Hack Forums
[help] how can I bypass wordpress /wp-admin/ login restriction? - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: [help] how can I bypass wordpress /wp-admin/ login restriction? (/showthread.php?tid=6055027)

[help] how can I bypass wordpress /wp-admin/ login restriction? - WPA2 - Mar 6, 2020

I already have access to the DB of the site, I also deleted most security plugins and .htacess files, I still get "Sorry, you are not allowed to access this page." on some websites, on other websites I get " 404 not found" when I literally see "wp-admin/login.php" in the website directory i.e: "site.com/wp-admin",
here is an example
[Image: bwQABc4.png]

Just to be clear again, I already have PHPshell on the website that I need to gain access to the dashboard of WordPress, I have changed the password in the DB but I still can't figure out how I can't access the dashboard! some times it says 404 not found (fake) and in other sites, it says "Sorry, you are not allowed to access this page"

RE: [help] how can I bypass wordpress /wp-admin/ login restriction? - compalabee - Mar 6, 2020

(Mar 6, 2020 03:12 AM)WPA2 Wrote:  I already have access to the DB of the site, I also deleted most security plugins and .htacess files, I still get "Sorry, you are not allowed to access this page." on some websites, on other websites I get " 404 not found" when I literally see "wp-admin/login.php" in the website directory i.e: "site.com/wp-admin",
here is an example
[Image: bwQABc4.png]

Just to be clear again, I already have PHPshell on the website that I need to gain access to the dashboard of WordPress, I have changed the password in the DB but I still can't figure out how I can't access the dashboard! some times it says 404 not found (fake) and in other sites, it says "Sorry, you are not allowed to access this page"


Not too sure, but I think you need admin rights to access that endpoint. Maybe the account you're logged in as is only an author account?

Default admin info is at
PHP Code

<?php 
/wp-json/wp/v2/users/1 

You might also be able to use the registration endpoint as foothold
PHP Code

<?php 
/wp-signup.php 

Edit:
Maybe I misunderstood you earlier.

The login page is actually at
PHP Code

<?php 
/wp-login.php 


RE: [help] how can I bypass wordpress /wp-admin/ login restriction? - WPA2 - Mar 6, 2020

I do have the admin account, but still, it shows Howdy bar without giving access

[Image: XyUJsBk.png]


also after deleting "all wp security plugin", I logged in and I see "Sorry, you are not allowed to access this page."

NOTE: I noticed that plugins and.htaccess files are born again after deleting them! wtf!!!