WordPress Download Manager Remote Code Execution Vulnerability (Add WP Admin)

    ___ ___               __
   |   Y   .-----.----.--|  .-----.----.-----.-----.-----.
   |.  |   |  _  |   _|  _  |  _  |   _|  -__|__ --|__ --|
   |. / \  |_____|__| |_____|   __|__| |_____|_____|_____|
   |:      |    ______      |__|              __                __
   |::.|:. |   |   _  \ .-----.--.--.--.-----|  .-----.---.-.--|  |
   `--- ---'   |.  |   \|  _  |  |  |  |     |  |  _  |  _  |  _  |
               |.  |    |_____|________|__|__|__|_____|___._|_____|
               |:  1    /   ___ ___
               |::.. . /   |   Y   .---.-.-----.---.-.-----.-----.----.
               `------'    |.      |  _  |     |  _  |  _  |  -__|   _|
                           |. \_/  |___._|__|__|___._|___  |_____|__|
                           |:  |   |                 |_____|
                           |::.|:. |
                           `--- ---'
                                                   WordPress Download Manager
                                                      R3m0t3 C0d3 Ex3cut10n
                                                         (Add WP Admin)
                                                          v2.7.0-2.7.4

                                 Written by:
                             Test On Kali Linux    
                                 rizaldifox
                      https://www.facebook.com/rizaldi0

[+] Tryng to connect to: http://localhost/wordpress
[!] Account Added
[!] Location: http://localhost/wordpress/wp-login.php
[!] Username: r7Uo4v
[!] Password: YN1G1F

Google Dork

index of "download-manager"

Download

wpsymposium.py

Exploit Usage

root@fireworm:~# python wp_download_manager_274_add_admin.py -t http[s]://localhost[:PORT]

yang gak ngerti PM :) 

Newer Post Older Post