You are here: Home » Hacking Tutorial » WordPress Hacking Tutorials to Add Administrator User Secretly

WordPress Hacking Tutorials to Add Administrator User Secretly

Posted by v4L in Hacking Tutorial | 3 comments

Today we will learn about WordPress Hacking Tutorials to Add Administrator User Secretly. Do not think too complex about this tutorial, because we will learn this with approach to social engineering technique.

What is wordpress? according to Wikipedia:

WordPress is a free and open source blogging tool and a content management system (CMS) based on PHP and MySQL which runs on a Web hosting service. Features include a plug-in architecture and a template system. WordPress is used by over 14.7% of Alexa Internet's "top 1 million" websites, and as of August 2011 manages 22% of all new websites. WordPress is currently the most popular blogging system in use on the Web, powering over 60 million websites worldwide.

and this is the definition about Social Engineering:

Social engineering, in the context of information security, is understood to mean the art of manipulating people into performing actions or divulging confidential information. This is a type of confidence trick for the purpose of information gathering, fraud, or gaining computer system access. It differs from traditional cons in that often the attack is a mere step in a more complex fraud scheme.

A few days back I got a premium wordpress themes from one of my friends, this themes was downloaded from warez website. Doesn't mean I suspected the warez website to spread the malicious code (even mostly you will find it 😛 ), because there's still many good guy there, but it is good if you examine first all the code that you will use in your website.

Today we will learn about the technique how to inject a wordpress theme with a backdoor inserted on the source code. This tutorial is for learning purpose only, at the end of this tutorial we also will learn about the conclusion how to detect and remove the backdoor in your wordpress themes.

Requirements:

1. Understand PHP.

2. Know wordpress codex.

3. Get a free wordpress themes (I use this one http://wordpress.org/themes/download/attitude.1.2.1.zip in this tutorial)

Step by Step WordPress Hacking Tutorials to Add Administrator User Secretly:

1. I've already download my wordpress themes (I use the free one from the link above). This is the file content preview

Wordpress Hacking Tutorials to Add Administrator User Secretly

2. Usually the file that always called by wordpress is the function.php file. This is the preview of the function.php.(/attitude/library/functions/functions.php)

Wordpress Hacking Tutorials to Add Administrator User Secretly

3. We've already have a small script to be inserted in this functions.php file. You can download the script below(only for subscribers).

Download

Wordpress Hacking Tutorials to Add Administrator User Secretly

4. We can trigger the add user function by sending the v4l parameter with value ok through GET method.

e.g: http://website-target.com/hacking/?v4l=ok

5. The information for username and password for this tutorial are:

username : hackingtutorial
password : 12345

you can change this username and password by your own

The step by step WordPress Hacking Tutorials to Add Administrator User Secretly you can view on the video below:

Conclusion:

1. Download the wordpress themes only from the trusted source.

2. Buy was better than "free download" 😀

3. Usually this kind of attack you can find on a premium wordpress themes(nulled edition or warez), make sure you check one by one the themes code to prevent the attack.

you can give a try to find the strings below in your themes code (especially the nulled and warez edition) to check whether it has a malicious code or not.