Join Our Official Group : https://t.me/+8hAW5FyWh6NmZmRl

WP-Shell3r v0.3

WP-Shell3r v0.3 — WordPress Shell Uploader

✓ Plugin / Direct / File Manager / Plugin Editor upload
✓ WAF & email verification bypass
✓ Auto admin creation
✓ Async GUI + retry system
✓ Multi-format site list support

━━━━━━━━━━━━━━━━━━━━
📋 Site List Formats
━━━━━━━━━━━━━━━━━━━━
site|user|pass
site:user:pass
site;user;pass
site/wp-login.php:user:pass
site/wp-login.php#user@pass

• http:// optional — auto-added
• Duplicates removed automatically
• Encodings: UTF-8 / Latin-1 / CP1252

Trial version : here
━━━━━━━━━━━━━━━━━━━━
💰 Price: DM
🛒 @blackscriptx
📩 Contact: @Moonlightcrow
━━━━━━━━━━━━━━━━━━━━
⚠️ For authorized penetration testing only

● 📬 Mailer Tester — by Who Knows

Mass-test your Leaf PHPMailer panels in seconds.

✅ Paste 100s of mailer URLs — tested concurrently
📊 Live stats: Done / Left / OK / Failed in real time
⚡️ Progress bar updates as each result comes in
⏹️ Stop anytime with one click
🌐 Clean web UI — runs locally on your machine

Built with Python (FastAPI) + Chrome TLS impersonation
so servers can't fingerprint-block the requests.

How to run:
pip install -r requirements.txt
python main.py
→ open http://localhost:8765

Link : here

🔗 https://t.me/Moonlightcrow

🚀 xLeet Shell Uploader v3.0

GUI tool for mass-uploading shells to xLeet

Features:
• 🍪 JSON Cookie Loader — paste exported browser cookies, tokens auto-extracted
• ⚡️ Multi-threaded uploads — configurable worker count (1–20)
• 💰 Price control — set min/max range or randomize per shell
• 🔄 Auto-retry — exponential backoff, skips 4xx auth errors instantly
• ⚙️ Persistent settings — URL, tokens, performance saved between sessions
• 🛑 Clean stop — non-blocking cancel, saves progress
• 📊 Live stats — success / failed / remaining counters
• 🔧 Configurable domain — change target URL without editing code



pip install PySide6 requests brotli

@Moonlightcrow

🔥 CVE-2026-48907 — JCE Joomla Unauthenticated RCE Scanner

Exploit for the JCE (JoomlaContentEditor) plugin remote code execution vulnerability.


⚙️ Features:
• Async engine (aiohttp) — high concurrency, low overhead
• Auto CSRF token extraction
• Multi-payload strategy (direct .php + GIF rename bypass)
• Only saves CONFIRMED shells (PHP code actually executes)
• Results saved to: joom-shell.txt

📌 Usage:
pip install aiohttp aiofiles colorama
python CVE-2026-48907.py
→ Enter targets file & concurrency

=> Who Knows
📢 Channel : https://t.me/Moonlightcrow

For educational and authorized testing only.

Adminer 5.4.2 — MSSQL TraceFile RCE

━━━ VULNERABILITY ━━━
Adminer 5.4.2 MSSQL driver passes auth[server]
directly into the PDO DSN. Semicolon-delimited
options are parsed by ODBC — injecting:
TraceFile=up.php;TraceOn=1
causes ODBC to write a trace file to webroot.
auth[username] lands as UID={<value>} in the
trace — inject PHP webshell there.

pip install aiohttp colorama

━━━ RUN ━━━
python Adminer-0day.py siteList.txt

Download-Link : Here

wp2shell (CVE-2026-63030 ,  CVE-2026-60137)

Usage : python wp2shell.py sites.txt

Download LINK : here