Skip to content
KitploitKITPLOIT
ๅทฅๅ…ทๅšๅฎข
ๆไบค
ๅทฅๅ…ทๅšๅฎข
ๆไบค

้ป‘ๅฎขใ€ๆธ—้€ๆต‹่ฏ•ๅ’Œ็ฝ‘็ปœๅฎ‰ๅ…จๅทฅๅ…ท๏ผŒๆญฆ่ฃ…ๆ‚จ็š„ๅฎ‰ๅ…จๆญฆๅ™จๅบ“๏ผ

Kitploit ๆ˜ฏไธ€ไธช้ป‘ๅฎขใ€็ฝ‘็ปœๅฎ‰ๅ…จๅ’Œๆธ—้€ๆต‹่ฏ•ๅทฅๅ…ท็š„็›ฎๅฝ•ใ€‚ๅ‘็Žฐๆœ€ๆ–ฐ็š„้กน็›ฎๆ›ดๆ–ฐ๏ผŒๆŸฅๆ‰พๆผๆดžใ€ๅˆ†ๆž็ณป็ปŸใ€่‡ชๅŠจๅŒ–ๆต‹่ฏ•ๅนถๅŠ ๅผบไฝ ็š„ๅฎ‰ๅ…จใ€‚

ยทยท่ฎข้˜…ๆบยท่”็ณปยท้š็งยทยฉ 2026 Kitploit

ๅทฅๅ…ท็›ฎๅฝ•

ๅˆ†็ฑป

ๆŸฅ็œ‹ๆ‰€ๆœ‰ๅˆ†็ฑป
Loading categories
ๅทฅๅ…ท/GitHubGitHub/h0w1tzxr/tryhack3m-bricks-heist
OSINT (ๅผ€ๆบๆƒ…ๆŠฅ)ไพฆๅฏŸๆผๆดžๅˆ†ๆžๆผๆดžๅˆฉ็”จWebๅบ”็”จ็จ‹ๅบๆผๆดžๅˆฉ็”จๅ–่ฏๅˆ†ๆžCTFๆธ—้€ๆต‹่ฏ•ๅญฆไน ไธŽๆ•™่‚ฒ
GitHubh0w1tzxr/tryhack3m-bricks-heist

TryHack3M-Bricks-Heist

๐Ÿงฑ CVE-2024-25600 WordPress Bricks Builder RCE ๆผๆดžๅˆฉ็”จ + TryHackMe Bricks Heist CTF ่งฃ้ข˜ๆŠฅๅ‘Š

ๆŸฅ็œ‹ไป“ๅบ“
158ไธชๆœˆๅ‰ๅฐšๆœชๅฎกๆ ธ

ๆœ€ๅ—ๆฌข่ฟŽ

ๆŸฅ็œ‹ๅ…จ้ƒจ โ†’

ๅ‘็Žฐๆˆ‘ไปฌ็คพๅŒบๆœ€ๅธธ็”จ็š„ๅทฅๅ…ทใ€‚

ๆŽข็ดขๆ‰€ๆœ‰ๅทฅๅ…ท

ๆต่งˆๆˆ‘ไปฌ็š„ๅทฅๅ…ท้›†ๅˆ

ๆŸฅ็œ‹ๆ‰€ๆœ‰ๅทฅๅ…ท โ†’
ๅˆ†ไบซ

TryHack3M: Bricks Heist

TryHackMe CVE Python License


ๆผๆดžๅˆฉ็”จ โ€ข ่งฃ้ข˜ๆŠฅๅ‘Š โ€ข CTF ๆŒ‘ๆˆ˜

ไธ€ไธชๅŒ…ๅซ่‡ชๅฎšไน‰ๆผๆดžๅˆฉ็”จ่„šๆœฌๅŠ่ฏฆ็ป†่งฃ้ข˜ๆŠฅๅ‘Š็š„็ปผๅˆไป“ๅบ“๏ผŒ้’ˆๅฏน TryHack3M: Bricks Heist ๆŒ‘ๆˆ˜


ๅฟซ้€Ÿๅผ€ๅง‹ โ€ข ไป“ๅบ“็ป“ๆž„ โ€ข ๆผๆดžๅˆฉ็”จ โ€ข ่งฃ้ข˜ๆŠฅๅ‘Š โ€ข ๅ…่ดฃๅฃฐๆ˜Ž


WordPress Bricks CVSS

ๆฆ‚่ฟฐ

ๆœฌไป“ๅบ“่ฎฐๅฝ•ไบ† TryHack3M: Bricks Heist ๆŒ‘ๆˆ˜โ€”โ€”ไธ€ไธชไธญ็ญ‰้šพๅบฆ็š„ CTF ๆˆฟ้—ด๏ผŒๆถ‰ๅŠ๏ผš

้˜ถๆฎตๆ่ฟฐ

ไป“ๅบ“็ป“ๆž„

root@kitploit:~
TryHack3M-Bricks-Heist/
โ”‚
โ”œโ”€โ”€ README.md              โ† You are here
โ”‚
โ”œโ”€โ”€ Exploit/
โ”‚   โ”œโ”€โ”€ README.md          โ† Detailed exploit documentation
โ”‚   โ”œโ”€โ”€ brickbreaker.py    โ† The exploit tool
โ”‚   โ””โ”€โ”€ requirements.txt   โ† Python dependencies
โ”‚
โ””โ”€โ”€ WriteUp/
    โ””โ”€โ”€ WRITEUP.md         โ† Full challenge walkthrough
็›ฎๅฝ•ๅ†…ๅฎน้“พๆŽฅ
Exploit/BrickBreaker v2.2 โ€” ่‡ชๅฎšไน‰ CVE-2024-25600 ๆผๆดžๅˆฉ็”จๅทฅๅ…ท๏ผŒๆ”ฏๆŒไบคไบ’ๅผ Shellไบ†่งฃๆ›ดๅคš

ๅฟซ้€Ÿๅผ€ๅง‹

30 ็ง’ๅ†…่Žทๅพ— Shell

root@kitploit:~
# Clone the repository
git clone https://github.com/h0w1tzxr/TryHack3M-Bricks-Heist.git
cd TryHack3M-Bricks-Heist/Exploit

# Set up environment
python3 -m venv brickbreaker && source brickbreaker/bin/activate
pip install -r requirements.txt

# Launch exploit
python3 brickbreaker.py https://target.com

้˜…่ฏปๅฎŒๆ•ด่งฃ้ข˜ๆŠฅๅ‘Š

็›ดๆŽฅ่ทณ่ฝฌๅˆฐๅฎŒๆ•ด่งฃ้ข˜ๆŠฅๅ‘Š๏ผŒๆŸฅ็œ‹่ฏฅๆŒ‘ๆˆ˜ไปŽๅคดๅˆฐๅฐพ็š„ๅฎŒๆ•ด่งฃ้ข˜่ฟ‡็จ‹ใ€‚


ๆผๆดžๅˆฉ็”จ

BrickBreaker v2.2

้’ˆๅฏน WordPress Bricks Builder ็š„ๆœช่ฎค่ฏ่ฟœ็จ‹ไปฃ็ ๆ‰ง่กŒ

root@kitploit:~
 โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•— โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•— โ–ˆโ–ˆโ•— โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•—โ–ˆโ–ˆโ•—  โ–ˆโ–ˆโ•—    โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•— โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•— โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•— โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•— โ–ˆโ–ˆโ•—  โ–ˆโ–ˆโ•—โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•—โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•— 
 โ–ˆโ–ˆโ•”โ•โ•โ–ˆโ–ˆโ•—โ–ˆโ–ˆโ•”โ•โ•โ–ˆโ–ˆโ•—โ–ˆโ–ˆโ•‘โ–ˆโ–ˆโ•”โ•โ•โ•โ•โ•โ–ˆโ–ˆโ•‘ โ–ˆโ–ˆโ•”โ•    โ–ˆโ–ˆโ•”โ•โ•โ–ˆโ–ˆโ•—โ–ˆโ–ˆโ•”โ•โ•โ–ˆโ–ˆโ•—โ–ˆโ–ˆโ•”โ•โ•โ•โ•โ•โ–ˆโ–ˆโ•”โ•โ•โ–ˆโ–ˆโ•—โ–ˆโ–ˆโ•‘ โ–ˆโ–ˆโ•”โ•โ–ˆโ–ˆโ•”โ•โ•โ•โ•โ•โ–ˆโ–ˆโ•”โ•โ•โ–ˆโ–ˆโ•—
 โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•”โ•โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•”โ•โ–ˆโ–ˆโ•‘โ–ˆโ–ˆโ•‘     โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•”โ•     โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•”โ•โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•”โ•โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•—  โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•‘โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•”โ• โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•—  โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•”โ•
 โ–ˆโ–ˆโ•”โ•โ•โ–ˆโ–ˆโ•—โ–ˆโ–ˆโ•”โ•โ•โ–ˆโ–ˆโ•—โ–ˆโ–ˆโ•‘โ–ˆโ–ˆโ•‘     โ–ˆโ–ˆโ•”โ•โ–ˆโ–ˆโ•—     โ–ˆโ–ˆโ•”โ•โ•โ–ˆโ–ˆโ•—โ–ˆโ–ˆโ•”โ•โ•โ–ˆโ–ˆโ•—โ–ˆโ–ˆโ•”โ•โ•โ•  โ–ˆโ–ˆโ•”โ•โ•โ–ˆโ–ˆโ•‘โ–ˆโ–ˆโ•”โ•โ–ˆโ–ˆโ•— โ–ˆโ–ˆโ•”โ•โ•โ•  โ–ˆโ–ˆโ•”โ•โ•โ–ˆโ–ˆโ•—
 โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•”โ•โ–ˆโ–ˆโ•‘  โ–ˆโ–ˆโ•‘โ–ˆโ–ˆโ•‘โ•šโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•—โ–ˆโ–ˆโ•‘  โ–ˆโ–ˆโ•—    โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•”โ•โ–ˆโ–ˆโ•‘  โ–ˆโ–ˆโ•‘โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•—โ–ˆโ–ˆโ•‘  โ–ˆโ–ˆโ•‘โ–ˆโ–ˆโ•‘  โ–ˆโ–ˆโ•—โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ•—โ–ˆโ–ˆโ•‘  โ–ˆโ–ˆโ•‘
 โ•šโ•โ•โ•โ•โ•โ• โ•šโ•โ•  โ•šโ•โ•โ•šโ•โ• โ•šโ•โ•โ•โ•โ•โ•โ•šโ•โ•  โ•šโ•โ•    โ•šโ•โ•โ•โ•โ•โ• โ•šโ•โ•  โ•šโ•โ•โ•šโ•โ•โ•โ•โ•โ•โ•โ•šโ•โ•  โ•šโ•โ•โ•šโ•โ•  โ•šโ•โ•โ•šโ•โ•โ•โ•โ•โ•โ•โ•šโ•โ•  โ•šโ•โ•

ๅฎŒๆ•ดๆผๆดžๅˆฉ็”จๆ–‡ๆกฃ โ†’


่งฃ้ข˜ๆŠฅๅ‘Š

TryHack3M: Bricks Heist โ€” ๅฎŒๆ•ดๆผ”็ปƒ

ไปŽๆผๆดžๅˆฉ็”จๅˆฐๅจ่ƒ่กŒไธบ่€…ๅฝ’ๅ› 

ๆœฌ่งฃ้ข˜ๆŠฅๅ‘Šๆถต็›–ๅฎŒๆ•ด็š„ๆ”ปๅ‡ป้“พไธŽ่ฐƒๆŸฅ่ฟ‡็จ‹๏ผš

ๆŒ‘ๆˆ˜็ญ”ๆกˆ้ข„่งˆ

้˜…่ฏปๅฎŒๆ•ด่งฃ้ข˜ๆŠฅๅ‘Š โ†’


ๅทฅๅ…ทไธŽๆŠ€ๆœฏ

ๅทฅๅ…ท็”จ้€”
Python

ๅ…่ดฃๅฃฐๆ˜Ž

root@kitploit:~
โ•”โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•—
โ•‘                                  WARNING                                     โ•‘
โ• โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•ฃ
โ•‘                                                                              โ•‘
โ•‘  This repository is for EDUCATIONAL and AUTHORIZED SECURITY TESTING only.    โ•‘
โ•‘                                                                              โ•‘
โ•‘  โ€ข Only use on systems you OWN or have EXPLICIT WRITTEN PERMISSION to test   โ•‘
โ•‘  โ€ข Unauthorized access to computer systems is ILLEGAL                        โ•‘
โ•‘  โ€ข The authors are NOT responsible for any misuse or damage caused           โ•‘
โ•‘  โ€ข Always follow RESPONSIBLE DISCLOSURE practices                            โ•‘
โ•‘                                                                              โ•‘
โ•šโ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•โ•

ๅ‚่€ƒ่ต„ๆ–™


่‡ด่ฐข


ๅฆ‚ๆžœไฝ ่ง‰ๅพ—่ฟ™ไธชไป“ๅบ“ๆœ‰็”จ๏ผŒ่ฏทไธบๅฎƒ็‚นไธช Star


Stars Forks Watchers


็”ฑ constantines ๅˆ›ๅปบ

้ป‘ๅฎขๆ„‰ๅฟซ๏ผ

ไธ‹่ฝฝๅทฅๅ…ท
ไพฆๅฏŸ
ๅ‘็Žฐไธ€ไธชไฝฟ็”จ Bricks Builder ็š„ๆ˜“ๅ—ๆ”ปๅ‡ป WordPress ็ซ™็‚น
ๅˆฉ็”จๅˆฉ็”จ CVE-2024-25600 ๅฎž็Žฐๆœช่ฎค่ฏ RCE
่ฐƒๆŸฅๆญ้œฒไธŽ LockBit ๅ‹’็ดข่ฝฏไปถ็›ธๅ…ณ่”็š„้š่—ๅŠ ๅฏ†่ดงๅธๆŒ–็Ÿฟ็จ‹ๅบ
ๅฝ’ๅ› ่ฟฝ่ธชๆฏ”็‰นๅธไบคๆ˜“่‡ณๅ—ๅˆถ่ฃ็š„ๅจ่ƒ่กŒไธบ่€…
WriteUp/ๅฎŒๆ•ด็š„้€ๆญฅๆผ”็ปƒ๏ผŒๅŒ…ๅซๆˆชๅ›พไธŽ็ญ”ๆกˆไบ†่งฃๆ›ดๅคš
ๅŠŸ่ƒฝๆ่ฟฐ
่‡ชๅŠจๅˆฉ็”จ่‡ชๅŠจๆๅ– nonce ๅนถๅฎŒๆˆๆผๆดžๅˆฉ็”จ
ไบคไบ’ๅผ ShellๅฎŒๆ•ด็š„็ฑป PTY ไฝ“้ชŒ๏ผŒๆ”ฏๆŒๅކๅฒ่ฎฐๅฝ•
ๆ–‡ไปถไผ ่พ“้€š่ฟ‡ base64 ไธŠไผ /ไธ‹่ฝฝๆ–‡ไปถ
ๅๅผน Shell5 ็ง่ฝฝ่ท็ฑปๅž‹๏ผˆbashใ€pythonใ€ncใ€phpใ€perl๏ผ‰
ๆ‰น้‡ๆ‰ซๆๅคง่ง„ๆจกๆผๆดžๆ‰ซๆ
็ฒพ็พŽ TUIๅŠŸ่ƒฝไธฐๅฏŒ็š„็ปˆ็ซฏ็•Œ้ข
้˜ถๆฎตไฝ ๅฐ†ๅญฆๅˆฐไป€ไนˆ
ไพฆๅฏŸ็ซฏๅฃๆ‰ซๆใ€WordPress ๆžšไธพใ€่ฏ†ๅˆซ Bricks Builder
ๅˆฉ็”จไฝฟ็”จ BrickBreaker ้€š่ฟ‡ CVE-2024-25600 ่Žทๅ–ๅˆๅง‹่ฎฟ้—ฎๆƒ้™
ๅ–่ฏๅ‘็Žฐ้š่—ๆ–‡ไปถใ€ๆถๆ„ๆœๅŠกไธŽๅŠ ๅฏ†่ดงๅธๆŒ–็Ÿฟ็จ‹ๅบ
ๅŒบๅ—้“พ่งฃ็ ๆททๆท†็š„้’ฑๅŒ…ๅœฐๅ€ๅนถ่ฟฝ่ธชไบคๆ˜“
ๅฝ’ๅ› ้€š่ฟ‡ OFAC ๅฐ†็›ธๅ…ณๆดปๅŠจไธŽ LockBit ๅ‹’็ดข่ฝฏไปถ็ป„็ป‡ๅ…ณ่”่ตทๆฅ
#้—ฎ้ข˜ๆ็คบ
1้š่—็š„ .txt ๆ–‡ไปถๅ†…ๅฎนTHM{...}
2ๅฏ็–‘่ฟ›็จ‹ๅ็งฐnm-****-******
3ๆœๅŠกๅ็งฐ******.service
4ๆŒ–็Ÿฟ็จ‹ๅบๆ—ฅๅฟ—ๆ–‡ไปถ****.****
5้’ฑๅŒ…ๅœฐๅ€bc1q...
6ๅจ่ƒ็ป„็ป‡7 ไธชๅญ—็ฌฆ
ๆผๆดžๅˆฉ็”จๅผ€ๅ‘
RustScan็ซฏๅฃๆ‰ซๆ
CyberChefๆ•ฐๆฎ่งฃ็ 
Blockchainไบคๆ˜“่ฟฝ่ธช
่ต„ๆบ้“พๆŽฅ
CVE-2024-25600๏ผˆNVD๏ผ‰nvd.nist.gov
ๅŽŸๅง‹ๆŠซ้œฒSnicco Security
OFAC ๅˆถ่ฃTreasury.gov
LockBit ๅ…ฌๅ‘ŠCISA
TryHackMe ๆˆฟ้—ดTryHackMe
่ง’่‰ฒ็ฝฒๅ
ไฝœ่€…constantines
ๆผๆดžๅ‘็ŽฐSnicco Security
ๅŽŸๅง‹ PoCChocapikk
ๆŒ‘ๆˆ˜TryHackMe