CVE-2016-10033 PoC — PHPMailer 安全漏洞

Description

Code and vulnerable WordPress container for exploiting CVE-2016-10033

介绍

# CVE2016-10033 explotation PoC

This repository holds the necessary files to exploit CVE2016-10033 on a vulnerable version of WordPress.

With these instructions you will be able to get a reverse interactive shell (not Pseudo-TTY) in the container that is running the WordPress as the user that is running the Apache server.

This exploit does not require any type of authentication or plugin. Just plain WordPress code + Exim4 MTA to send emails from WordPress (installed in most servers).

 * [Full advisory CVE2016-10033](https://exploitbox.io/vuln/WordPress-Exploit-4-6-RCE-CODE-EXEC-CVE-2016-10033.html)

## Requirements
  * Linux based operative system
  * Docker
  * docker-compose

## How-to
  1. Deploy docker-compose
  2. Enter your WordPress site and follow the installation wizard using `admin` as username
  2. Execute the exploit script

## Attributions

 * Dawid Golunski (@dawid_golunski) at [LegalHackers](https:/legalhackers.com) for the discovery and first version of PoC exploit

文件快照

备注