How icex0/wp2shell-poc works
wp2shell is a command-line proof of concept for detecting and exercising WordPress REST batch route-confusion SQL injection. The principal workflow starts with a target URL: check gathers passive WordPress/version signals and probes the batch endpoint; read selects a UNION, error-based, or blind SQLi extractor; and unauthenticated shell can bridge from UNION fake posts through oEmbed cache IDs and a poisoned batch to a generated administrator, then authenticate and upload a temporary plugin webshell. The graph reflects documented flows and sampled calls; exploit internals are only partly sampled.
Main entry points: cli.py Command interface · client.py Batch transport · exploit.py Admin bridge · shell.py Admin session
Components 17
CLI workflows
- Command interface
wp2shell/cli.py - Extracted data
Detection and SQLi
- WP fingerprints
wp2shell/version.py - Batch transport
wp2shell/client.py - Blind SQLi
wp2shell/sqli.py - Error SQLi
wp2shell/sqli.py - UNION SQLi
wp2shell/sqli.py
Admin bridge
- Admin bridge
wp2shell/exploit.py - Fake post render
wp2shell/exploit.py - oEmbed cache IDs
wp2shell/exploit.py - Poisoned batch
wp2shell/exploit.py - Generated administrator
wp2shell/exploit.py
Authenticated execution
- Admin session
wp2shell/shell.py - Plugin webshell
wp2shell/shell.py - Command output
wp2shell/shell.py
Other components
- Operator
- WordPress target
Connections 27
- Operator → Command interface: runs
- Command interface → WP fingerprints: checks markers
- Command interface → Batch transport: probes batch
- WP fingerprints → Batch transport: fetches public data
- Batch transport → WordPress target: sends HTTP
- WordPress target → Batch transport: returns responses
- Command interface → Blind SQLi: confirms timing
- Command interface → UNION SQLi: tries extraction
- Command interface → Error SQLi: selects extractor
- Blind SQLi → Batch transport: sends probes
- Error SQLi → Batch transport: sends payloads
- UNION SQLi → Batch transport: sends payloads
- Command interface → Extracted data: prints extraction
- Command interface → Admin bridge: starts bridge
- Admin bridge → UNION SQLi: extracts database values
- Admin bridge → Fake post render: renders UNION posts
- Fake post render → WordPress target: triggers oEmbed
- Admin bridge → oEmbed cache IDs: recovers IDs via SQLi
- Admin bridge → Poisoned batch: builds request
- Poisoned batch → WordPress target: submits batch
- WordPress target → Generated administrator: creates account
- Command interface → Admin session: logs in
- Generated administrator → Admin session: supplies credentials
- Admin session → WordPress target: authenticates
- Admin session → Plugin webshell: uploads plugin
- Plugin webshell → WordPress target: executes commands
- Plugin webshell → Command output: returns output