CVE-2025-34085 Multi-Target RCE Scanner

Mass-exploitation scanner for CVE-2025-34085 — an unauthenticated remote code execution vulnerability in the WordPress Simple File List plugin.

This tool uploads a PHP payload disguised as an image, renames it via a vulnerable file engine, and triggers shell execution with a custom command. Supports multithreaded scanning across large target sets.

🔥 Features

• Multi-target scanning (from targets.txt)
• Auto-upload & rename of malicious payload
• Webshell trigger with customizable command
• Threaded execution for speed
• Logs successful RCEs to vuln.txt

⚙️ Usage

python3 CVE-2025-34085.py

Targets should be listed in targets.txt:

example.com
http://target2.com
https://target3.com

🛠️ Configuration

Edit the following values in the script as needed:

COMMAND = "id"                      # Shell command to execute
EXPECTED_SUBSTRING = "uid="        # String to verify successful command execution
THREADS = 20                        # Number of concurrent threads

💡 How It Works

1. Uploads a fake .png file containing via the vulnerable ee-upload-engine.php.

2. Renames it to .php, .phtml, etc. using ee-file-engine.php.

3. Sends a GET request to trigger the shell with cmd=id.

4. Verifies success based on expected output substring.

📂 Output

Successful hits are saved to:

vuln.txt

Each line includes the vulnerable URL, shell path, and command output.

🧪 Tested Against

WordPress Simple File List Plugin (unpatched versions affected by CVE-2025-34085)

Apache/Nginx default setups with writable wp-content/uploads/

⚠️ Disclaimer

This tool is for educational and authorized testing only. Use at your own risk. Unauthorized access to systems is illegal.