Hack Forums
Hacking a wordpress site with wp-config.php - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: Hacking a wordpress site with wp-config.php (/showthread.php?tid=6090077)

Pages: Pages 1 2


Hacking a wordpress site with wp-config.php - MikeGolfRomeo - Jun 25, 2020

I have a wordpress site where is wp-config.php has been leaked...

PHP Code

<?php

$temp_ip 
= explode(',', isset($_SERVER['HTTP_X_FORWARDED_FOR']) ? $_SERVER['HTTP_X_FORWARDED_FOR'] : (isset($_SERVER['HTTP_CLIENT_IP']) ?
$_SERVER['HTTP_CLIENT_IP'] : $_SERVER['REMOTE_ADDR']));
$remote_addr = trim($temp_ip[0]);
$_SERVER['REMOTE_ADDR'] = preg_replace('/[^0-9.:]/', '', $remote_addr );

define( 'DB_NAME', 'privater' );
define( 'DB_USER', 'privater' );
define( 'DB_PASSWORD', 'private' );
define( 'DB_HOST', 'private' );

define( 'DB_CHARSET', 'utf8' );
define( 'DB_COLLATE', '' );
define('SUBDOMAIN_INSTALL',true);
define( 'VHOST', 'yes' );
//define( 'WP_ALLOW_MULTISITE', true );
//define( 'MULTISITE', true );
//define( 'SUBDOMAIN_INSTALL', true );
define( 'WP_ALLOW_REPAIR', true );
$base = '/';

define( 'DOMAIN_CURRENT_SITE', 'private.co.uk' );
define( 'PATH_CURRENT_SITE', '/' );
define( 'WPLANG', 'en-GB' );
define( 'SITE_ID_CURRENT_SITE', 1 );
define( 'BLOG_ID_CURRENT_SITE', 1 );
define( 'AUTOSAVE_INTERVAL', 120 );
define( 'WP_POST_REVISIONS', 10 );
define( 'EMPTY_TRASH_DAYS', 7 );
define( 'WP_MEMORY_LIMIT', '512M' );
define( 'WPCOM_API_KEY','private' );
define( 'TUKOD_MSSN', true );
define( 'ALLOW_UNFILTERED_UPLOADS', true );
define( 'DISALLOW_UNFILTERED_HTML', false );
define( 'FS_METHOD', 'direct' );
define( 'WP_DEFAULT_THEME', 'twentytwelve' );
define( 'PSTS_DONT_REVERSE_LEVELS', true );
define( 'PSTS_DEFAULT_LEVEL', 1 );
define( 'PSTS_DEFAULT_PERIOD', 1 );
define( 'PSTS_CANCEL_LAST', 1 );
define( 'DOMAINMAPPING_ALLOWMULTI', 'yes' );
define( 'WPMUDEV_HIDE_BRANDING', true );
define( 'WPMUDEV_LIMIT_TO_USER','31505,97879,9,8469' );
define( 'DISABLE_WP_CRON', true );
//define(' ALTERNATE_WP_CRON', true );
define( 'SC_WPFMP_ADMIN_ALERT_PERMISSION', 'manage_network' );
define( 'WDS_SITEWIDE', false );
define( 'AUTH_KEY', 'private' );
define( 'SECURE_AUTH_KEY', 'private' );
define( 'LOGGED_IN_KEY', 'private' );
define( 'NONCE_KEY', 'private' );
define( 'AUTH_SALT', 'private' );
define( 'SECURE_AUTH_SALT', 'private' );
define( 'LOGGED_IN_SALT', 'private' );
define( 'NONCE_SALT', 'private' );
define( 'COOKIEHASH', md5('private') );
define( 'WP_CACHE_KEY_SALT', 'pb' );
define('WP_CACHE', true);
//define( 'ADMIN_COOKIE_PATH', '/' );
//define( 'COOKIEPATH', '/' );
//define( 'SITECOOKIEPATH', '/' );

// needs to be hashed out for upgraded plugin
//define( 'COOKIE_DOMAIN', '');

define( 'POST_BY_EMAIL', true );

define( 'LOGINFORMKEY', 'private' );

define( 'GF_RECAPTCHA_PUBLIC_KEY', 'private' );
define( 'GF_RECAPTCHA_PRIVATE_KEY', 'private' );
define( 'GF_LICENSE_KEY', 'private' );

$table_prefix  = 'wp_';
if( 
$base == 'BASE' )
die( 
'Problem in wp-config.php - $base is set to BASE when it should be the path like "/" or "/blogs/"! Please fix it!' );
if ( !
defined('ABSPATH') )
define( 'ABSPATH', dirname(__FILE__) . '/' );

$redis = array(
  
'host' => '88.208.201.123',
  
'port' => 1234,
);

//define( 'WP_DEBUG', true );
//define( 'WP_DEBUG_LOG', true );
//define( 'WP_DEBUG_DISPLAY', true );
//define( 'DISABLE_WP_CRON', true);
//define( 'CONCATENATE_SCRIPTS', false );
//define( 'WPMU_ACCEL_REDIRECT', true );

define( 'SUNRISE', 'on' );
require_once(
ABSPATH . 'wp-settings.php');

define( 'WP_AUTO_UPDATE_CORE', false ); 

i replaced private info w/ "private"

How could i hack them?


RE: Hacking a wordpress site with wp-config.php - Sickness - Jun 25, 2020

Are you literally dumb? You have on the first lines the define variables for the connection to the database, you can do many things with just that. Use your head or just leave it alone, asking this clearly shows your intellectual level.


RE: Hacking a wordpress site with wp-config.php - MikeGolfRomeo - Jun 25, 2020

(Jun 25, 2020 03:22 AM)Sickness. Wrote:  Are you literally dumb? You have on the first lines the define variables for the connection to the database, you can do many things with just that. Use your head or just leave it alone, asking this clearly shows your intellectual level.

I dont understand, how could i recreate that and steal data?


RE: Hacking a wordpress site with wp-config.php - Sickness - Jun 25, 2020

(Jun 25, 2020 03:25 AM)MikeGolfRomeo Wrote:  I dont understand, how could i recreate that and steal data?

Google how to connect to a database, but, if I was you I would literally leave this cause you're gonna leave many footprints.


RE: Hacking a wordpress site with wp-config.php - MikeGolfRomeo - Jun 25, 2020

(Jun 25, 2020 03:26 AM)Sickness. Wrote:  Google how to connect to a database, but, if I was you I would literally leave this cause you're gonna leave many footprints.

Ok, but what about all the keys, and salts? What can i do with them?


RE: Hacking a wordpress site with wp-config.php - Sickness - Jun 25, 2020

define( 'DOMAIN_CURRENT_SITE', 'private.co.uk' );
&
$redis = array(
'host' => '88.208.201.123',
'port' => 1234,
);

you just left this important information, this shows how dumb you are, also, the site doesnt host anything now so I dont know if they removed the site or whatever.


RE: Hacking a wordpress site with wp-config.php - MikeGolfRomeo - Jun 25, 2020

(Jun 25, 2020 04:10 AM)Sickness. Wrote:  define( 'DOMAIN_CURRENT_SITE', 'private.co.uk' );
&
$redis = array(
 'host' => '88.208.201.123',
 'port' => 1234,
);

you just left this important information, this shows how dumb you are, also, the site doesnt host anything now so I dont know if they removed the site or whatever.

Yes it does, the domain i changed to private.co.uk lol and the port hehe

Anyway look up the domain "primary blogger". All the websites it hosts have there config.php open

wp-config.php.save
| Found By: Direct Access (Aggressive Detection)

It hosts websites all which have the vulnerability above. Just search it up and hack away lol


RE: Hacking a wordpress site with wp-config.php - Sickness - Jun 25, 2020

(Jun 25, 2020 04:21 AM)MikeGolfRomeo Wrote:  Yes it does, the domain i changed to private.co.uk lol and the port hehe

Anyway look up the domain "primary blogger". All the websites it hosts have there config.php open

wp-config.php.save
| Found By: Direct Access (Aggressive Detection)

It hosts websites all which have the vulnerability above. Just search it up and hack away lol

Port 3306 and 6379 doesnt connect properly, used the user and password inside that file and seems that is old as hell and they got another password, or just accept connection from the same machine, one of those.


RE: Hacking a wordpress site with wp-config.php - MikeGolfRomeo - Jun 25, 2020

(Jun 25, 2020 04:46 AM)Sickness. Wrote:  Port 3306 and 6379 doesnt connect properly, used the user and password inside that file and seems that is old as hell and they got another password, or just accept connection from the same machine, one of those.

Ohhhh, what code did you use? The same one that you showed me? How can i run php? They host other websites too try that out :)


RE: Hacking a wordpress site with wp-config.php - Sickness - Jun 25, 2020

(Jun 25, 2020 05:05 AM)MikeGolfRomeo Wrote:  Ohhhh, what code did you use? The same one that you showed me? How can i run php? They host other websites too try that out :)

Just connected to the database, look on internet how to do that.


RE: Hacking a wordpress site with wp-config.php - MikeGolfRomeo - Jun 25, 2020

(Jun 25, 2020 05:24 AM)Sickness. Wrote:  Just connected to the database, look on internet how to do that.

So it worked?


RE: Hacking a wordpress site with wp-config.php - Sickness - Jun 25, 2020

(Jun 25, 2020 05:53 AM)MikeGolfRomeo Wrote:  So it worked?

I mean that I used the parameters found there but no can't connect, search on google so you'll learn how to do a mysql connection.


RE: Hacking a wordpress site with wp-config.php - MikeGolfRomeo - Jun 25, 2020

(Jun 25, 2020 05:55 AM)Sickness. Wrote:  I mean that I used the parameters found there but no can't connect, search on google so you'll learn how to do a mysql connection.

Ok, would that work with this data?

http://cworldcars.com/.env


RE: Hacking a wordpress site with wp-config.php - Sickness - Jun 25, 2020

(Jun 25, 2020 05:56 AM)MikeGolfRomeo Wrote:  Ok, would that work with this data?

http://cworldcars.com/.env

Contact me on private, you are leaking too much sensitive data.
Sickness#0001


RE: Hacking a wordpress site with wp-config.php - MikeGolfRomeo - Jun 25, 2020

I cant need reputation, you do it to me

(Jun 25, 2020 05:58 AM)Sickness. Wrote:  Contact me on private, you are leaking too much sensitive data.
Sickness#0001

You have discord?

Sickness, i cant PM add me on discord 101Hacker101#8447

(Jun 25, 2020 05:58 AM)Sickness. Wrote:  Contact me on private, you are leaking too much sensitive data.
Sickness#0001

Add me on discord "101Hacker101#8447"