# deathshotxd/comment2shell architecture

> Architecture diagram of the GitHub repository deathshotxd/comment2shell, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-26). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/deathshotxd/comment2shell
- Repository: https://github.com/deathshotxd/comment2shell

## Overview

Comment2Shell is a single-file WordPress vulnerability scanner and proof-of-concept exploit, with a local Docker lab and defensive detection artifacts. The principal workflow discovers a target and post, submits a stored-XSS comment, relies on an administrator’s browser to upload a webshell, then polls and executes a command. The source excerpt is partial, so uncertain internal call wiring is omitted; documented behavior and paths in the tree support the broader workflow and ancillary capabilities.

Main entry points: [`comment2shell.py`](https://github.com/deathshotxd/comment2shell/blob/main/comment2shell.py) (CLI Modes), [`ioc`](https://github.com/deathshotxd/comment2shell/tree/main/ioc) (IOC Check), [`nuclei/CVE-2026-93485.yaml`](https://github.com/deathshotxd/comment2shell/blob/main/nuclei/CVE-2026-93485.yaml) (Nuclei Detection), [`requests/exploit.http`](https://github.com/deathshotxd/comment2shell/blob/main/requests/exploit.http) (HTTP Request Artifact)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_core["Exploit Tool"]
  node_cli["CLI Modes<br/>[comment2shell.py]"]
  node_scanner["Version Scanner<br/>[comment2shell.py]"]
  node_postfinder["Post Discovery<br/>[comment2shell.py]"]
  node_payload["Payload Builder<br/>[comment2shell.py]"]
  node_comment["Comment Submission<br/>[comment2shell.py]"]
  node_pluginzip["In-browser ZIP<br/>[comment2shell.py]"]
  node_poller["Shell Polling<br/>[comment2shell.py]"]
  node_executor["Command Execution<br/>[comment2shell.py]"]
end

subgraph group_defense["Defensive Checks"]
  node_ioc["IOC Check"]
  node_nuclei["Nuclei Detection"]
  node_httpartifact["HTTP Request Artifact<br/>[exploit.http]"]
end

subgraph group_lab["Local Lab"]
  node_lab["Docker Lab<br/>[docker-compose.yml]"]
end

node_operator(("Operator"))
node_target[("WordPress Target")]
node_admin(("Administrator"))
node_browser["Admin Browser"]
node_webshell["Uploaded Webshell"]
node_callback(("OAST Service"))

node_operator -->|"selects mode"| node_cli
node_cli -->|"runs scan"| node_scanner
node_scanner -->|"probes version"| node_target
node_cli -->|"discovers post"| node_postfinder
node_postfinder -->|"queries posts"| node_target
node_cli -->|"builds payload"| node_payload
node_cli -->|"submits comment"| node_comment
node_comment -->|"posts payload"| node_target
node_admin -->|"views post"| node_browser
node_browser -->|"loads post"| node_target
node_target -->|"serves stored payload"| node_browser
node_browser -->|"builds ZIP"| node_pluginzip
node_browser -->|"uploads plugin"| node_target
node_target -->|"creates shell"| node_webshell
node_cli -->|"waits for shell"| node_poller
node_poller -->|"checks shell path"| node_target
node_cli -->|"runs command"| node_executor
node_executor -->|"requests command"| node_target
node_target -->|"executes command"| node_webshell
node_cli -->|"runs IOC mode"| node_ioc
node_ioc -->|"checks indicators"| node_target
node_operator -->|"runs template"| node_nuclei
node_nuclei -->|"tests vulnerability"| node_target
node_operator -.->|"uses request"| node_httpartifact
node_operator -->|"starts lab"| node_lab
node_payload -.->|"optional callback"| node_callback
node_browser -.->|"sends notification"| node_callback

click node_cli "https://github.com/deathshotxd/comment2shell/blob/main/comment2shell.py"
click node_scanner "https://github.com/deathshotxd/comment2shell/blob/main/comment2shell.py"
click node_postfinder "https://github.com/deathshotxd/comment2shell/blob/main/comment2shell.py"
click node_payload "https://github.com/deathshotxd/comment2shell/blob/main/comment2shell.py"
click node_comment "https://github.com/deathshotxd/comment2shell/blob/main/comment2shell.py"
click node_pluginzip "https://github.com/deathshotxd/comment2shell/blob/main/comment2shell.py"
click node_poller "https://github.com/deathshotxd/comment2shell/blob/main/comment2shell.py"
click node_executor "https://github.com/deathshotxd/comment2shell/blob/main/comment2shell.py"
click node_ioc "https://github.com/deathshotxd/comment2shell/tree/main/ioc"
click node_nuclei "https://github.com/deathshotxd/comment2shell/blob/main/nuclei/CVE-2026-93485.yaml"
click node_httpartifact "https://github.com/deathshotxd/comment2shell/blob/main/requests/exploit.http"
click node_lab "https://github.com/deathshotxd/comment2shell/blob/main/docker/docker-compose.yml"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_cli,node_scanner,node_postfinder,node_payload,node_comment,node_pluginzip,node_poller,node_executor,node_browser toneBlue
class node_ioc,node_nuclei,node_httpartifact,node_target toneAmber
class node_lab toneMint
class node_operator,node_admin,node_webshell,node_callback toneIndigo
```

## Components

### Exploit Tool

- [CLI Modes](https://github.com/deathshotxd/comment2shell/blob/main/comment2shell.py): `comment2shell.py`
- [Version Scanner](https://github.com/deathshotxd/comment2shell/blob/main/comment2shell.py): `comment2shell.py`
- [Post Discovery](https://github.com/deathshotxd/comment2shell/blob/main/comment2shell.py): `comment2shell.py`
- [Payload Builder](https://github.com/deathshotxd/comment2shell/blob/main/comment2shell.py): `comment2shell.py`
- [Comment Submission](https://github.com/deathshotxd/comment2shell/blob/main/comment2shell.py): `comment2shell.py`
- [In-browser ZIP](https://github.com/deathshotxd/comment2shell/blob/main/comment2shell.py): `comment2shell.py`
- [Shell Polling](https://github.com/deathshotxd/comment2shell/blob/main/comment2shell.py): `comment2shell.py`
- [Command Execution](https://github.com/deathshotxd/comment2shell/blob/main/comment2shell.py): `comment2shell.py`

### Defensive Checks

- [IOC Check](https://github.com/deathshotxd/comment2shell/tree/main/ioc): `ioc`
- [Nuclei Detection](https://github.com/deathshotxd/comment2shell/blob/main/nuclei/CVE-2026-93485.yaml): `nuclei/CVE-2026-93485.yaml`
- [HTTP Request Artifact](https://github.com/deathshotxd/comment2shell/blob/main/requests/exploit.http): `requests/exploit.http`

### Local Lab

- [Docker Lab](https://github.com/deathshotxd/comment2shell/blob/main/docker/docker-compose.yml): `docker/docker-compose.yml`

### Other components

- **Operator**
- **WordPress Target**
- **Administrator**
- **Admin Browser**
- **Uploaded Webshell**
- **OAST Service**

## Connections

- Operator → CLI Modes: selects mode
- CLI Modes → Version Scanner: runs scan
- Version Scanner → WordPress Target: probes version
- CLI Modes → Post Discovery: discovers post
- Post Discovery → WordPress Target: queries posts
- CLI Modes → Payload Builder: builds payload
- CLI Modes → Comment Submission: submits comment
- Comment Submission → WordPress Target: posts payload
- Administrator → Admin Browser: views post
- Admin Browser → WordPress Target: loads post
- WordPress Target → Admin Browser: serves stored payload
- Admin Browser → In-browser ZIP: builds ZIP
- Admin Browser → WordPress Target: uploads plugin
- WordPress Target → Uploaded Webshell: creates shell
- CLI Modes → Shell Polling: waits for shell
- Shell Polling → WordPress Target: checks shell path
- CLI Modes → Command Execution: runs command
- Command Execution → WordPress Target: requests command
- WordPress Target → Uploaded Webshell: executes command
- CLI Modes → IOC Check: runs IOC mode
- IOC Check → WordPress Target: checks indicators
- Operator → Nuclei Detection: runs template
- Nuclei Detection → WordPress Target: tests vulnerability
- Operator → HTTP Request Artifact: uses request
- Operator → Docker Lab: starts lab
- Payload Builder → OAST Service: optional callback
- Admin Browser → OAST Service: sends notification