update wordpress plugins and themes lists

[h00die]

This PR runs tools/dev/check_external_scripts.rb to pull in the new wordpress plugins/themes.

Verification

• Start msfconsole
• use auxiliary/scanner/http/wordpress_scanner
• set exploitable false
• set rhosts/threads
• run
• Verify it runs through everything without throwing errors

Example run w/ updates:

msf6 auxiliary(scanner/http/wordpress_scanner) > run

[*] Trying 2.2.2.2
[+] 2.2.2.2 - Detected Wordpress 5.7.8
[*] 2.2.2.2 - Enumerating Themes
[*] 2.2.2.2 - Progress      0/24085 (0.0%)
[*] 2.2.2.2 - Progress   1000/24085 (4.15%)
[*] 2.2.2.2 - Progress   2000/24085 (8.3%)
[*] 2.2.2.2 - Progress   3000/24085 (12.45%)
[*] 2.2.2.2 - Progress   4000/24085 (16.6%)
[*] 2.2.2.2 - Progress   5000/24085 (20.75%)
[*] 2.2.2.2 - Progress   6000/24085 (24.91%)
[*] 2.2.2.2 - Progress   7000/24085 (29.06%)
[*] 2.2.2.2 - Progress   8000/24085 (33.21%)
[*] 2.2.2.2 - Progress   9000/24085 (37.36%)
[*] 2.2.2.2 - Progress  10000/24085 (41.51%)
[*] 2.2.2.2 - Progress  11000/24085 (45.67%)
[*] 2.2.2.2 - Progress  12000/24085 (49.82%)
[*] 2.2.2.2 - Progress  13000/24085 (53.97%)
[*] 2.2.2.2 - Progress  14000/24085 (58.12%)
[*] 2.2.2.2 - Progress  15000/24085 (62.27%)
[*] 2.2.2.2 - Progress  16000/24085 (66.43%)
[*] 2.2.2.2 - Progress  17000/24085 (70.58%)
[*] 2.2.2.2 - Progress  18000/24085 (74.73%)
[*] 2.2.2.2 - Progress  19000/24085 (78.88%)
[*] 2.2.2.2 - Progress  20000/24085 (83.03%)
[*] 2.2.2.2 - Progress  21000/24085 (87.19%)
[+] 2.2.2.2 - Detected theme: twentynineteen version 1.5
[+] 2.2.2.2 - Detected theme: twentyseventeen version 2.3
[+] 2.2.2.2 - Detected theme: twentytwenty version 1.2
[+] 2.2.2.2 - Detected theme: twentytwentyone version 1.2
[*] 2.2.2.2 - Progress  22000/24085 (91.34%)
[*] 2.2.2.2 - Progress  23000/24085 (95.49%)
[*] 2.2.2.2 - Progress  24000/24085 (99.64%)
[*] 2.2.2.2 - Finished scanning themes
[*] 2.2.2.2 - Enumerating plugins
[*] 2.2.2.2 - Progress      0/97170 (0.0%)
[*] 2.2.2.2 - Progress   1000/97170 (1.02%)
[*] 2.2.2.2 - Progress   2000/97170 (2.05%)
[*] 2.2.2.2 - Progress   3000/97170 (3.08%)
[+] 2.2.2.2 - Detected plugin: akismet version 4.1.5
[*] 2.2.2.2 - Progress   4000/97170 (4.11%)
[*] 2.2.2.2 - Progress   5000/97170 (5.14%)
[*] 2.2.2.2 - Progress   6000/97170 (6.17%)
[*] 2.2.2.2 - Progress   7000/97170 (7.2%)
[+] 2.2.2.2 - Detected plugin: backup version 1.5.8
[*] 2.2.2.2 - Progress   8000/97170 (8.23%)
[*] 2.2.2.2 - Progress   9000/97170 (9.26%)
[+] 2.2.2.2 - Detected plugin: boldgrid-backup version 1.14.9
[*] 2.2.2.2 - Progress  10000/97170 (10.29%)
[+] 2.2.2.2 - Detected plugin: brizy version 2.3.15
[*] 2.2.2.2 - Progress  11000/97170 (11.32%)
[+] 2.2.2.2 - Detected plugin: bulletproof-security version 5.1
[*] 2.2.2.2 - Progress  12000/97170 (12.34%)
[+] 2.2.2.2 - Detected plugin: catch-themes-demo-import version 
[*] 2.2.2.2 - Progress  13000/97170 (13.37%)
[*] 2.2.2.2 - Progress  14000/97170 (14.4%)
[*] 2.2.2.2 - Progress  15000/97170 (15.43%)
[*] 2.2.2.2 - Progress  16000/97170 (16.46%)
[+] 2.2.2.2 - Detected plugin: contact-form-7 version 5.1.9
[*] 2.2.2.2 - Progress  17000/97170 (17.49%)
[*] 2.2.2.2 - Progress  18000/97170 (18.52%)
[*] 2.2.2.2 - Progress  19000/97170 (19.55%)
[*] 2.2.2.2 - Progress  20000/97170 (20.58%)
[*] 2.2.2.2 - Progress  21000/97170 (21.61%)
[*] 2.2.2.2 - Progress  22000/97170 (22.64%)
[+] 2.2.2.2 - Detected plugin: drag-and-drop-multiple-file-upload-contact-form-7 version 1.3.3.2
[+] 2.2.2.2 - Detected plugin: duplicator version 1.2.40
[*] 2.2.2.2 - Progress  23000/97170 (23.66%)
[+] 2.2.2.2 - Detected plugin: easy-wp-smtp version 1.4.1
[*] 2.2.2.2 - Progress  24000/97170 (24.69%)
[*] 2.2.2.2 - Progress  25000/97170 (25.72%)
[+] 2.2.2.2 - Detected plugin: email-subscribers version 4.2.2
[*] 2.2.2.2 - Progress  26000/97170 (26.75%)
[*] 2.2.2.2 - Progress  27000/97170 (27.78%)
[*] 2.2.2.2 - Progress  28000/97170 (28.81%)
[*] 2.2.2.2 - Progress  29000/97170 (29.84%)
[*] 2.2.2.2 - Progress  30000/97170 (30.87%)
[*] 2.2.2.2 - Progress  31000/97170 (31.9%)
[*] 2.2.2.2 - Progress  32000/97170 (32.93%)
[*] 2.2.2.2 - Progress  33000/97170 (33.96%)
[+] 2.2.2.2 - Detected plugin: gotmls version 4.20.59
[*] 2.2.2.2 - Progress  34000/97170 (34.99%)
[*] 2.2.2.2 - Progress  35000/97170 (36.01%)
[*] 2.2.2.2 - Progress  36000/97170 (37.04%)
[*] 2.2.2.2 - Progress  37000/97170 (38.07%)
[*] 2.2.2.2 - Progress  38000/97170 (39.1%)
[*] 2.2.2.2 - Progress  39000/97170 (40.13%)
[*] 2.2.2.2 - Progress  40000/97170 (41.16%)
[*] 2.2.2.2 - Progress  41000/97170 (42.19%)
[*] 2.2.2.2 - Progress  42000/97170 (43.22%)
[+] 2.2.2.2 - Detected plugin: learnpress version 3.2.6.7
[*] 2.2.2.2 - Progress  43000/97170 (44.25%)
[+] 2.2.2.2 - Detected plugin: loginizer version 1.6.3
[*] 2.2.2.2 - Progress  44000/97170 (45.28%)
[*] 2.2.2.2 - Progress  45000/97170 (46.31%)
[*] 2.2.2.2 - Progress  46000/97170 (47.33%)
[*] 2.2.2.2 - Progress  47000/97170 (48.36%)
[*] 2.2.2.2 - Progress  48000/97170 (49.39%)
[*] 2.2.2.2 - Progress  49000/97170 (50.42%)
[*] 2.2.2.2 - Progress  50000/97170 (51.45%)
[*] 2.2.2.2 - Progress  51000/97170 (52.48%)
[*] 2.2.2.2 - Progress  52000/97170 (53.51%)
[+] 2.2.2.2 - Detected plugin: optinmonster version 2.6.4
[*] 2.2.2.2 - Progress  53000/97170 (54.54%)
[*] 2.2.2.2 - Progress  54000/97170 (55.57%)
[*] 2.2.2.2 - Progress  55000/97170 (56.6%)
[+] 2.2.2.2 - Detected plugin: pie-register version 3.7.1.4
[*] 2.2.2.2 - Progress  56000/97170 (57.63%)
[*] 2.2.2.2 - Progress  57000/97170 (58.66%)
[*] 2.2.2.2 - Progress  58000/97170 (59.68%)
[*] 2.2.2.2 - Progress  59000/97170 (60.71%)
[*] 2.2.2.2 - Progress  60000/97170 (61.74%)
[*] 2.2.2.2 - Progress  61000/97170 (62.77%)
[*] 2.2.2.2 - Progress  62000/97170 (63.8%)
[*] 2.2.2.2 - Progress  63000/97170 (64.83%)
[*] 2.2.2.2 - Progress  64000/97170 (65.86%)
[*] 2.2.2.2 - Progress  65000/97170 (66.89%)
[*] 2.2.2.2 - Progress  66000/97170 (67.92%)
[*] 2.2.2.2 - Progress  67000/97170 (68.95%)
[+] 2.2.2.2 - Detected plugin: simple-file-list version 4.2.2
[*] 2.2.2.2 - Progress  68000/97170 (69.98%)
[*] 2.2.2.2 - Progress  69000/97170 (71.0%)
[*] 2.2.2.2 - Progress  70000/97170 (72.03%)
[*] 2.2.2.2 - Progress  71000/97170 (73.06%)
[*] 2.2.2.2 - Progress  72000/97170 (74.09%)
[*] 2.2.2.2 - Progress  73000/97170 (75.12%)
[*] 2.2.2.2 - Progress  74000/97170 (76.15%)
[*] 2.2.2.2 - Progress  75000/97170 (77.18%)
[*] 2.2.2.2 - Progress  76000/97170 (78.21%)
[*] 2.2.2.2 - Progress  77000/97170 (79.24%)
[*] 2.2.2.2 - Progress  78000/97170 (80.27%)
[*] 2.2.2.2 - Progress  79000/97170 (81.3%)
[*] 2.2.2.2 - Progress  80000/97170 (82.32%)
[*] 2.2.2.2 - Progress  81000/97170 (83.35%)
[*] 2.2.2.2 - Progress  82000/97170 (84.38%)
[*] 2.2.2.2 - Progress  83000/97170 (85.41%)
[*] 2.2.2.2 - Progress  84000/97170 (86.44%)
[+] 2.2.2.2 - Detected plugin: woocommerce version 4.8.0
[+] 2.2.2.2 - Detected plugin: woocommerce-abandoned-cart version You
[*] 2.2.2.2 - Progress  85000/97170 (87.47%)
[*] 2.2.2.2 - Progress  86000/97170 (88.5%)
[+] 2.2.2.2 - Detected plugin: wordpress-popular-posts version 5.3.2
[*] 2.2.2.2 - Progress  87000/97170 (89.53%)
[*] 2.2.2.2 - Progress  88000/97170 (90.56%)
[*] 2.2.2.2 - Progress  89000/97170 (91.59%)
[+] 2.2.2.2 - Detected plugin: wp-fastest-cache version 0.9.4
[*] 2.2.2.2 - Progress  90000/97170 (92.62%)
[*] 2.2.2.2 - Progress  91000/97170 (93.65%)
[*] 2.2.2.2 - Progress  92000/97170 (94.67%)
[+] 2.2.2.2 - Detected plugin: wp-super-cache version 1.7.1
[*] 2.2.2.2 - Progress  93000/97170 (95.7%)
[*] 2.2.2.2 - Progress  94000/97170 (96.73%)
[*] 2.2.2.2 - Progress  95000/97170 (97.76%)
[*] 2.2.2.2 - Progress  96000/97170 (98.79%)
[*] 2.2.2.2 - Progress  97000/97170 (99.82%)
[*] 2.2.2.2 - Finished scanning plugins
[*] 2.2.2.2 - Searching Users
[*] 2.2.2.2 - Was not able to identify users on site using /wp-json/wp/v2/users
[*] 2.2.2.2 - Finished all scans
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

[gwillcox-r7]

@h00die Question but how long did this take for you to run? For me this is taking literally 10's of minutes and I've not even gotten past [*] 2.2.2.2 - Progress 1000/24085 (4.15%) equivalent on the theme detection.

[h00die]

It's not fast since there are sooooo many, however I set threads to 10, then ran some metal to the scrapper, yard waste to the dump, truck broke down and got it pushed to safety, had someone come try to jump it, nearly started a fire (alternator blew and must have a short), then came back home and it was done. When did it finish? No idea, but yea jack the threads up!

[gwillcox-r7]

Yeah unforunately I can't test this @h00die its taking 8-10 seconds to retrieve 10 themes. Upping the threads doesn't help since we only support threads running across hosts and have a limit of one thread per host scanned atm.

I think overall the PR itself looks good though, just worried that without an upgrade to the tools that use it this will mean that there is simply too much data to go through in any reasonable timeframe. For me it would take about 66 hours at the current rate for this data to be processed just for the themes itself.

Perhaps we should look at adding threading support to the scanner tools that use these lists? I'm just worried that since these are defaults users will start complaining that the defaults are too large.

[h00die]

I'll give mine a run again and let you know what my timing is (26.22 minutes). This is also why the exploitable option was added so you can just do a quick list. Yours is taking unreasonably long though...

[adfoster-r7]

Looks good to me; Running against wordpress in docker with the msfconsole time command took 40 minutes:

msf6 auxiliary(scanner/http/wordpress_scanner) > time run rhosts=127.0.0.1 rport=8080

[*] Trying 127.0.0.1
[+] 127.0.0.1 - Detected Wordpress 6.1
[*] 127.0.0.1 - Enumerating Themes
[*] 127.0.0.1 - Progress      0/24085 (0.0%)
[*] 127.0.0.1 - Progress   1000/24085 (4.15%)
[*] 127.0.0.1 - Progress   2000/24085 (8.3%)
[*] 127.0.0.1 - Progress   3000/24085 (12.45%)
[*] 127.0.0.1 - Progress   4000/24085 (16.6%)
[*] 127.0.0.1 - Progress   5000/24085 (20.75%)
[*] 127.0.0.1 - Progress   6000/24085 (24.91%)
[*] 127.0.0.1 - Progress   7000/24085 (29.06%)
[*] 127.0.0.1 - Progress   8000/24085 (33.21%)
[*] 127.0.0.1 - Progress   9000/24085 (37.36%)
[*] 127.0.0.1 - Progress  10000/24085 (41.51%)
[*] 127.0.0.1 - Progress  11000/24085 (45.67%)
[*] 127.0.0.1 - Progress  12000/24085 (49.82%)
[*] 127.0.0.1 - Progress  13000/24085 (53.97%)
[*] 127.0.0.1 - Progress  14000/24085 (58.12%)
[*] 127.0.0.1 - Progress  15000/24085 (62.27%)
[*] 127.0.0.1 - Progress  16000/24085 (66.43%)
[*] 127.0.0.1 - Progress  17000/24085 (70.58%)
[*] 127.0.0.1 - Progress  18000/24085 (74.73%)
[*] 127.0.0.1 - Progress  19000/24085 (78.88%)
[*] 127.0.0.1 - Progress  20000/24085 (83.03%)
[*] 127.0.0.1 - Progress  21000/24085 (87.19%)
[+] 127.0.0.1 - Detected theme: twentytwentythree version 1.0
[+] 127.0.0.1 - Detected theme: twentytwentytwo version 1.3
[*] 127.0.0.1 - Progress  22000/24085 (91.34%)
[*] 127.0.0.1 - Progress  23000/24085 (95.49%)
[*] 127.0.0.1 - Progress  24000/24085 (99.64%)
[*] 127.0.0.1 - Finished scanning themes
[*] 127.0.0.1 - Enumerating plugins
[*] 127.0.0.1 - Progress      0/97170 (0.0%)
[*] 127.0.0.1 - Progress   1000/97170 (1.02%)
[*] 127.0.0.1 - Progress   2000/97170 (2.05%)
[*] 127.0.0.1 - Progress   3000/97170 (3.08%)
[*] 127.0.0.1 - Progress   4000/97170 (4.11%)
[*] 127.0.0.1 - Progress   5000/97170 (5.14%)
[*] 127.0.0.1 - Progress   6000/97170 (6.17%)
[*] 127.0.0.1 - Progress   7000/97170 (7.2%)
[*] 127.0.0.1 - Progress   8000/97170 (8.23%)
[*] 127.0.0.1 - Progress   9000/97170 (9.26%)
[*] 127.0.0.1 - Progress  10000/97170 (10.29%)
[*] 127.0.0.1 - Progress  11000/97170 (11.32%)
[*] 127.0.0.1 - Progress  12000/97170 (12.34%)
[*] 127.0.0.1 - Progress  13000/97170 (13.37%)
[*] 127.0.0.1 - Progress  14000/97170 (14.4%)
[*] 127.0.0.1 - Progress  15000/97170 (15.43%)
[*] 127.0.0.1 - Progress  16000/97170 (16.46%)
[*] 127.0.0.1 - Progress  17000/97170 (17.49%)
[*] 127.0.0.1 - Progress  18000/97170 (18.52%)
[*] 127.0.0.1 - Progress  19000/97170 (19.55%)
[*] 127.0.0.1 - Progress  20000/97170 (20.58%)
[*] 127.0.0.1 - Progress  21000/97170 (21.61%)
[*] 127.0.0.1 - Progress  22000/97170 (22.64%)
[*] 127.0.0.1 - Progress  23000/97170 (23.66%)
[*] 127.0.0.1 - Progress  24000/97170 (24.69%)
[*] 127.0.0.1 - Progress  25000/97170 (25.72%)
[*] 127.0.0.1 - Progress  26000/97170 (26.75%)
[*] 127.0.0.1 - Progress  27000/97170 (27.78%)
[*] 127.0.0.1 - Progress  28000/97170 (28.81%)
[*] 127.0.0.1 - Progress  29000/97170 (29.84%)
[*] 127.0.0.1 - Progress  30000/97170 (30.87%)
[*] 127.0.0.1 - Progress  31000/97170 (31.9%)
[*] 127.0.0.1 - Progress  32000/97170 (32.93%)
[*] 127.0.0.1 - Progress  33000/97170 (33.96%)
[*] 127.0.0.1 - Progress  34000/97170 (34.99%)
[*] 127.0.0.1 - Progress  35000/97170 (36.01%)
[*] 127.0.0.1 - Progress  36000/97170 (37.04%)
[*] 127.0.0.1 - Progress  37000/97170 (38.07%)
[*] 127.0.0.1 - Progress  38000/97170 (39.1%)
[*] 127.0.0.1 - Progress  39000/97170 (40.13%)
[*] 127.0.0.1 - Progress  40000/97170 (41.16%)
[*] 127.0.0.1 - Progress  41000/97170 (42.19%)
[*] 127.0.0.1 - Progress  42000/97170 (43.22%)
[*] 127.0.0.1 - Progress  43000/97170 (44.25%)
[*] 127.0.0.1 - Progress  44000/97170 (45.28%)
[*] 127.0.0.1 - Progress  45000/97170 (46.31%)
[*] 127.0.0.1 - Progress  46000/97170 (47.33%)
[*] 127.0.0.1 - Progress  47000/97170 (48.36%)
[*] 127.0.0.1 - Progress  48000/97170 (49.39%)
[*] 127.0.0.1 - Progress  49000/97170 (50.42%)
[*] 127.0.0.1 - Progress  50000/97170 (51.45%)
[*] 127.0.0.1 - Progress  51000/97170 (52.48%)
[*] 127.0.0.1 - Progress  52000/97170 (53.51%)
[*] 127.0.0.1 - Progress  53000/97170 (54.54%)
[*] 127.0.0.1 - Progress  54000/97170 (55.57%)
[*] 127.0.0.1 - Progress  55000/97170 (56.6%)
[*] 127.0.0.1 - Progress  56000/97170 (57.63%)
[*] 127.0.0.1 - Progress  57000/97170 (58.66%)
[*] 127.0.0.1 - Progress  58000/97170 (59.68%)
[*] 127.0.0.1 - Progress  59000/97170 (60.71%)
[*] 127.0.0.1 - Progress  60000/97170 (61.74%)
[*] 127.0.0.1 - Progress  61000/97170 (62.77%)
[*] 127.0.0.1 - Progress  62000/97170 (63.8%)
[*] 127.0.0.1 - Progress  63000/97170 (64.83%)
[*] 127.0.0.1 - Progress  64000/97170 (65.86%)
[*] 127.0.0.1 - Progress  65000/97170 (66.89%)
[*] 127.0.0.1 - Progress  66000/97170 (67.92%)
[*] 127.0.0.1 - Progress  67000/97170 (68.95%)
[*] 127.0.0.1 - Progress  68000/97170 (69.98%)
[*] 127.0.0.1 - Progress  69000/97170 (71.0%)
[*] 127.0.0.1 - Progress  70000/97170 (72.03%)
[*] 127.0.0.1 - Progress  71000/97170 (73.06%)
[*] 127.0.0.1 - Progress  72000/97170 (74.09%)
[*] 127.0.0.1 - Progress  73000/97170 (75.12%)
[*] 127.0.0.1 - Progress  74000/97170 (76.15%)
[*] 127.0.0.1 - Progress  75000/97170 (77.18%)
[*] 127.0.0.1 - Progress  76000/97170 (78.21%)
[*] 127.0.0.1 - Progress  77000/97170 (79.24%)
[*] 127.0.0.1 - Progress  78000/97170 (80.27%)
[*] 127.0.0.1 - Progress  79000/97170 (81.3%)
[*] 127.0.0.1 - Progress  80000/97170 (82.32%)
[*] 127.0.0.1 - Progress  81000/97170 (83.35%)
[*] 127.0.0.1 - Progress  82000/97170 (84.38%)
[*] 127.0.0.1 - Progress  83000/97170 (85.41%)
[*] 127.0.0.1 - Progress  84000/97170 (86.44%)
[*] 127.0.0.1 - Progress  85000/97170 (87.47%)
[*] 127.0.0.1 - Progress  86000/97170 (88.5%)
[*] 127.0.0.1 - Progress  87000/97170 (89.53%)
[*] 127.0.0.1 - Progress  88000/97170 (90.56%)
[*] 127.0.0.1 - Progress  89000/97170 (91.59%)
[*] 127.0.0.1 - Progress  90000/97170 (92.62%)
[*] 127.0.0.1 - Progress  91000/97170 (93.65%)
[*] 127.0.0.1 - Progress  92000/97170 (94.67%)
[*] 127.0.0.1 - Progress  93000/97170 (95.7%)
[*] 127.0.0.1 - Progress  94000/97170 (96.73%)
[*] 127.0.0.1 - Progress  95000/97170 (97.76%)
[*] 127.0.0.1 - Progress  96000/97170 (98.79%)
[*] 127.0.0.1 - Progress  97000/97170 (99.82%)
[*] 127.0.0.1 - Finished scanning plugins
[*] 127.0.0.1 - Searching Users
[*] 127.0.0.1 - Was not able to identify users on site using /wp-json/wp/v2/users
[*] 127.0.0.1 - Finished all scans
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
[+] Command "run rhosts=127.0.0.1 rport=8080" completed in 2389.363352000015 seconds
msf6 auxiliary(scanner/http/wordpress_scanner) >

In the future this could be done in parallel/made faster, but I don't think that's a blocker for this PR

[gwillcox-r7]

Thanks for checking @AlanFoster. Seeing how this might just be something on my end I'll go ahead and land this. If we have future complaints we can look into this further.

[gwillcox-r7]

Release Notes

The list of Wordpress plugins and themes has been updated to allow Metasploit tools to scan for a wider range of known themes and plugins on Wordpress targets.