CVE-2021-29447-POC

CVE-2021-29447-POC 关于 此脚本可自动执行在 Wordpress 媒体上传功能中利用 CVE-2021-29447 所需步骤，并通过 XXE 提取文件。 用法 ./generatepayloads.py --help usage: generatepayloads.py -h --local-ip LOCALIP --local-port LOCALPORT --media-payload MEDIAPAYLOAD --dtd-payload DTDPAYLOAD --files-to-fetch FILESTOFETCH FILESTOFETCH...

CVE-2021-29447

安装及执行顺序 0. 运行 docker $docker-compose up 1. 运行 wordpress.sh 在安装 wordpress 之前，需要对 wp-config.php 文件进行配置。 $docker exec -it -u root wordpress /bin/bash -c "/usr/local/bin/wordpress.sh" 2. 安装 wordpress 进入容器中运行的 wordpress 网站进行安装。 请勿直接复制，请使用 code 视图进行复制。 3. 生成 WAV 文件 生成要上传到媒体服务器的 wav 文件。 $echo -en...

blind-xxe-controller-CVE-2021-29447

盲 XXE 控制器 我在完成 HackTheBox 中的 metatwo 机器时制作了这个控制器，用于利用 CVE-2021-29447，这是 WordPress 媒体库中的一个 XXE 漏洞，影响版本 5.7、5.6.2、5.6.1、5.6、5.0.11。该漏洞允许具有上传媒体库权限的已认证用户上传恶意 wav 文件，从而导致远程任意文件读取和服务器端请求伪造（SSRF）。 要利用这些漏洞，需要多个步骤才能完成一次成功的攻击。由于解析后的 iXML 元数据不会返回给用户，因此我们需要一个盲 XXE 载荷。这可以通过包含由攻击者控制的外部文档类型定义（DTD）来实现，并且我们需要创建恶意...

CVE-2021-29447

CVE-2021-29447 - WordPress XXE 漏洞利用 描述 该存储库包含一个针对 CVE-2021-29447 的 exploit，这是 WordPress 5.7.0 及更早版本中存在的一个 XXE（XML 外部实体）漏洞。该漏洞存在于处理 WAV 文件的媒体库中，允许攻击者读取服务器上的任意文件。 要求 Bash Python 3 Docker 和 Docker Compose（用于搭建测试环境） 存在漏洞的 WordPress 服务器（5.7.0 或更低版本） 文件 文件| 描述 ---|--- CVE-2021-29447.sh| 生成恶意 WAV payloa...

demo-CVE-2021-29447-lezione

POC CVE-2021029447 - WordPress中的XXE WordPress 5.6-5.7 - 认证（作者及以上）XXE CVE-2021-29447 https://vulners.com/cve/CVE-2021-29447 使用方法 步骤1：运行WordPress $ make up-wp 步骤2：运行攻击者web服务器 $ make up-mal 步骤3：生成恶意WAV文件 使用wavefile npm $ make make-wav 步骤4：登录WordPress并上传WAV文件到新媒体 open http://localhost:8000/ open...

cve-2021-29447_auto-script

CVE-2021-29447：WordPress 媒体库 XXE 漏洞 本仓库详细介绍了 CVE-2021-29447 漏洞，这是 WordPress 中一个严重的安全缺陷，允许攻击者通过媒体库进行经过身份验证的 XML 外部实体（XXE）攻击。它还提供了一个自动化脚本，用于演示概念验证（PoC）。 📌 漏洞概述 该漏洞存在于 WordPress 对上传音频文件元数据的处理中。具体如下： 根本原因：WordPress 使用 getID3 库解析 WAV 等媒体文件的元数据。WAV 文件可以包含一个名为 iXML 的 XML 数据块。攻击者可以构造一个包含恶意 XML 内容的 WAV...

CVE-2021-29447

WordPress 5.6-5.7 - 已认证（作者及以上）XXE CVE-2021-29447 使用 步骤1：运行WordPress $ make up-wp 步骤2：运行攻击者Web服务器 $ make up-mal 步骤3：生成恶意WAV文件 不使用wavefile npm（推荐） $ echo -en 'RIFF\xb8\x00\x00\x00WAVEiXML\x7b\x00\x00\x00%remote;%init;%trick; \x00' malicious.wav 使用wavefile npm $ make make-wav...

Project-Project-Chimera-Exploiting-a-Modern-WordPress-XXE-to-Pillage-Secrets-

项目目标：演示针对易受攻击的WordPress安装的完整攻击链，利用CVE-2021-29447（媒体库中的XXE）实现远程代码执行并完全攻陷系统。 阶段1：侦察与信息收集 使用Nmap进行网络扫描： bash 快速SYN扫描发现开放端口 nmap -sS -T4 10.201.3.95 详细的版本和脚本扫描 nmap -sV -sC -p22,80,3306 10.201.3.95 -oA initialscan 结果： text PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.2p2 Ubuntu 80/tcp open ht...

CVE-2021-29447

WAV iXML XXE エクスプロイトジェネレータ 不正なWAVファイルを生成し、iXMLメタデータチャンクを解析するWordPressプラグイン（例：BookingPress │ Target │ └──────────┘ └──────────┘ ▲ │ │ │ 2. Parse XML │ │ │ 3. GET /xxe.dtd │ │─────────────────────────────┘ │ │ 4. GET /?p=base64data │─────────────────────────────┐ │ │ └─ Decode and read file │...

CVE-2021-29447

CVE-2021-29447 Impacto Divulgación arbitraria de archivos: el contenido de cualquier archivo en el sistema de archivos del host podría recuperarse, por ejemplo, wp-config.php que contiene datos sensibles como credenciales de base de datos. Falsificación de solicitudes del lado del servidor SSRF: ...

Ubuntu 14.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : GStreamer Bad Plugins vulnerability (USN-8855-1)

The remote Ubuntu 14.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8855-1 advisory. It was discovered that GStreamer Bad Plugins incorrectly validated the size of multi-channel audio...

AlmaLinux 9.2 [TuxCare] Security Update: libsndfile / libsndfile-devel / libsndfile-utils (ALMALINUX9.2:CLSA-2026:1780592196)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1780592196 advisory. - An issue was discovered in libsndfile 1.2.2 IMA ADPCM codec. The AIFF code path line 241 was fixed with sfcountt cast, but the WAV code pat...

Rocky Linux 9.6 [TuxCare] Security Update: libsndfile / libsndfile-devel / libsndfile-utils (ALMALINUX9.6:CLSA-2026:1780515309)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1780515309 advisory. - An issue was discovered in libsndfile 1.2.2 IMA ADPCM codec. The AIFF code path line 241 was fixed with sfcountt cast, but the WAV code...

Rocky Linux 9 [CIQ] Security Update: speex / speex-debuginfo / speex-debugsource / speex-devel (crlsa-2022_7979)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20227979 advisory. speex: divide by zero in readsamples via crafted WAV file CVE-2020-23903 Tenable has extracted the preceding description block directly from the CIQ security...

Rocky Linux 8 [CIQ] Security Update: libsndfile / libsndfile-debuginfo / libsndfile-debugsource / etc (crlsa-2021_3253)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20213253 advisory. libsndfile: Heap buffer overflow via crafted WAV file allows arbitrary code execution CVE-2021-3246 Tenable has extracted the preceding description block directly...

AlmaLinux 9.6 [TuxCare] Security Update: libsndfile / libsndfile-devel / libsndfile-utils (ALMALINUX9.6:CLSA-2026:1780515309)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1780515309 advisory. - An issue was discovered in libsndfile 1.2.2 IMA ADPCM codec. The AIFF code path line 241 was fixed with sfcountt cast, but the WAV code pat...

CentOS Linux 7 [TuxCare] Security Update: taglib / taglib-devel / taglib-doc (CENTOS7:CLSA-2026:1778161748)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1778161748 advisory. - TagLib before 2.0 allows a segmentation violation and application crash during tag writing via a crafted WAV file in which an id3 chunk is the...

AlmaLinux 9.2 [TuxCare] Security Update: taglib / taglib-devel (ALMALINUX9.2:CLSA-2025:1754552791)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1754552791 advisory. - TagLib before 2.0 allows a segmentation violation and application crash during tag writing via a crafted WAV file in which an id3 chunk is...

Rocky Linux 9.6 [TuxCare] Security Update: taglib / taglib-devel (ALMALINUX9.6:CLSA-2026:1777540469)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1777540469 advisory. - TagLib before 2.0 allows a segmentation violation and application crash during tag writing via a crafted WAV file in which an id3 chunk i...

AlmaLinux 9.6 [TuxCare] Security Update: taglib / taglib-devel (ALMALINUX9.6:CLSA-2026:1777540469)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1777540469 advisory. - TagLib before 2.0 allows a segmentation violation and application crash during tag writing via a crafted WAV file in which an id3 chunk is...