[M4STERMIND]

Hey everyone,

I'm interesed to know if there's any ready-to-use backdoor that I can use to infect a wordpress plugin so I can get full access to the victim's web server (after the victim uploads and activates the plugin).

If there isn't any public backdoor, can you recommend any tips or techniques on how to infect a WP Plugin with a backdoor?

I appreciate if you could help me with any suggestions.

Thanks alot in advance.

[linkinpork]

...
If there isn't any public backdoor, can you recommend any tips or techniques on how to infect a WP Plugin with a backdoor?
...

Hi,

Wordpress assumes 3 things:

• There's a webserver
  
• It has at least PHP 7.4
  
• It has a MySQL/MariaDB
  

Source: https://wordpress.org/about/requirements/

So basically you can like edit a plugin somewhere to include a PHP webshell (or deadass just upload the page or whatever). Plenty of PHP shells on GitHub, there's a public repository here.

Cheers!

[M4STERMIND]

Hi,

Wordpress assumes 3 things:

• There's a webserver
  
• It has at least PHP 7.4
  
• It has a MySQL/MariaDB
  

Source: https://wordpress.org/about/requirements/

So basically you can like edit a plugin somewhere to include a PHP webshell (or deadass just upload the page or whatever). Plenty of PHP shells on GitHub, there's a public repository here.

Cheers!

Thanks, I didn't know it was this easy. I thought WP had some protection for suspicious plugins.