XML-RPC WordPress Brute-Force Exploit Script

This repository contains a Python-based proof of concept (PoC) for brute-forcing login credentials on WordPress instances vulnerable to CVE-2014-0195, where the XML-RPC system.multicall function can be exploited to attempt multiple login requests in a single HTTP request, potentially resulting in a denial of service. This script is intended for cybersecurity professionals to evaluate the security posture of WordPress installations.

Disclaimer

This code is strictly for ethical use on authorized systems. Unauthorized use of this code is illegal and may lead to severe consequences. Always obtain explicit permission before testing or exploiting systems you do not own.

Vulnerability Overview

The vulnerability lies in WordPress's XML-RPC API, specifically within the system.multicall method. This method allows for batching multiple requests, which is exploited here to submit multiple login attempts within a single request. This feature allows for faster brute-force attempts and bypasses typical rate-limiting protections.

More details can be found in the Broadcom Security Advisory.

Prerequisites

• Python 3
• Requests library: Install via $ pip install -r requirements.txt or $ pip install requests.
• Seclists: This script uses the rockyou-75.txt password file from Seclists. Ensure it’s installed at /usr/share/seclists/Passwords/Leaked-Databases/rockyou-75.txt or change the path accordingly.

How It Works

The script performs the following steps:

1. Initialize and Load Passwords: Loads a list of passwords from the specified file.
2. Payload Generation: Generates XML-RPC payloads containing up to 200 login attempts each, using the system.multicall method.
3. Multithreaded Request Sending: Launches threads to send each payload to the target URL and monitors responses for successful logins.