python3 exploit.py <目标>
CVE-2025-3515 是 WordPress 插件 "Drag and Drop Multiple File Upload for Contact Form 7" 中的一个文件上传漏洞，允许未认证的攻击者上传恶意文件并实现远程代码执行。
/inc/dnd-upload-cf7.phpdnd_upload_cf7_upload() (第856行)黑名单中缺失的扩展名：.phar、.php5、.inc
// 第107-108行 - 潜在的路径遍历
if ( $handle = fopen( $htaccess_file, 'w' ) ) {
fwrite( $handle, "Options -Indexes \n <Files *.php> \n deny from all \n </Files>" );
// 第523-524行 - 未经验证的日志写入
$file = fopen( $uploads_dir['upload_dir']."/logs.txt", "a");
fwrite( $file, "\n". ( is_array( $message ) ? print_r( $message, true ) : $message ) );
# 搜索可疑上传文件
find /wp-content/uploads/ -name "*.phar" -o -name "*.php5" -o -name "*.inc"
# 检查Web后门
grep -r "system\|exec\|shell_exec" /wp-content/uploads/
# Apache/Nginx访问日志
grep "admin-ajax.php" /var/log/apache2/access.log | grep "dnd_codedropz_upload"
# WordPres调试日志
grep "dnd_upload_cf7_upload" /wp-content/debug.log