How deathshotxd/comment2shell works
Comment2Shell is a single-file WordPress vulnerability scanner and proof-of-concept exploit, with a local Docker lab and defensive detection artifacts. The principal workflow discovers a target and post, submits a stored-XSS comment, relies on an administrator’s browser to upload a webshell, then polls and executes a command. The source excerpt is partial, so uncertain internal call wiring is omitted; documented behavior and paths in the tree support the broader workflow and ancillary capabilities.
Main entry points: comment2shell.py CLI Modes · ioc IOC Check · CVE-2026-93485.yaml Nuclei Detection · exploit.http HTTP Request Artifact
Components 18
Exploit Tool
- CLI Modes
comment2shell.py - Version Scanner
comment2shell.py - Post Discovery
comment2shell.py - Payload Builder
comment2shell.py - Comment Submission
comment2shell.py - In-browser ZIP
comment2shell.py - Shell Polling
comment2shell.py - Command Execution
comment2shell.py
Defensive Checks
- IOC Check
ioc - Nuclei Detection
nuclei/CVE-2026-93485.yaml - HTTP Request Artifact
requests/exploit.http
Local Lab
- Docker Lab
docker/docker-compose.yml
Other components
- Operator
- WordPress Target
- Administrator
- Admin Browser
- Uploaded Webshell
- OAST Service
Connections 27
- Operator → CLI Modes: selects mode
- CLI Modes → Version Scanner: runs scan
- Version Scanner → WordPress Target: probes version
- CLI Modes → Post Discovery: discovers post
- Post Discovery → WordPress Target: queries posts
- CLI Modes → Payload Builder: builds payload
- CLI Modes → Comment Submission: submits comment
- Comment Submission → WordPress Target: posts payload
- Administrator → Admin Browser: views post
- Admin Browser → WordPress Target: loads post
- WordPress Target → Admin Browser: serves stored payload
- Admin Browser → In-browser ZIP: builds ZIP
- Admin Browser → WordPress Target: uploads plugin
- WordPress Target → Uploaded Webshell: creates shell
- CLI Modes → Shell Polling: waits for shell
- Shell Polling → WordPress Target: checks shell path
- CLI Modes → Command Execution: runs command
- Command Execution → WordPress Target: requests command
- WordPress Target → Uploaded Webshell: executes command
- CLI Modes → IOC Check: runs IOC mode
- IOC Check → WordPress Target: checks indicators
- Operator → Nuclei Detection: runs template
- Nuclei Detection → WordPress Target: tests vulnerability
- Operator → HTTP Request Artifact: uses request
- Operator → Docker Lab: starts lab
- Payload Builder → OAST Service: optional callback
- Admin Browser → OAST Service: sends notification