[ｍＯｂｉＩｅ]

WordPress Slider Revolution Vulnerability Exploit:
Slider Revolution Premium WordPress Plugin that allows a remote attacker to download any file from the server.

http://blog.sucuri.net/2014/09/slider-re...oited.html

In my previous thread I help explain how easy it was to hack multiple WordPress websites through some vulnerable themes.
As you may already know the database password rarely matched the WordPress admin's password. =/

[TUTORIAL:]>_ HACK WORDPRESS WEBSITES_[/NO Experience Required!]

https://hackforums.net/showthread.php?tid=4445583

Here's a simple .php script Coded By AMir dZ 52 and Modified & Hosted by me help you exploit it even more. 🎉


Here's how it works:

First Click on "Exploit Dorks" tab and choose a dork to search on Google.

EXAMPLE:


Next click "Exploiter" tab and copy/paste multiple URL's from google and click on "Exploit" to scan for vulnerable WordPress sites. If infected it will display:

PHP Code


<?php 
DB_Name:
DB_User:
DB_Pass:
DB_Host: 


Now that you have the MySQL database information click on "Find DB Panel" and you can try to locate the login panel.


Currently scans:

PHP Code


<?php 
$list = array(

'/phpMyAdmin/',

'/phpmyadmin/',

'/PMA/',

'/pma/',

'/admin/',

'/wp-login.php',

'/dbadmin/',

'/DB_ADMIN/',

'/db_admin/',

'/DBA/',

'/SQLI/',

'/dba/',

'/sqli/',

'/mysql/',

'/myadmin/',

'/phpmyadmin2/',

'/phpMyAdmin2/',

'/phpMyAdmin-2/',

'/php-my-admin/',

'/phpMyAdmin-2.2.3/',

'/phpMyAdmin-2.2.6/',

'/phpMyAdmin-2.5.1/',

'/phpMyAdmin-2.5.4/',

'/phpMyAdmin-2.5.5-rc1/',

'/phpMyAdmin-2.5.5-rc2/',

'/phpMyAdmin-2.5.5/',

'/phpMyAdmin-2.5.5-pl1/',

'/phpMyAdmin-2.5.6-rc1/',

'/phpMyAdmin-2.5.6-rc2/',

'/phpMyAdmin-2.5.6/',

'/phpMyAdmin-2.5.7/',

'/phpMyAdmin-2.5.7-pl1/',

'/phpMyAdmin-2.6.0-alpha/',

'/phpMyAdmin-2.6.0-alpha2/',

'/phpMyAdmin-2.6.0-beta1/',

'/phpMyAdmin-2.6.0-beta2/',

'/phpMyAdmin-2.6.0-rc1/',

'/phpMyAdmin-2.6.0-rc2/',

'/phpMyAdmin-2.6.0-rc3/',

'/phpMyAdmin-2.6.0/',

'/phpMyAdmin-2.6.0-pl1/',

'/phpMyAdmin-2.6.0-pl2/',

'/phpMyAdmin-2.6.0-pl3/',

'/phpMyAdmin-2.6.1-rc1/',

'/phpMyAdmin-2.6.1-rc2/',

'/phpMyAdmin-2.6.1/',

'/phpMyAdmin-2.6.1-pl1/',

'/phpMyAdmin-2.6.1-pl2/',

'/phpMyAdmin-2.6.1-pl3/',

'/phpMyAdmin-2.6.2-rc1/',

'/phpMyAdmin-2.6.2-beta1/',

'/phpMyAdmin-2.6.2-rc1/',

'/phpMyAdmin-2.6.2/',

'/phpMyAdmin-2.6.2-pl1/',

'/phpMyAdmin-2.6.3/',

'/phpMyAdmin-2.6.3-rc1/',

'/phpMyAdmin-2.6.3/',

'/phpMyAdmin-2.6.3-pl1/',

'/phpMyAdmin-2.6.4-rc1/',

'/phpMyAdmin-2.6.4-pl1/',

'/phpMyAdmin-2.6.4-pl2/',

'/phpMyAdmin-2.6.4-pl3/',

'/phpMyAdmin-2.6.4-pl4/',

'/phpMyAdmin-2.6.4/',

'/phpMyAdmin-2.7.0-beta1/',

'/phpMyAdmin-2.7.0-rc1/',

'/phpMyAdmin-2.7.0-pl1/',

'/phpMyAdmin-2.7.0-pl2/',

'/phpMyAdmin-2.7.0/',

'/phpMyAdmin-2.8.0-beta1/',

'/phpMyAdmin-2.8.0-rc1/',

'/phpMyAdmin-2.8.0-rc2/',

'/phpMyAdmin-2.8.0/',

'/phpMyAdmin-2.8.0.1/',

'/phpMyAdmin-2.8.0.2/',

'/phpMyAdmin-2.8.0.3/',

'/phpMyAdmin-2.8.0.4/',

'/phpMyAdmin-2.8.1-rc1/',

'/phpMyAdmin-2.8.1/',

'/phpMyAdmin-2.8.2/',

'/sqlmanager/',

'/mysqlmanager/',

'/p/m/a/',

'/PMA2005/',

'/pma2005/',

'/dev/',

'/phpmanager/',

'/php-myadmin/',

'/phpmy-admin/',

'/webadmin/',

'/sqlweb/',

'/websql/',

'/webdb/',

'/mysqladmin/',

'/mysql-admin/',

'/mya/',

'/PhpMyAdmin/',

'/phpmyadmin/',

'/myadmin/',

'/mysql/',

'/sql/',

'/server/',

'/db/',

'/database/',

'/databases/',

'/adm/',

'/configuration/',

'/configure/',

'/administrator/',

'/login/',

'/moderator/',

'/controlpanel/',

'/adminpanel/',

'/admincontrol/',

'/fileadmin/',

'/data/',

'/postgresql/',

'/oracle/',

'/msssql/',

'/msaccess/',

'/sysadmin/',

'/serverdata/',

'/webadmin/',

'/admins/',

'/Database_Administration/',

'/WebAdmin/',

'/useradmin/',

'/sysadmins/',

'/admin1/',

'/system-administration/',

'/administrators/',

'/pgadmin/',

'/directadmin/',

'/staradmin/',

'/ServerAdministrator/',

'/SysAdmin/',

'/administer/',

'/LiveUser_Admin/',

'/sys-admin/',

'/typo3/',

'/panel/',

'/xlogin/',

'/smblogin/',

'/phpldapadmin/',

'/server_admin/',

'/database_administration/',

'/system_administration/',

'/ss_vms_admin_sm/',

'/adminarea/',

'/MySQL/',

'/mysql_admin/',

'/server_data/',

'/DB/',

'/DB1/',

'/DB2/',

'/DB3/',

'/DB4/',

'/DB5/',

'/DB6/',

'/DB7/',

'/DB8/',

'/DB9/',

'/DB0/',

'/db1/',

'/db2/',

'/db3/',

'/db4/',

'/db5/',

'/db6/',

'/db7/',

'/db8/',

'/db9/',

'/db0/',

'/mysql5/',

'/mysql4/',

'/root/',

'/apache/',

'/php/',

'/Apache/',

'/Php/',

'/apach/',

'/apachepanel/',

'/WEBSERVERS/',

'/DATABASE1/',

'/DATABASE2/',

'/DATABASE3/',

'/DATABASE4/',

'/DATABASE5/',

'/DATABASE6/',

'/DATABASE7/',

'/DATABASE8/',

'/DATABASE9/',

'/WEBDATA/',

'/WEB_DATA/',

'/webservers/',

'/database1/',

'/database2/',

'/database3/',

'/database4/',

'/database5/',

'/database6/',

'/database7/',

'/database8/',

'/database9/',

'/webdata/',

'/web_data/',

); 


Some other added features to help you along.






►Hosted Link:

http://www.dogankagit.com/toksel/revpress.php

Good Luck and Thanks for viewing my thread. 🤝

[Hooded Robin]

no shouts when i posted a py exploit script for this vuln on your other original posting :(

PS - you can turn it into a very high success rate for WP admin panel compromise, if you follow some good advice from here: http://blog.spiderlabs.com/2014/09/lever...sites.html (use your brain and you can see how this vuln and this writeup relate.....hint hint wink wink, not just for LFI)

[Zlatane Ibrahimovique]

Great contribution Sir!

Thanks for this :)

[***W0lf***]

Thanks for sharing this useful site-tools Sir!

[Hunger]

Thanks for sharing this OP, useful tool :D

[Nitai]

Thanks for sharing this tool, HQ Member !

[Bibl]

I love it i love it i love it very HQ :DDDDDD

[Drøm]

Yeah, they can download files from the server but what damage is that going to cause. Except they would only have the ability to rip a template or plugin but I can't see this as a massive threat tbh.

[Nigga From Africa]

Yeah, they can download files from the server but what damage is that going to cause. Except they would only have the ability to rip a template or plugin but I can't see this as a massive threat tbh.

Download the config
Find the pma and boom db access.

[Drøm]

Download the config
Find the pma and boom db access.

Depends on what kind of version of WP you're using.

[Nigga From Africa]

Depends on what kind of version of WP you're using.

It all depends on if you can find the phpmyadmin login.
You dont really know what you're talking about do you?

[Drøm]

It all depends on if you can find the phpmyadmin login.
You dont really know what you're talking about do you?

Didn't you here? It was silently patched which means the creator of the "vulnerable plugin" patched it without prior notice when he noticed his plugin had a PHP vuln.

I do know what I am talking about since I read my news before coming to conclusions.

With cpanel accounts Mysql logins will always require said user to be logged onto their actual Cpanel account.

I have used Cpanel alot. And I am an ex hacker.

[Nigga From Africa]

Didn't you here? It was silently patched which means the creator of the "vulnerable plugin" patched it without prior notice when he noticed his plugin had a PHP vuln.

I do know what I am talking about since I read my news before coming to conclusions.

With cpanel accounts Mysql logins will always require said user to be logged onto their actual Cpanel account.

I have used Cpanel alot. And I am an ex hacker.

Okay no you have no idea what you're talking about.

---

Im on phone so just brief.
You use the vuln to download a config file.
Config file have database info.
If remote login is enabled just connect
If not you search for phpmyadmin login.

If you're an ex hacker i assume all you could do was use havij.

[Drøm]

Okay no you have no idea what you're talking about.

---

Im on phone so just brief.
You use the vuln to download a config file.
Config file have database info.
If remote login is enabled just connect
If not you search for phpmyadmin login.

If you're an ex hacker i assume all you could do was use havij.

Only skids use Havij you being the skid

Remote SQL would only be available if you have acccess to the remote session which you wouldn't

You are horrible with knowledge on "SQL and hacking".

You are speaking nonsense now.

[Nigga From Africa]

Only skids use Havij you being the skid

Remote SQL would only be available if you have acccess to the remote session which you wouldn't

You are horrible with knowledge on "SQL and hacking".

You are speaking nonsense now.

Holy shit im fucking laughing.
Why dont you fucking try this yourself?