Hi guys,
I’ve been trying for a while now to get wp_admin_shell_upload working. Each time I’m running “use exploit/unix/webapp/admin/wp_admin_shell_upload” I get the “No payload configured, defaulting to php/meterpreter/reverse_tcp” message.
I tried uninstalling/reinstalling Metasploit-framework, tried to run wp_admin_shell_upload as a new module, but nothing is working…
Anyone managed to get passed it ?
Thanks 
!
Have you tried running the module itself after setting the parameters? (RHOST, USERNAME, PASSWORD, TARGETURI, LHOST?)
The “No payload configured, defaulting to php/meterpreter/reverse_tcp” occurs because you have the option to use your own/different payload with the module. The module (exploit/unix/webapp/admin/wp_admin_shell_upload) is an exploit that allows you to upload a reverse shell payload into Wordpress as a plugin. Thats what the module itself exploits and you have the choice of what payload it uses. If you do not provide a payload for it to use, it will default to the php/meterpreter/reverse_tcp payload (Which is okay to do).
Set RHOSTS to the IP of the attack target, USERNAME/PASSWORD you should know, TARGETURI to /wordpress and don’t forget to set LHOST to your local IP (tun0 in “ip a” command)
Then run the module and your netcat listener should catch the reverse shell.
Please note that I may have not written the parameters exactly, (I think RHOSTS has the S at the end bu LHOST does not). If the exploit is not working, make sure to double check the spelling of the parameters with what is typed in the walk-through for the machine.
Oooooh ! That worked with the LHOST configured !
I was so focused on the “no payload” message a did not think of trying this. Thank you !
Type your comment> @Xalfy said:
Oooooh ! That worked with the LHOST configured !
I was so focused on the “no payload” message a did not think of trying this. Thank you !
Anxiety pranks XD