mirror of
https://github.com/carlospolop/hacktricks
synced 2024-11-26 22:52:06 +00:00
Translated ['network-services-pentesting/pentesting-web/wordpress.md'] t
This commit is contained in:
Translator
parent
524ad5eeac
commit
584340946e
1 changed files with 33 additions and 55 deletions
|
|
@ -54,7 +54,7 @@
|
|||
* **管理员**
|
||||
* **编辑**：发布和管理自己和其他人的帖子
|
||||
* **作者**：发布和管理自己的帖子
|
||||
* **贡献者**：编写和管理自己的帖子，但不能发布
|
||||
* **投稿者**：撰写和管理自己的帖子，但不能发布
|
||||
* **订阅者**：浏览帖子并编辑自己的个人资料
|
||||
|
||||
## **被动枚举**
|
||||
|
|
@ -69,65 +69,43 @@
|
|||
```bash
|
||||
curl https://victim.com/ | grep 'content="WordPress'
|
||||
```
|
||||
### 获取插件
|
||||
* `meta name`
|
||||
|
||||
To get the plugins, you can follow these steps:
|
||||
.png>)
|
||||
|
||||
1. Access the WordPress admin dashboard.
|
||||
2. Go to the "Plugins" section.
|
||||
3. Click on the "Add New" button.
|
||||
4. Search for the desired plugin using the search bar.
|
||||
5. Once you find the plugin, click on the "Install Now" button.
|
||||
6. After the installation is complete, click on the "Activate" button to activate the plugin.
|
||||
* CSS link files
|
||||
|
||||
.png>)
|
||||
|
||||
* JavaScript files
|
||||
|
||||
.png>)
|
||||
|
||||
### 获取插件
|
||||
|
||||
要获取插件，您可以按照以下步骤进行操作：
|
||||
|
||||
1. 访问WordPress管理后台。
|
||||
2. 进入“插件”部分。
|
||||
3. 点击“添加新插件”按钮。
|
||||
4. 使用搜索栏搜索所需的插件。
|
||||
5. 找到插件后，点击“立即安装”按钮。
|
||||
6. 安装完成后，点击“激活”按钮以激活插件。
|
||||
{% code overflow="wrap" %}
|
||||
```bash
|
||||
curl -s -X GET https://wordpress.org/support/article/pages/ | grep -E 'wp-content/plugins/' | sed -E 's,href=|src=,THIIIIS,g' | awk -F "THIIIIS" '{print $2}' | cut -d "'" -f2
|
||||
curl -H 'Cache-Control: no-cache, no-store' -L -ik -s https://wordpress.org/support/article/pages/ | grep -E 'wp-content/plugins/' | sed -E 's,href=|src=,THIIIIS,g' | awk -F "THIIIIS" '{print $2}' | cut -d "'" -f2
|
||||
```
|
||||
To get themes for your WordPress website, you can follow these steps:
|
||||
### 获取主题
|
||||
|
||||
1. Go to the WordPress admin dashboard.
|
||||
2. Click on "Appearance" in the left-hand menu.
|
||||
3. Select "Themes" from the dropdown menu.
|
||||
4. You will see a list of available themes. You can browse through them or use the search bar to find a specific theme.
|
||||
5. Once you find a theme you like, click on the "Preview" button to see how it will look on your website.
|
||||
6. If you are satisfied with the preview, click on the "Install" button to add the theme to your website.
|
||||
7. After the theme is installed, click on the "Activate" button to make it the active theme for your website.
|
||||
|
||||
That's it! You have successfully obtained and installed a new theme for your WordPress website.
|
||||
{% code overflow="wrap" %}
|
||||
```bash
|
||||
curl -s -X GET https://wordpress.org/support/article/pages/ | grep -E 'wp-content/themes' | sed -E 's,href=|src=,THIIIIS,g' | awk -F "THIIIIS" '{print $2}' | cut -d "'" -f2
|
||||
```
|
||||
### 提取版本信息
|
||||
### 提取一般版本
|
||||
|
||||
To extract the version of WordPress being used on a website, you can follow these steps:
|
||||
|
||||
1. **Manual Inspection**: Look for any version information displayed on the website's frontend or backend. This could be found in the footer, admin dashboard, or any other visible area.
|
||||
|
||||
2. **Page Source**: View the page source code by right-clicking on the webpage and selecting "View Page Source" or using the browser's developer tools. Search for keywords like "version" or "wp-version" to find any references to the WordPress version.
|
||||
|
||||
3. **Readme.html**: WordPress installations often include a readme.html file. Access this file by appending "/readme.html" to the website's URL (e.g., `http://example.com/readme.html`). The WordPress version may be mentioned in this file.
|
||||
|
||||
4. **Readme.txt**: Some WordPress installations have a readme.txt file in the root directory. You can access it by appending "/readme.txt" to the website's URL (e.g., `http://example.com/readme.txt`). Look for the version information in this file.
|
||||
|
||||
5. **Version Checkers**: There are online tools and plugins available that can check the WordPress version of a website by simply entering its URL. These tools can provide accurate results and save time.
|
||||
|
||||
Remember, it is important to keep your WordPress installation up to date to ensure security and prevent vulnerabilities associated with older versions.
|
||||
{% code overflow="wrap" %}
|
||||
```bash
|
||||
curl -s -X GET https://wordpress.org/support/article/pages/ | grep http | grep -E '?ver=' | sed -E 's,href=|src=,THIIIIS,g' | awk -F "THIIIIS" '{print $2}' | cut -d "'" -f2
|
||||
curl -H 'Cache-Control: no-cache, no-store' -L -ik -s https://wordpress.org/support/article/pages/ | grep http | grep -E '?ver=' | sed -E 's,href=|src=,THIIIIS,g' | awk -F "THIIIIS" '{print $2}' | cut -d "'" -f2
|
||||
|
||||
```
|
||||
{% endcode %}
|
||||
|
||||
<figure><img src="../../.gitbook/assets/image (3) (1) (1).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
使用[**Trickest**](https://trickest.com/?utm\_campaign=hacktrics\&utm\_medium=banner\&utm\_source=hacktricks)可以轻松构建和自动化由全球最先进的社区工具提供支持的工作流程。
|
||||
\
|
||||
使用[**Trickest**](https://trickest.com/?utm\_campaign=hacktrics\&utm\_medium=banner\&utm\_source=hacktricks)可以轻松构建和自动化由全球最先进的社区工具提供支持的工作流程。\
|
||||
立即获取访问权限：
|
||||
|
||||
{% embed url="https://trickest.com/?utm_campaign=hacktrics&utm_medium=banner&utm_source=hacktricks" %}
|
||||
|
|
@ -136,13 +114,13 @@ curl -s -X GET https://wordpress.org/support/article/pages/ | grep http | grep -
|
|||
|
||||
### 插件和主题
|
||||
|
||||
您可能无法找到所有可能的插件和主题。为了发现它们的全部，您需要**主动暴力破解插件和主题的列表**（幸运的是，有自动化工具包含了这些列表）。
|
||||
您可能无法找到所有可能的插件和主题。为了发现它们的全部，您需要**主动暴力破解插件和主题的列表**（幸运的是，有自动化工具包含这些列表）。
|
||||
|
||||
### 用户
|
||||
|
||||
**ID暴力破解**
|
||||
|
||||
通过暴力破解用户ID，您可以获取WordPress网站上的有效用户：
|
||||
通过暴力破解用户ID，您可以获取WordPress网站的有效用户：
|
||||
```
|
||||
curl -s -I -X GET http://blog.example.com/?author=1
|
||||
```
|
||||
|
|
@ -164,9 +142,9 @@ curl http://blog.example.com/wp-json/wp/v2/users
|
|||
|
||||
### XML-RPC
|
||||
|
||||
如果`xml-rpc.php`处于活动状态，您可以执行凭据暴力破解或使用它来发动对其他资源的DoS攻击（例如，您可以使用[这个](https://github.com/relarizky/wpxploit)来自动化此过程）。
|
||||
如果`xml-rpc.php`处于活动状态，您可以执行凭据暴力破解，或使用它来对其他资源发动DoS攻击。（例如，您可以使用[这个工具](https://github.com/relarizky/wpxploit)来自动化此过程）。
|
||||
|
||||
要查看它是否处于活动状态，请尝试访问_**/xmlrpc.php**_并发送此请求：
|
||||
要查看它是否处于活动状态，请尝试访问_**/xmlrpc.php**_并发送以下请求：
|
||||
|
||||
**检查**
|
||||
```markup
|
||||
|
|
@ -231,7 +209,7 @@ curl http://blog.example.com/wp-json/wp/v2/users
|
|||
|
||||
**绕过双因素认证**
|
||||
|
||||
此方法适用于程序而非人类，并且已经过时，因此不支持双因素认证。因此，如果您拥有有效的凭据但主入口受到双因素认证的保护，**您可能能够滥用xmlrpc.php以绕过双因素认证进行登录**。请注意，您将无法执行通过控制台可以执行的所有操作，但您可能仍然能够实现RCE，就像Ippsec在[https://www.youtube.com/watch?v=p8mIdm93mfw\&t=1130s](https://www.youtube.com/watch?v=p8mIdm93mfw\&t=1130s)中所解释的那样。
|
||||
此方法适用于程序而非人类，并且已经过时，因此不支持双因素认证。因此，如果您拥有有效的凭据但主入口受到双因素认证的保护，**您可能能够滥用xmlrpc.php以绕过双因素认证进行登录**。请注意，您将无法执行通过控制台可以执行的所有操作，但您可能仍然能够实现远程命令执行（RCE），正如Ippsec在[https://www.youtube.com/watch?v=p8mIdm93mfw\&t=1130s](https://www.youtube.com/watch?v=p8mIdm93mfw\&t=1130s)中所解释的那样。
|
||||
|
||||
**DDoS或端口扫描**
|
||||
|
||||
|
|
@ -328,8 +306,8 @@ use exploit/unix/webapp/wp_admin_shell_upload
|
|||
|
||||
### PHP插件
|
||||
|
||||
可能可以将.php文件作为插件上传。\
|
||||
例如，使用以下代码创建您的php后门：
|
||||
可能可以将.php文件上传为插件。\
|
||||
例如，使用以下命令创建您的php后门：
|
||||
|
||||
.png>)
|
||||
|
||||
|
|
@ -379,9 +357,9 @@ use exploit/unix/webapp/wp_admin_shell_upload
|
|||
|
||||
|
||||
|
||||
一切准备就绪后，开始利用。由于我们已经安装了名为“reflex-gallery”的易受攻击的插件，因此很容易进行利用。
|
||||
当一切准备就绪时，开始利用。由于我们已经安装了名为“reflex-gallery”的易受攻击的插件，因此它很容易被利用。
|
||||
|
||||
您将在Metasploit框架中找到此漏洞的利用，因此加载以下模块并执行以下命令：
|
||||
您将在Metasploit框架中找到此漏洞的利用方式，因此加载以下模块并执行以下命令：
|
||||
|
||||
执行上述命令后，您将获得meterpreter会话。正如本文所述，有多种方法可以利用WordPress平台的网站。
|
||||
|
||||
|
|
@ -435,8 +413,8 @@ add_filter( 'auto_update_theme', '__return_true' );
|
|||
|
||||
<summary><a href="https://cloud.hacktricks.xyz/pentesting-cloud/pentesting-cloud-methodology"><strong>☁️ HackTricks Cloud ☁️</strong></a> -<a href="https://twitter.com/hacktricks_live"><strong>🐦 Twitter 🐦</strong></a> - <a href="https://www.twitch.tv/hacktricks_live/schedule"><strong>🎙️ Twitch 🎙️</strong></a> - <a href="https://www.youtube.com/@hacktricks_LIVE"><strong>🎥 Youtube 🎥</strong></a></summary>
|
||||
|
||||
* 你在**网络安全公司**工作吗？想要在HackTricks中**宣传你的公司**吗？或者你想要访问**最新版本的PEASS或下载PDF格式的HackTricks**吗？请查看[**订阅计划**](https://github.com/sponsors/carlospolop)！
|
||||
* 发现我们的独家[**NFTs**](https://opensea.io/collection/the-peass-family)收藏品[**The PEASS Family**](https://opensea.io/collection/the-peass-family)
|
||||
* 你在一家**网络安全公司**工作吗？想要在HackTricks中**宣传你的公司**吗？或者你想要**获取PEASS的最新版本或下载PDF格式的HackTricks**吗？请查看[**订阅计划**](https://github.com/sponsors/carlospolop)！
|
||||
* 发现我们的独家[**NFTs**](https://opensea.io/collection/the-peass-family)收藏品——[**The PEASS Family**](https://opensea.io/collection/the-peass-family)
|
||||
* 获取[**官方PEASS和HackTricks周边产品**](https://peass.creator-spring.com)
|
||||
* **加入**[**💬**](https://emojipedia.org/speech-balloon/) [**Discord群组**](https://discord.gg/hRep4RUj7f)或[**电报群组**](https://t.me/peass)，或在**Twitter**上**关注**我[**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks\_live)**。**
|
||||
* **通过向**[**hacktricks repo**](https://github.com/carlospolop/hacktricks) **和**[**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud) **提交PR来分享你的黑客技巧。**
|
||||
|
|
|
|||
Loading…
Reference in a new issue