whyuhurtz/wongpress

GitHubRepository PoCWriteup

PoC files

18 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a technical writeup describing a real-case exploitation chain combining CVE-2024-2961 (glibc buffer overflow) and CVE-2024-29510 (Ghostscript format string) to achieve RCE on an Ubuntu server. It provides step-by-step instructions for generating and delivering a Metasploit exploit, but the repository itself contains only documentation and no executable exploit or scanner code.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of two markdown files: a README placeholder and an exploit guide for CVE-2024-29510. The guide instructs the user to generate a Metasploit payload and upload it to a WordPress endpoint. No backdoor, deceptive payload, or concealed operator-directed harm is present in the reviewed text. The instructions describe a standard exploit workflow against a stated target, which is not backdoor behavior.

ClassificationWriteup
Model confidence95%
AuthenticationUnknown
Languagesmarkdown
Target softwareGhostscriptglibcUbuntu Server
Attack typesremote code executionformat stringbuffer overflow
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is classified as a writeup because it provides a substantive technical analysis and step-by-step instructions for exploiting CVE-2024-29510, but does not contain any executable exploit or scanner code within the repository itself. The files are Markdown documentation describing how to use external tools (Metasploit) to perform the attack.

README.md:1-28exploit/cve-2024-29510.md:1-47

Requirements

  • Metasploit Framework is required to generate the exploit PostScript file.exploit/cve-2024-29510.md:5
  • A target server running a WordPress plugin that converts PostScript to images via Ghostscript is implied.exploit/cve-2024-29510.md:43-46

Observed behavior

  • The writeup instructs the user to generate a malicious PostScript file using a Metasploit module.exploit/cve-2024-29510.md:9-24
  • The writeup instructs the user to start a Metasploit handler to receive a reverse shell.exploit/cve-2024-29510.md:28-38
  • The writeup instructs the user to upload the generated PostScript file to a target WordPress endpoint via curl.exploit/cve-2024-29510.md:42-46
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Ip Address
10.85.104.40Attacker-controlled LHOST and FETCH_SRVHOST used in Metasploit payload generation and listener setup.exploit/cve-2024-29510.md:13exploit/cve-2024-29510.md:17exploit/cve-2024-29510.md:32exploit/cve-2024-29510.md:34
Ip Address
10.85.104.208Target WordPress server address used in the curl upload command.exploit/cve-2024-29510.md:43
Url
http://10.85.104.208/wp-admin/admin-ajax.phpWordPress AJAX endpoint targeted for uploading the malicious PostScript file.exploit/cve-2024-29510.md:43
Filename
sh3llName of the fetched payload file written to /tmp on the target.exploit/cve-2024-29510.md:19
Review boundaries

What the analysis did not establish

  • Only 2 of 18 text files were included in the evidence packet; the remaining 16 files (109,417 bytes) were omitted and not analyzed.
  • The evidence packet reports complete_artifact_coverage as false, meaning the full repository content was not provided.
  • The README.md file contains placeholder text ('*soon*') for most sections, indicating the writeup is incomplete.
  • Only 2 of 18 text files in the repository were included in the evidence; the remaining 16 files were omitted and their contents are unknown.
  • No binary files were identified, but any non-text content in the repository would not have been analyzed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

2
GitHub

docker-compose.local.yml

Created Vuln labCVE-2023-26326CVE-2024-29510CVE-2024-2961Compose · mixed

1 Compose manifest · 1 Dockerfile · 3 services

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment for local testing of a vulnerable WordPress lab. It deploys MySQL, a custom WordPress image with vulnerable glibc and Ghostscript, and an Nginx reverse proxy. The lab is designed to exercise CVE-2024-2961 (glibc iconv buffer overflow) and CVE-2024-29510 (Ghostscript format string).

docker-compose.local.yml:1-5wordpress/Dockerfile.local:1-7

Lab assessment

Vulnerability lab

The Compose file header explicitly states it is a 'Vulnerable WordPress Lab Environment (FOR LOCAL TESTING)' targeting CVE-2024-2961 and CVE-2024-29510. The Dockerfile installs specific vulnerable versions (glibc 2.35, Ghostscript 10.02.1) and a vulnerable WordPress plugin (BuddyForms 2.7.6). An exploit script for CVE-2024-2961 is included.

docker-compose.local.yml:1-5wordpress/Dockerfile.local:1-7wordpress/Dockerfile.local:30-38wordpress/Dockerfile.local:56-58exploit/cve=2024-2961.py:1-4
Lab shapeCompose · mixed
Services3
Compose manifests1
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

mysql

database

MySQL 8.0 database service for WordPress. Configured with healthcheck, persistent volume, and environment variables for credentials.

docker-compose.local.yml:8-30

wordpress

vulnerable web applicationPHP-FPM backend

Custom WordPress image built from Ubuntu 22.04 with vulnerable glibc 2.35, Ghostscript 10.02.1, BuddyForms 2.7.6 plugin, and a custom mu-plugin for Ghostscript-based file conversion. Runs with SYS_ADMIN, SYS_PTRACE capabilities and AppArmor unconfined for local testing. Entrypoint script initializes WordPress, configures plugins, and creates pages for exploitation.

docker-compose.local.yml:32-67wordpress/Dockerfile.local:1-150wordpress/entrypoint.local.sh:1-392

nginx

reverse proxystatic file server

Nginx 1.29.8-alpine reverse proxy serving WordPress on port 80. Mounts configuration files and shares WordPress files for static assets.

docker-compose.local.yml:69-90nginx/nginx.conf:1-35nginx/conf.d/wordpress.local.conf:1-84

gs-convert-file.php

AJAX handler for Ghostscript conversionCVE-2024-29510 trigger

WordPress mu-plugin that handles AJAX file uploads (PS/EPS/PDF) and converts them to images using Ghostscript via exec(). The comment explicitly states it triggers CVE-2024-29510.

wordpress/mu-plugins/gs-convert-file.php:1-64

cve=2024-2961.py

exploit script for CVE-2024-2961

Python exploit script (CNEXT) that achieves RCE via PHP file read primitive using CVE-2024-2961. It targets the BuddyForms AJAX handler and uses filter chains to corrupt PHP's heap.

exploit/cve=2024-2961.py:1-576

setup.sh

deployment automation

Bash script to automate deployment of the lab locally or in production. Checks OS, installs Docker, generates .env and nginx config, and starts containers.

setup.sh:1-756
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2023-26326

Insufficient evidence

CVE-2023-26326 is mentioned in the Compose file header and README, but no vulnerable component or exploit for BuddyForms unauth deserialization is visible in the provided evidence. The BuddyForms plugin is installed, but no specific deserialization vulnerability is configured or demonstrated.

docker-compose.local.yml:4README.md:1-28

CVE-2024-29510

Supported by supplied evidence

The Dockerfile installs Ghostscript 10.02.1, a version known to be vulnerable to CVE-2024-29510. The mu-plugin gs-convert-file.php explicitly states it triggers this CVE and uses exec() to call Ghostscript with -dSAFER, which the format string vulnerability can bypass. The ImageMagick policy is modified to allow PS/EPS/PDF processing.

wordpress/Dockerfile.local:1-7wordpress/Dockerfile.local:88-108wordpress/mu-plugins/gs-convert-file.php:1-64

CVE-2024-2961

Supported by supplied evidence

The Dockerfile installs glibc 2.35-0ubuntu3, the vulnerable version for CVE-2024-2961. The exploit script cve=2024-2961.py is provided and targets the lab's BuddyForms AJAX handler. The entrypoint script configures the BuddyForms page and the exploit's Remote class matches the lab's endpoint.

wordpress/Dockerfile.local:30-38exploit/cve=2024-2961.py:1-4exploit/cve=2024-2961.py:40-50wordpress/entrypoint.local.sh:1-5
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed on the host.setup.sh:90-130
  • The lab must be deployed using setup.sh or docker compose with the local Compose file.setup.sh:1-10docker-compose.local.yml:1-103
  • For CVE-2024-2961, the attacker must be able to reach the WordPress site and trigger the BuddyForms AJAX action 'upload_image_from_url'.exploit/cve=2024-2961.py:40-50
  • For CVE-2024-29510, the attacker must upload a malicious PS/EPS/PDF file via the 'Convert PostScript to Image' page.wordpress/mu-plugins/gs-convert-file.php:1-64wordpress/entrypoint.local.sh:200-300

Evidence-described exercise path

  1. Deploy the lab using setup.sh local or docker compose -f docker-compose.local.yml up.setup.sh:1-10docker-compose.local.yml:1-103
  2. For CVE-2024-2961: Run the exploit script cve=2024-2961.py against the WordPress site, providing the URL and a command to execute.exploit/cve=2024-2961.py:1-576
  3. For CVE-2024-29510: Upload a crafted PostScript file via the /convert-postscript-to-image page to trigger the Ghostscript format string vulnerability and achieve RCE.wordpress/mu-plugins/gs-convert-file.php:1-64wordpress/entrypoint.local.sh:200-300
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the lab's own target containers. The WordPress container is given SYS_ADMIN, SYS_PTRACE, and AppArmor unconfined, which are explicitly noted as intentional for local testing. The exploit script targets the lab's own WordPress instance. No hidden persistence, credential theft, host escape, or external connectivity beyond the lab is observed.

docker-compose.local.yml:62-66exploit/cve=2024-2961.py:1-576wordpress/mu-plugins/gs-convert-file.php:1-64
Review boundaries

What the analysis did not establish

  • CVE-2023-26326 is mentioned but no vulnerable component or exploit is visible in the provided evidence.
  • The exploit script for CVE-2024-29510 is not included in the evidence files.
  • The production Compose file and Dockerfile are not included in the evidence, so the analysis is limited to the local lab configuration.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

GitHub

docker-compose.prod.yml

Created Vuln labCVE-2023-26326CVE-2024-29510CVE-2024-2961Compose · mixed

1 Compose manifest · 1 Dockerfile · 5 services

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment deploying a vulnerable WordPress site on Ubuntu 22.04 with Nginx, MySQL, Redis, and Certbot. The WordPress container is built with a vulnerable glibc 2.35, Ghostscript 10.02.1, and BuddyForms 2.7.6 plugin to serve as a target for CVE-2024-2961 and CVE-2024-29510 exploitation exercises.

docker-compose.prod.yml:1-5wordpress/Dockerfile.prod:1-6

Lab assessment

Vulnerability lab

The environment is explicitly labeled as a 'Vulnerable WordPres Lab Environment' for CVE-2024-2961 and CVE-2024-29510. It includes intentionally vulnerable software versions (glibc 2.35, Ghostscript 10.02.1, BuddyForms 2.7.6), a custom Ghostscript AJAX handler, and an exploit script for CVE-2024-2961, all indicating a vulnerability research purpose.

docker-compose.prod.yml:1-5wordpress/Dockerfile.prod:1-6exploit/cve=2024-2961.py:1-4
Lab shapeCompose · mixed
Services5
Compose manifests1
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

mysql

database

MySQL 8.0 database service for WordPress, configured with healthcheck and persistent volume.

docker-compose.prod.yml:8-30

redis

object cache

Redis 8.0.3-alpine service for WordPress object caching, configured with memory limits and healthcheck.

docker-compose.prod.yml:32-52

wordpress

vulnerable targetPHP application server

Custom-built WordPress container on Ubuntu 22.04 with PHP-FPM 8.1, vulnerable glibc 2.35, Ghostscript 10.02.1, and BuddyForms 2.7.6 plugin. Exposes port 9000 for PHP-FPM. Runs with SYS_ADMIN, SYS_PTRACE capabilities and AppArmor unconfined for exploit development. Entrypoint script installs WordPress, activates plugins, and creates pages for exploitation.

docker-compose.prod.yml:54-93wordpress/Dockerfile.prod:1-150wordpress/entrypoint.prod.sh:1-402

nginx

reverse proxyTLS termination

Nginx 1.29.8-alpine reverse proxy serving WordPress over HTTP/HTTPS, with SSL termination, security headers, and static file serving.

docker-compose.prod.yml:95-120nginx/conf.d/wordpress.prod.conf:1-138

certbot

SSL certificate management

Certbot v4.2.0 for Let's Encrypt SSL certificate issuance and renewal, run on demand.

docker-compose.prod.yml:122-133

setup.sh

deployment automation

Bash script to automate deployment of the lab in local or production mode, including Docker installation, .env generation, nginx config generation, and container startup.

setup.sh:1-756

clean.sh

cleanup automation

Bash script to tear down Docker containers, volumes, and generated files for the lab.

clean.sh:1-175

cve=2024-2961.py

exploit script

Python exploit script (CNEXT) for CVE-2024-2961, implementing a PHP file-read to RCE via glibc iconv buffer overflow. Targets the lab's WordPress admin-ajax.php endpoint.

exploit/cve=2024-2961.py:1-576

gs-convert-file.php

vulnerable AJAX handler

WordPress mu-plugin providing an AJAX endpoint to convert uploaded PS/EPS/PDF files to images using Ghostscript. Intentionally calls ghostscript with -dSAFER to demonstrate CVE-2024-29510 format string vulnerability.

wordpress/mu-plugins/gs-convert-file.php:1-64
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2023-26326

Insufficient evidence

CVE-2023-26326 is mentioned in the Compose file header and README but no vulnerable component, exploit, or reproduction path for this CVE is visible in the supplied evidence. The BuddyForms plugin version 2.7.6 is installed, but no deserialization attack vector is configured or demonstrated.

docker-compose.prod.yml:4README.md:5

CVE-2024-29510

Supported by supplied evidence

The environment installs Ghostscript 10.02.1, a version known to be affected by CVE-2024-29510. A custom WordPress mu-plugin (gs-convert-file.php) provides an AJAX endpoint that executes Ghostscript with -dSAFER on user-uploaded PostScript files, explicitly documented as a trigger for the format string vulnerability. The Dockerfile and entrypoint script configure the vulnerable Ghostscript and the upload conversion page.

wordpress/Dockerfile.prod:1-6wordpress/Dockerfile.prod:100-120wordpress/mu-plugins/gs-convert-file.php:1-64wordpress/entrypoint.prod.sh:1-3

CVE-2024-2961

Supported by supplied evidence

The environment installs glibc 2.35-0ubuntu3, the vulnerable version for CVE-2024-2961. The BuddyForms plugin is installed, providing an unauthenticated AJAX endpoint (upload_image_from_url) used by the included exploit script (cve=2024-2961.py) to achieve file read and RCE via the iconv buffer overflow. The exploit script is present and targets the lab's own WordPress instance.

wordpress/Dockerfile.prod:1-6wordpress/Dockerfile.prod:30-38exploit/cve=2024-2961.py:1-4exploit/cve=2024-2961.py:40-50
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker Engine with Compose plugin installed on the host.setup.sh:100-130
  • Ubuntu 22.04 host OS (recommended, with warning for others).setup.sh:80-98
  • For production mode: a public IP address, a domain name, and DNS pointing to the host.setup.sh:50-55
  • Required passwords and configuration supplied via command-line arguments or .env file.setup.sh:40-55
  • WordPress container runs with SYS_ADMIN, SYS_PTRACE capabilities and AppArmor unconfined for exploit development.docker-compose.prod.yml:88-92

Evidence-described exercise path

  1. Deploy the lab using setup.sh with appropriate mode and parameters.setup.sh:1-15
  2. For CVE-2024-2961: Run the exploit script cve=2024-2961.py against the lab's WordPress URL, providing a command to execute.exploit/cve=2024-2961.py:1-4exploit/cve=2024-2961.py:40-50
  3. For CVE-2024-29510: Upload a crafted PostScript file via the 'Convert PostScript to Image' page to trigger the Ghostscript format string vulnerability.wordpress/mu-plugins/gs-convert-file.php:1-64wordpress/entrypoint.prod.sh:200-280
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior targets the lab's own WordPress container. The exploit script attacks the lab's admin-ajax.php endpoint, and the Ghostscript handler processes uploads within the container. The WordPress container runs with elevated capabilities (SYS_ADMIN, SYS_PTRACE, AppArmor unconfined) which are documented prerequisites for the exercise and do not by themselves indicate host compromise. No evidence of host persistence, credential theft, data destruction, unexplained external payloads, or backdoor behavior is present.

exploit/cve=2024-2961.py:40-50wordpress/mu-plugins/gs-convert-file.php:1-64docker-compose.prod.yml:88-92
Review boundaries

What the analysis did not establish

  • The exploit script cve=2024-2961.py imports external Python modules (pwn, ten) not included in the packet; their behavior is uninspected.
  • CVE-2023-26326 is mentioned but no exploit or vulnerable path is visible.
  • The README is mostly placeholder text ('soon') and does not provide complete documentation.
  • The production nginx config contains placeholder strings (<SERVER-PUBLICIP>, <DOMAIN_NAME>) indicating it is a template, not a final runnable config.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

2