Unauthenticated Arbitrary File Upload in Hash Form for WordPress

Repository contains a working PoC exploit for CVE-2024-5084 (Hash Form WordPress plugin <= 1.1.0) demonstrating unauthenticated arbitrary file upload leading to RCE. Structure: - README.md: describes the vulnerability, lab-only intent, and how to run the script. - exploit.py: main exploit implementation. - requirements.txt: Python dependencies (requests, prompt_toolkit, rich_click). Exploit flow (exploit.py): 1) GET base URL (user-supplied -u/--url) and scrape a required nonce using regex '"ajax_nounce":"(\w+)"'. 2) POST to '<base_url>/wp-admin/admin-ajax.php' with parameters including: - action=hashform_file_upload_action - file_uploader_nonce=<nonce> - allowedExtensions[0]=php - qqfile=RedTeam_shell.php The POST body is the PHP payload content. 3) If JSON response indicates success, it extracts and uses response_json['url'] as the uploaded file location. 4) Provides an interactive shell that repeatedly sends GET requests to '<uploaded_url>?cmd=<user_command>' and prints the response. Capabilities: - Unauthenticated remote file upload of a PHP webshell. - Remote command execution via the uploaded webshell. - Interactive command loop (exit/clear supported). Notable implementation details: - TLS verification is disabled (verify=False) for requests. - The script attempts to rewrite the returned file URL by replacing 'localhost' with the host from the provided base URL, to make the shell usable when the server returns localhost-based URLs.

This repository contains a single Metasploit module (modules/exploits/multi/http/wp_hash_form_rce.rb) that exploits a critical unauthenticated file upload vulnerability (CVE-2024-5084) in the Hash Form - Drag & Drop Form Builder plugin for WordPress (versions <= 1.1.0). The exploit works by first retrieving a nonce from the target WordPress site's /wp-admin/admin-ajax.php endpoint, then uploading a PHP payload using the vulnerable file upload action, and finally triggering the payload to achieve remote code execution. The module supports multiple platforms (PHP, Unix/Linux, Windows) and allows for customizable payloads, including Meterpreter shells. The exploit is weaponized, reliable, and suitable for use in penetration testing engagements targeting vulnerable WordPress installations.

This repository contains a Python exploit (hash.py) targeting CVE-2024-5084, a vulnerability in the Hash Form – Drag & Drop Form Builder WordPress plugin (<= 1.1.0). The exploit scans a list of target URLs, checks for the presence and version of the vulnerable plugin, and attempts to upload a PHP webshell via a vulnerable AJAX endpoint. If successful, the shell is accessible in the plugin's upload directory, granting remote code execution. The exploit is operational, using multi-threading for mass exploitation, and is designed for unauthenticated attacks. The only code file is hash.py, which contains all exploit logic, while README.md provides usage instructions and context.

This repository contains a working exploit for CVE-2024-5084, targeting the Hash Form – Drag & Drop Form Builder WordPress plugin (versions <= 1.1.0). The exploit is implemented in Python (exploit.py) and automates the process of exploiting an unauthenticated arbitrary file upload vulnerability. The script first retrieves a required nonce from the target WordPress site, then uploads a simple PHP webshell (<?php system($_GET["cmd"]); ?>) via the vulnerable AJAX endpoint (/wp-admin/admin-ajax.php). If successful, the script provides an interactive shell interface, allowing the attacker to execute arbitrary system commands on the compromised server through HTTP requests to the uploaded webshell. The repository also includes a requirements.txt for dependencies and a README.md with detailed usage instructions. The exploit is operational and provides a real, interactive post-exploitation capability.