Upload Shell To Wordpress

 Posted admin

Join GitHub today

Website directory) through system, and our shell will be created.If don’t work,try exec because system can be disabled on the webserver from php.ini. 5 – Access our shell – Now lets check if our malicous code was successfully injected.Lets check if the shell is present.

GitHub is home to over 36 million developers working together to host and review code, manage projects, and build software together.

Sign up

Upload Wordpress Theme

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Comments

commented Oct 20, 2018•
edited by wvu-r7

I am running the Mr.Robot CTF and when I try to use the wp_admin_shell_upload.rb
the module says that the site is not running wp.

PS. the ctf is running on a VMware

Steps to reproduce

use metasploit-framework/modules/exploits/unix/webapp/wp_admin_shell_upload.rb
set requested data (see below)

Expected behavior

What should happen?
create a shell

Current behavior

What happens instead?
it says the target is not using wp
You might also want to check the last ~1k lines of
/opt/metasploit/apps/pro/engine/config/logs/framework.log or
~/.msf4/logs/framework.log for relevant stack traces

System stuff

Metasploit version

msf exploit(unix/webapp/wp_admin_shell_upload) > version
Framework: 4.17.18-dev
Console : 4.17.18-dev

I installed Metasploit with:

  • Kali package via apt

OS

What OS are you running Metasploit on?

KALI BABY WOOOOO

Linux kali 4.18.0-kali1-amd64 #1 SMP Debian 4.18.6-1kali1 (2018-09-10) x86_64 GNU/Linux

commented Oct 20, 2018

Shell

You can disable the WordPress check with: set WPCHECK false

commented Oct 20, 2018•
edited

Your TARGETURI of wp-login.php is incorrect. It should be / or other. The filename is added by the API.

And please don't post spoilers.

changed the title BROKEN MODULE: metasploit-framework/modules/exploits/unix/webapp/wp_admin_shell_upload.rbOct 20, 2018

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment