+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: Wordpress Plugin Backdoor [Help] (/showthread.php?tid=6255377)
Wordpress Plugin Backdoor [Help] - M4STERMIND - Nov 1, 2023
Hey everyone,
I'm interesed to know if there's any ready-to-use backdoor that I can use to infect a wordpress plugin so I can get full access to the victim's web server (after the victim uploads and activates the plugin).
If there isn't any public backdoor, can you recommend any tips or techniques on how to infect a WP Plugin with a backdoor?
I appreciate if you could help me with any suggestions.
Thanks alot in advance.
RE: Wordpress Plugin Backdoor [Help] - linkinpork - Nov 1, 2023
(Nov 1, 2023 05:53 PM)M4STERMIND Wrote: ...
If there isn't any public backdoor, can you recommend any tips or techniques on how to infect a WP Plugin with a backdoor?
...
Hi,
Wordpress assumes 3 things:
- There's a webserver
- It has at least PHP 7.4
- It has a MySQL/MariaDB
So basically you can like edit a plugin somewhere to include a PHP webshell (or deadass just upload the page or whatever). Plenty of PHP shells on GitHub, there's a public repository here.
Cheers!
RE: Wordpress Plugin Backdoor [Help] - M4STERMIND - Nov 3, 2023
(Nov 1, 2023 11:06 PM)linkinpork Wrote: Hi,
Wordpress assumes 3 things:Source: https://wordpress.org/about/requirements/
- There's a webserver
- It has at least PHP 7.4
- It has a MySQL/MariaDB
So basically you can like edit a plugin somewhere to include a PHP webshell (or deadass just upload the page or whatever). Plenty of PHP shells on GitHub, there's a public repository here.
Cheers!
Thanks, I didn't know it was this easy. I thought WP had some protection for suspicious plugins.