Private Crypter - Unique Private Stubs ◆ [#1] PURE RAT v4 // BEST HVNC RAT ◆ Spoof Call and Spoof SMS set any caller ◆ ProxiesFood: Unlimited Residential Proxy ◆
Home Upgrade Search Memberlist Extras Hacker Tools Award Goals Help Wiki Contact
Hack Forums Hacks, Exploits, and Various Discussions Grayhat • Purple Team • Hybrid Security Website Hacking › Shell Via WordPress Image Uploading?

New Reply 

Shell Via WordPress Image Uploading?
focuss
focuss Offline
[user@HF:]
*
Registered
Posts:
443
Threads:
28
Credibility:
000
Popularity:
0
βytes:
β 71.2
Game XP:
0
Jun 13, 2018 06:15 PM
Is it possible to upload a shell via WordPress image upload?
I know wordpress re-creates the image which will remove any malicious code but was wondering if there was any other way?
0xB9
0xB9 Offline
[closed@HF:]
Posts:
753
Threads:
8
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
Jun 14, 2018 08:15 AM
Of course not... Unless you find a new method.
ernestmiller
ernestmiller Offline
[bin@HF:]
***
HF l33t
Posts:
672
Threads:
203
Credibility:
100
Popularity:
194
βytes:
β 0
Game XP:
0
Jun 14, 2018 08:25 AM
Unless they are running a version of Wordpress that has that known vulnerability then a big fat nope
inbox02
inbox02 Offline
[n00b@HF:]
*
Registered
Posts:
1
Threads:
0
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Jun 15, 2018 10:18 AM
THANKS YOU SO MUSH BROTER
bravetoaster
bravetoaster Offline
[user@HF:]
*
Registered
Posts:
102
Threads:
5
Credibility:
000
Popularity:
9
βytes:
β 0
Game XP:
0
Jun 17, 2018 09:59 AM
(Jun 13, 2018 06:15 PM)focuss Wrote:  Is it possible to upload a shell via WordPress image upload?
I know wordpress re-creates the image which will remove any malicious code but was wondering if there was any other way?

I actually poked around playing with bad input a few months back. I was contracted for some web dev work and they INSISTED on using WP. Was kinda on a spiteful quest to show how garbage it is. So I'm interested in any additional answers to this topic, as I was unable to find any submission methods that dont in some way validate or sanitize input.
CryptoLs
CryptoLs Offline
[n00b@HF:]
*
Registered
Posts:
35
Threads:
1
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Jun 27, 2018 07:32 PM
As long as the WordPress is up to date you can't upload a shell via the uploads folder, try using a tool such as wpscan and you might be able to find outdated add-ons or ways to brute Force the login with say open xmlrpc
Next Oldest | Next Newest
New Reply 


Possibly Related Threads...
Thread / Author Replies Views Last Post
by aNeekMay 3, 2020 01:37 PM 2 151 May 3, 2020 01:37 PM
Last Post: aNeek
by keyvansfxJun 5, 2019 06:38 AM 0 147 Jun 5, 2019 06:38 AM
Last Post: keyvansfx
by ｍＯｂｉＩｅFeb 16, 2018 07:10 AM 34 7,571 Feb 16, 2018 07:10 AM
Last Post: kamera