Cheap KYC Verifications & Openups ◆ Anvilpoint CyberOps - Hacker for Hire ◆ Traffic service & campaign optimization ◆ Spoof Call and Spoof SMS set any caller ◆
Home Upgrade Search Memberlist Extras Hacker Tools Award Goals Help Wiki Contact
Hack Forums Hacks, Exploits, and Various Discussions Grayhat • Purple Team • Hybrid Security Website Hacking › Found 'Database search and replace' on wordpress site. What next?

New Reply 

Found 'Database search and replace' on wordpress site. What next?
joever11
joever11 Offline
[n00b@HF:]
*
Registered
Posts:
97
Threads:
18
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Jul 31, 2014 05:22 AM
So I was scanning a wordpress website using WPScan in Kali Linux.
I found out that they replaced their databases recently and they didn't uninstall the script.
I found a url to this script:
https://interconnectit.com/products/sear...databases/

The url is:
website.com/searchreplacedb2.php

I saw you can edit the database with it easely. Now I don't want to make fast decissions and I want to know what to do next, should I somehow find out what the current databases contain first or should I make one and change it directly?
Hope some people can help me :D
gizmodo
gizmodo Offline
[bin@HF:]
*
Registered
Posts:
1,706
Threads:
83
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Jul 31, 2014 06:34 AM
(Jul 31, 2014 05:22 AM)joever11 Wrote:  So I was scanning a wordpress website using WPScan in Kali Linux.
I found out that they replaced their databases recently and they didn't uninstall the script.
I found a url to this script:
https://interconnectit.com/products/sear...databases/

The url is:
website.com/searchreplacedb2.php

I saw you can edit the database with it easely. Now I don't want to make fast decissions and I want to know what to do next, should I somehow find out what the current databases contain first or should I make one and change it directly?
Hope some people can help me :D

Maybe you can try and use this exploit http://pastebin.com/2557GJrh
joever11
joever11 Offline
[n00b@HF:]
*
Registered
Posts:
97
Threads:
18
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Jul 31, 2014 07:52 AM
(Jul 31, 2014 06:34 AM)gizmodo Wrote:  Maybe you can try and use this exploit http://pastebin.com/2557GJrh

I'm in the wordpress admin panel at the moment. But there is one big problem: I can't upload shell's as read only is enabled and when I want to upload a plugin I need to enter ftp details which I don't have...
Is there a way to bypass this?
I have tried editing plugins/theme, none worked
asm-99
asm-99 Offline
[user@HF:]
*
Registered
Posts:
357
Threads:
28
Credibility:
100
Popularity:
0
βytes:
β 0
Game XP:
0
Jul 31, 2014 03:11 PM
^ try login to the ftp using the information you got from the DB
TheWholeWorldExplodes
Guest
 
Jul 31, 2014 03:15 PM
(Jul 31, 2014 07:52 AM)joever11 Wrote:  I'm in the wordpress admin panel at the moment. But there is one big problem: I can't upload shell's as read only is enabled and when I want to upload a plugin I need to enter ftp details which I don't have...
Is there a way to bypass this?
I have tried editing plugins/theme, none worked

have you tried editing themes to injecct a shell there?
joever11
joever11 Offline
[n00b@HF:]
*
Registered
Posts:
97
Threads:
18
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Aug 1, 2014 02:20 AM
(Jul 31, 2014 03:15 PM)TheWholeWorldExplodes Wrote:  have you tried editing themes to injecct a shell there?

Yes, I can't edit them because Read-Only is enabled on the ftp, which I don't have access to.
yassinemks
yassinemks Offline
[n00b@HF:]
*
Registered
Posts:
6
Threads:
4
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Jul 23, 2015 02:52 PM
please i have get a user and pasword of database how i can connect to database
dalekdj
dalekdj Offline
[closed@HF:]
Posts:
1
Threads:
0
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
Aug 21, 2015 08:51 AM
Hi to all,i'm new.
how is possible to use the exploit ?
sun215
sun215 Offline
[n00b@HF:]
*
Registered
Posts:
32
Threads:
14
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Mar 2, 2017 03:57 AM (This post was last modified: Mar 2, 2017 03:58 AM by sun215.)
Hello, i have the same problem, am i able to watch content of database with this script? I've alredy tried to use exploit above, it shows database, and that's it. Currently mysql port is close, so this script is my last hope. Any suggestions. Thanks.
Maybe i can somehow add new user, or just see current database.
Next Oldest | Next Newest
New Reply 


Possibly Related Threads...
Thread / Author Replies Views Last Post
by Q00Jan 22, 2025 01:39 AM 12 1,398 Jan 22, 2025 01:39 AM
Last Post: Bastille
by XoraxJun 6, 2024 02:36 AM 2 153 Jun 6, 2024 02:36 AM
Last Post: Xorax
by kamis086Aug 2, 2023 04:15 PM 15 837 Aug 2, 2023 04:15 PM
Last Post: Lndomie1