Exploit for CVE-2014-0195# XML-RPC WordPress Brute-Force Exploit Script
This repository contains a Python-based proof of concept (PoC) for brute-forcing login credentials on WordPress instances vulnerable to CVE-2014-0195, where the XML-RPC `system.multicall` function can be exploited to attempt multiple login requests in a single HTTP request, potentially resulting in a denial of service. This script is intended for cybersecurity professionals to evaluate the security posture of WordPress installations.
## Disclaimer
> This code is strictly for ethical use on authorized systems. Unauthorized use of this code is illegal and may lead to severe consequences. Always obtain explicit permission before testing or exploiting systems you do not own.
## Vulnerability Overview
The vulnerability lies in WordPress's XML-RPC API, specifically within the `system.multicall` method. This method allows for batching multiple requests, which is exploited here to submit multiple login attempts within a single request. This feature allows for faster brute-force attempts and bypasses typical rate-limiting protections.
More details can be found in the [Broadcom Security Advisory](https://www.broadcom.com/support/security-center/attacksignatures/detail?asid=31137).
## Prerequisites
- **Python 3**
- **Requests library**: Install via `$ pip install -r requirements.txt` or `$ pip install requests`.
- **Seclists**: This script uses the `rockyou-75.txt` password file from Seclists. Ensure it’s installed at `/usr/share/seclists/Passwords/Leaked-Databases/rockyou-75.txt` or change the path accordingly.
## How It Works
The script performs the following steps:
1. **Initialize and Load Passwords**: Loads a list of passwords from the specified file.
2. **Payload Generation**: Generates XML-RPC payloads containing up to 200 login attempts each, using the `system.multicall` method.
3. **Multithreaded Request Sending**: Launches threads to send each payload to the target URL and monitors responses for successful logins.
Log in to view the POC file snapshot cached by Shenlong Bot
Log in to view