ExKit is a convenience library for proof of concept code developed by Wordfence. It includes common actions such as logging in as a user with a specific role, returning the path for an endpoint (e.g., admin-ajax.php), grabbing WP nonces, and so on.

Most proofs of concept will require some degree of customization for the host being targeted. Each PoC will automatically prompt as needed for these values, but for repeated testing it may be useful to create a configuration file to pass in to avoid extra typing.

The configuration file is a simple, one-level JSON file. All of the common fields are defined in the file config-sample.json, but PoCs may define their own as needed. Using this file when executing a PoC is done with the --config command line option. The syntax is proofofconcept.php --config=/path/to/config.json.

This is just a broad overview of the available functions. For any additional details, consult the source code for the documentation and syntax.

The Cli class defines a number of convenience functions for getting and sending information via the console.

Returns a pre-parsed associative array of all options provided when the script was invoked.

Writes to the console, optionally with coloring.

Prompts the user for a value, optionally providing a default.

The Config class provides a unified interface for getting and storing environment-dependent values. This includes things like user credentials, host URLs, and so on.

Merges the given file with the stored value array.

Returns the value for the desired key, optionally prompting for it or returning a default value.

Stores the value for the given key.

The Endpoint class provides a unified interface for getting the URLs for the common endpoints for PoCs. It causes a prompt for these values if they have not been provided.

The base URL to the site.

The login URL for the site. This defaults to the baseURL + /wp-login.php if not yet known.

The admin URL for the site. This defaults to the baseURL + /wp-admin/admin.php if not yet known.

The admin AJAX URL for the site. This defaults to the baseURL + /wp-admin/admin-ajax.php if not yet known.

The admin post URL for the site. This defaults to the baseURL + /wp-admin/admin-post.php if not yet known.

The uploads URL for the site. This defaults to the baseURL + /wp-content/uploads if not yet known.

Checks the config for the given URL and prompts the user for it if needed.

Defines several exit codes to ensure PoCs use a common set of values.

Use if displaying some information only and not running the exploit (e.g., displaying the help message).

Use if the exploit fails.

Use if the exploit succeeds.

Use if some precondition for running the exploit fails (e.g., invalid login credentials).

Use if a test for a valid request fails.

Provides convenience functions to interface with a page.

Loads the given page and applies the regex to the response, returning any matches.

Provides login capabilities. This may be for a specific user or for a user with the desired role.

Logs in as a user with the desired role (calls logInAsUser). If no user is found in the configuration cache, it will prompt for the user's credentials.

Logs in as the user with the given credentials. If logging in fails, it will write out an error and exit with the code EXIT_CODE_FAILED_PRECONDITION.

Convience class for finding nonces.

Loads the given page and searches it for a nonce. Currently this is just done by applying a regex, but future versions may use a smarter approach.