirements.txt
```

#### Run the exploit
While in the exploit directory to run the exploit issue the following command:
```
path/to/new/virtual/environment/bin/python3 exploit.py -u http://127.0.0.1:8080

```
This will crant you access to the server shell as www-data. And you will have access to /etc/passwd.
Output from exploit script and whoami
![alt text](image.png)

File Snapshot

Remarks