Lutfifakee-Project/wp2shell

# 🔍 wp2shell - WordPress CVE-2026-63030 漏洞扫描与利用工具

⚡ 快速、实时的 CVE-2026-63030 (wp2shell) 漏洞扫描与利用工具

## 📌 概述 **wp2shell** 是一个用于检测和利用 **CVE-2026-63030** 的综合工具包，该漏洞是 WordPress 中的一个严重漏洞，允许未经身份验证的攻击者利用 REST API 批量路由混淆与 SQL 注入的组合来执行远程代码。 ### 🔍 什么是 CVE-2026-63030？ CVE-2026-63030 (wp2shell) 是由 **Adam Kues** (Assetnote / Searchlight Cyber) 发现的一个影响 WordPress 核心的严重漏洞。它结合了两个 bug： 1. **GHSA-ff9f-jf42-662q** - REST 批量路由混淆 2. **GHSA-fpp7-x2x2-2mjf** - `author__not_in` SQL 注入 ### 📊 受影响版本 | 版本范围 | 影响 | 状态 | |---------------|--------|--------| | 6.9.0 - 6.9.4 | 🔴 RCE (严重) | ❌ 存在漏洞 | | 7.0.0 - 7.0.1 | 🔴 RCE (严重) | ❌ 存在漏洞 | | 6.8.0 - 6.8.5 | 🟡 SQLi (高危) | ❌ 存在漏洞 | | 6.9.5+ / 7.0.2+ | ✅ 已修补 | ✅ 安全 | ## 📁 仓库结构 ``` wp2shell/ │ ├── 📄 wp2shell_scanner.py # 🔍 Fast multi-threaded scanner ├── 📄 wp2shell_intooutfile.py # 📂 INTO OUTFILE exploit variant │ ├── 📋 list.txt # Example target list ├── 📊 results.txt # Scan results output │ └── 📖 README.md # Documentation 🛠️ Tools Included 1️⃣ wp2shell_scanner.py - Fast Scanner Multi-threaded real-time scanner for large-scale vulnerability detection. bash # 基本扫描 python wp2shell_scanner.py -f list.txt -o results.txt # 跳过 SQLi 测试（更快） python wp2shell_scanner.py -f list.txt -o results.txt --no-sqli-test # JSON 输出 python wp2shell_scanner.py -f list.txt -j 2️⃣ wp2shell_intooutfile.py - INTO OUTFILE Exploit Demonstrates the INTO OUTFILE RCE variant (requires MySQL FILE privilege). bash # 单个目标 python3 wp2shell_intooutfile.py https://target.com # 多个目标 python3 wp2shell_intooutfile.py -f list.txt -t 10 ✨ Features

🚀 Multi-threading	Scan hundreds of targets simultaneously
📊 Real-time Output	Results appear instantly as they're discovered
🎨 Color-coded Results	Easy-to-read output with risk levels
💾 Save Vulnerable URLs	Export only vulnerable sites to a file
🔬 SQLi Detection	Optional time-based SQL injection testing
🌐 Smart Protocol Detection	Auto-adds https:// if missing
📋 Batch File Support	Scan from a list of targets
🛡️ Non-destructive	Safe scanning - no exploitation

📸 Screenshot bash ___ __ ____ _ _____ |_ |___ / / ___ / / / | |/|/ / _ \/ __/(_- , GET /wp/v2/posts ] ↓ categories → posts handler (misaligned) ↓ author_exclude unsanitized → SQL Injection Stage 3: Impact text SQL Injection → Data Exposure / Hash Extraction → Potential RCE 🔑 Hash Cracking Reference WordPress Hash Formats Format Prefix Hashcat Mode Speed phpass (old) $P$B 400 ⚡ Fast bcrypt (new) $wp$2y$10$ 2612 / 3200 🐢 Slow Cracking Commands bash # phpass（快速） hashcat -m 400 -a 0 hash.txt rockyou.txt # bcrypt（慢 - 使用 GPU） hashcat -m 2612 -a 0 hash.txt rockyou.txt # 使用 john john --format=phpass hash.txt --wordlist=rockyou.txt 📚 Example Target File (list.txt) txt https://example1.com https://example2.com example3.com # Will auto-add https:// https://example4.com ⚠️ Legal Disclaimer IMPORTANT: This tool is for educational and authorized testing purposes only. Only use on systems you own or have explicit written permission to test. Unauthorized access to computer systems is illegal. The developers assume no responsibility for misuse of this software. Use responsibly and ethically. 📚 References CVE-2026-63030 Assetnote Research WordPress Security Advisory ```

标签：DOE合作, 逆向工具