Usage

The script provides three operating modes: probe (detection), extract (retrieve data), and rce (execute commands). Here are usage examples.

Probe (check vulnerability):

Extract (get scalar values via time‑based blind SQLi):

RCE (execute remote commands — full exploit chain):

Common options

• -h, --help : Display help message
• -v, --verbose: Enable verbose output (debug)
• -c <COMMAND> : RCE mode — execute shell command on target

Brief technical summary

• The script exploits the WordPress REST API batch endpoint to inject SQL payloads that cause the SLEEP() function to be executed on the target server as a boolean condition (time‑based blind SQLi).
• Using probing and extraction techniques based on binary search over response times, the script can extract strings and integers from the database.
• The exploit chain seeds an oEmbed entry via SQL payload, finds the generated post cache, composes a malicious changeset, creates a new administrator account, and uploads a PHP plugin that is executed for RCE.

Risks & mitigation

• This script can potentially make permanent changes to the WordPress installation (e.g., account creation, plugin upload). Ensure testing is done in a controlled environment (lab) and backups are available.
• Immediately update WordPress and plugins to the latest versions, restrict REST API access if not needed, and use a web application firewall solution.

Developer notes

• The main implementation and logic are in poc_wp_tot.py.
• To understand the full flow, see the calibrate(), get_scalar(), and exploit_rce() functions in the script.

License & attribution

• This PoC is provided as-is for educational/security testing purposes.
• Original author: GhostGTR666 — github.com/gagaltotal