Omega - From Wordpress admin to pty

Related tags

Security related resourceslinuxshellwordpresstoolhackingttyptycybersecuritypwnpwntoolshacktoberfestkali
Overview

GitHub GitHub

Omega - From Wordpress admin to pty

The Linux tool to automate the process of getting a pty once you got admin credentials in a Wordpress site. Keep in mind that right now Omega only can attack Linux hosts.

Omega getting a pty to a Wordpress host

How does it work?

First, Omega gets an admin session in the Wordpress site and using web scrapping, it extracts the current template used by wordpress. After that, it will use the template editor to inject a simple web shell.

Once everything is set up, Omega will spin up a listenner, execute a reverse shell using the web shell injected and wait for the shell to connect back. Before giving the control to the user, Omega will try to stabilize the shell and get a pty.

If stabilization is not possible using the methods Omega has, a non tty shell will be provided that can be stabilize without problems using any method you want.

Requirements

You need Python 3 installed in your system and also some dependencies that can be installed executing (Keep in mind that this tool only works in Linux):

pip3 install -r requirements.txt

You can use a virtual env to install the dependencies or intall them system wide.

Usage

If you have all the requirements you can start playing with Omega! You can add the repository folder to your PATH and execute the tool everywhere.

Omega - From Wordpress admin to pty

usage: omega.py [-h] [-v] [--no-pty] -u WP_URL -l USERNAME -p PASSWORD -H LHOST [-P LPORT]

Provides a reverse shell (stabilized if possible) to a Wordpress host. You need admin credentials!

optional arguments:
  -h, --help            show this help message and exit
  -v, --version         show program's version number and exit
  --no-pty              if this flag is set, no shell stabilization is perform
  -u WP_URL, --wp-url WP_URL
                        the target Wordpress url
  -l USERNAME, --username USERNAME
                        Wordpress admin user to use for login
  -p PASSWORD, --password PASSWORD
                        Wordpress admin password to use for login
  -H LHOST, --lhost LHOST
                        the ip where the reverse shell should connect to
  -P LPORT, --lport LPORT
                        the port used to listen for the reverse shell (Default: 8080)
You might also like...
The Django Leaflet Admin List package provides an admin list view featured by the map and bounding box filter for the geo-based data of the GeoDjango.
The Django Leaflet Admin List package provides an admin list view featured by the map and bounding box filter for the geo-based data of the GeoDjango.

The Django Leaflet Admin List package provides an admin list view featured by the map and bounding box filter for the geo-based data of the GeoDjango. It requires a django-leaflet package.

Vsevolod Novikov 33 Nov 11, 2022
Django Admin Two-Factor Authentication, allows you to login django admin with google authenticator.
Django Admin Two-Factor Authentication, allows you to login django admin with google authenticator.

Django Admin Two-Factor Authentication Django Admin Two-Factor Authentication, allows you to login django admin with google authenticator. Why Django

Iman Karimi 9 Dec 7, 2022
aiohttp admin is generator for admin interface based on aiohttp
aiohttp admin is generator for admin interface based on aiohttp

aiohttp admin is generator for admin interface based on aiohttp

Mykhailo Havelia 17 Nov 16, 2022
WordPress models and views for Django.

django-wordpress Models and views for reading a WordPress database. Compatible with WordPress version 3.5+. django-wordpress is a project of ISL and t

Jeremy Carbaugh 332 Dec 24, 2022
BuddyPress is an open source WordPress plugin to build a community site. In releases of BuddyPress from 5.0.0 before 7.2.1 it's possible for a non-privileged, regular user to obtain administrator rights by exploiting an issue in the REST API members endpoint. The vulnerability has been fixed in BuddyPress 7.2.1. Existing installations of the plugin should be updated to this version to mitigate the issue.
BuddyPress is an open source WordPress plugin to build a community site. In releases of BuddyPress from 5.0.0 before 7.2.1 it's possible for a non-privileged, regular user to obtain administrator rights by exploiting an issue in the REST API members endpoint. The vulnerability has been fixed in BuddyPress 7.2.1. Existing installations of the plugin should be updated to this version to mitigate the issue.

CVE-2021-21389 BuddyPress 7.2.1 - REST API Privilege Escalation to RCE PoC (Full) Affected version: 5.0.0 to 7.2.0 User requirement: Subscriber user

KIEN HOANG 17 Nov 9, 2022
Sail is a free CLI tool to deploy, manage and scale WordPress applications in the DigitalOcean cloud.

Deploy WordPress to DigitalOcean with Sail Sail is a free CLI tool to deploy, manage and scale WordPress applications in the DigitalOcean cloud. Conte

Konstantin Kovshenin 159 Dec 12, 2022
WordPress look and feel for Django administration panel
WordPress look and feel for Django administration panel

Django WP Admin WordPress look and feel for Django administration panel. Features WordPress look and feel New styles for selector, calendar and timepi

Maciej Marczewski 266 Nov 21, 2022
Manage your WordPress installation directly from SublimeText SideBar and Command Palette.
Manage your WordPress installation directly from SublimeText SideBar and Command Palette.

WordpressPluginManager Manage your WordPress installation directly from SublimeText SideBar and Command Palette. Installation Dependencies You will ne

Art-i desenvolvimento 1 Dec 14, 2021
WordPress-style shortcodes for Python

Python Shortcodes WordPress-style shortcodes for Python Create and use WordPress-style shortcodes in your Python based app. Example # static output de

Bob 1 Dec 22, 2021
Modern responsive template for the Django admin interface with improved functionality. We are proud to announce completely new Jet. Please check out Live Demo
Modern responsive template for the Django admin interface with improved functionality. We are proud to announce completely new Jet. Please check out Live Demo

Django JET Modern template for Django admin interface with improved functionality Attention! NEW JET We are proud to announce completely new Jet. Plea

Geex Arts 3.4k Dec 29, 2022
Drop-in replacement of Django admin comes with lots of goodies, fully extensible with plugin support, pretty UI based on Twitter Bootstrap.
Drop-in replacement of Django admin comes with lots of goodies, fully extensible with plugin support, pretty UI based on Twitter Bootstrap.

Xadmin Drop-in replacement of Django admin comes with lots of goodies, fully extensible with plugin support, pretty UI based on Twitter Bootstrap. Liv

差沙 4.7k Dec 31, 2022
Real-time monitor and web admin for Celery distributed task queue

Flower Flower is a web based tool for monitoring and administrating Celery clusters. Features Real-time monitoring using Celery Events Task progress a

Mher Movsisyan 5.5k Dec 28, 2022
A jazzy skin for the Django Admin-Interface (official repository).

Django Grappelli A jazzy skin for the Django admin interface. Grappelli is a grid-based alternative/extension to the Django administration interface.

Patrick Kranzlmueller 3.4k Dec 31, 2022
A Django admin theme using Twitter Bootstrap. It doesn't need any kind of modification on your side, just add it to the installed apps.
A Django admin theme using Twitter Bootstrap. It doesn't need any kind of modification on your side, just add it to the installed apps.

django-admin-bootstrapped A Django admin theme using Bootstrap. It doesn't need any kind of modification on your side, just add it to the installed ap

null 1.6k Dec 28, 2022
django's default admin interface made customizable. popup windows replaced by modals. :mage: :zap:
django's default admin interface made customizable. popup windows replaced by modals. :mage: :zap:

django-admin-interface django-admin-interface is a modern responsive flat admin interface customizable by the admin itself. Features Beautiful default

Fabio Caccamo 1.3k Dec 31, 2022
Extendable, adaptable rewrite of django.contrib.admin
Extendable, adaptable rewrite of django.contrib.admin

django-admin2 One of the most useful parts of django.contrib.admin is the ability to configure various views that touch and alter data. django-admin2

Jazzband 1.2k Dec 29, 2022
FastAPI Admin Dashboard based on FastAPI and Tortoise ORM.
FastAPI Admin Dashboard based on FastAPI and Tortoise ORM.

FastAPI ADMIN 中文文档 Introduction FastAPI-Admin is a admin dashboard based on fastapi and tortoise-orm. FastAPI-Admin provide crud feature out-of-the-bo

long2ice 1.6k Jan 2, 2023
Modern theme for Django admin interface
Modern theme for Django admin interface

Django Suit Modern theme for Django admin interface. Django Suit is alternative theme/skin/extension for Django administration interface. Project home

Kaspars Sprogis 2.2k Dec 29, 2022
Django application and library for importing and exporting data with admin integration.
Django application and library for importing and exporting data with admin integration.

django-import-export django-import-export is a Django application and library for importing and exporting data with included admin integration. Featur

null 2.6k Dec 26, 2022
Comments
  • Feature: Windows hosts compatibility

    Feature: Windows hosts compatibility

    Description

    • Add Windows hosts compatibility! (Thanks to ivan-sincek for his PHP reverse shell)
    • Improve the README a bit
    • Added the use of random user agents in every run
    enhancement 
    opened by anthares101 0
  • Feature: Auto shell stabilization

    Feature: Auto shell stabilization

    Description

    • Added auto shell stabilization! Omega will try some methods to get a pty and upgrade the obtained shell
    • Added new flag to let the user decide if shell stabilization should be perform
    • Dropped Windows support to be able to use termios for tty configuration
    • Added tests (better late than never you know)
    enhancement 
    opened by anthares101 0
Releases(v2.6)

  • v2.6(Jan 3, 2022)

    Features

    • Now the Linux and MacOS reverse shell stabilization should work as expected

    Known issues

    • Upgrading the shell manually and then exit makes the terminal unresponsive. A workaround to this is to add ; exit to the code used to get a pty. This way, the Omega handler will take care of restoring your terminal
    • If the current Wordpress template doesn't have a 404 php file Omega is not able to inject the payload
    Source code(tar.gz)
    Source code(zip)

  • v2.5(Aug 1, 2021)

    Features

    • Updated the repository structure
    • Omega available throught Pypi!

    Known issues

    • Upgrading the shell manually and then exit makes the terminal unresponsive. A workaround to this is to add ; exit to the code used to get a pty. This way, the Omega handler will take care of restoring your terminal
    Source code(tar.gz)
    Source code(zip)

  • v2.4(Jul 31, 2021)

    Fixes

    • Changed Windows shell code to avoid the shell closing issue (#6)

    Known issues

    • Upgrading the shell manually and then exit makes the terminal unresponsive. A workaround to this is to add ; exit to the code used to get a pty. This way, the Omega handler will take care of restoring your terminal
    Source code(tar.gz)
    Source code(zip)

  • v2.3(Jul 31, 2021)

    Fixes

    • Shell output after upgrade wasn't always cleared (#5)
    • A README typo

    Known issues

    • Upgrading the shell manually and then exit makes the terminal unresponsive. A workaround to this is to add ; exit to the code used to get a pty. This way, the Omega handler will take care of restoring your terminal
    • Windows shells are not closed smoothly.
    Source code(tar.gz)
    Source code(zip)

  • v2.2(Jul 31, 2021)

    Fixes

    • The code that checked if a reverse shell was updated to work properly (#4)

    Known issues

    • Upgrading the shell manually and then exit makes the terminal unresponsive. A workaround to this is to add ; exit to the code used to get a pty. This way, the Omega handler will take care of restoring your terminal
    • Windows shells are not closed smoothly.
    Source code(tar.gz)
    Source code(zip)

  • v2.1(Jul 29, 2021)

    Features

    • Added Windows hosts compatibility! Omega is able to get a shell even with in Windows hosts now (#3). Thanks to ivan-sincek for his PHP reverse shell.
    • Added the use of random user agents in every run

    Known issues

    • Upgrading the shell manually and then exit makes the terminal unresponsive. A workaround to this is to add ; exit to the code used to get a pty. This way, the Omega handler will take care of restoring your terminal
    • Windows shells are not closed smoothly.
    Source code(tar.gz)
    Source code(zip)

  • v2.0(Jul 16, 2021)

    Features

    • Added auto shell stabilization! Omega will try some methods to get a pty and upgrade the obtained shell (#2)
    • Added new flag to let the user decide if shell stabilization should be perform (#2)
    • Dropped Windows support to be able to use termios for tty configuration (#2)
    • Added tests (better late than never you know) (#2)

    Known issues

    • Upgrading the shell manually and then exit makes the terminal unresponsive. A workaround to this is to add ; exit to the code used to get a pty. This way, the Omega handler will take care of restoring your terminal
    Source code(tar.gz)
    Source code(zip)

  • v1.2(Jul 16, 2021)

    Features

    • Added a version flag to check the tool version in use (#1)

    Known issues

    • Upgrading the shell and then exits makes the terminal unresponsive
    Source code(tar.gz)
    Source code(zip)

  • v1.1(Jul 13, 2021)

    Fixes

    • If the site doesn't have xmlrpc open the attack fails

    Known issues

    • Upgrading the shell and then exits makes the terminal unresponsive
    Source code(tar.gz)
    Source code(zip)

  • v1.0(Jul 13, 2021)

    Features

    • Omega first version complete! (Only for Linux targets)
    • Detect if the user specified is admin throgh xmlrpc
    • Create a Wordpress session and interact with the admin site
    • Get the active theme name
    • Drop a simple web shell payload into the current theme 404 page template
    • Get and manage a reverse shell that can be upgraded

    Known issues

    • If the site doesn't have xmlrpc open the attack fails
    • Upgrading the shell and then exits makes the terminal unresponsive
    Source code(tar.gz)
    Source code(zip)
Owner
Ángel Heredia
Always learning new things
Ángel Heredia
GitHub Repository
The self-hostable proxy tunnel

TTUN Server The self-hostable proxy tunnel. Running Running: docker run -e TUNNEL_DOMAIN=Your tunnel domain -e SECURE=True if using SSL ghcr.io/to

Tom van der Lee 2 Jan 11, 2022
Python exploit code for CVE-2021-4034 (pwnkit)

Python3 code to exploit CVE-2021-4034 (PWNKIT). This was an exercise in "can I make this work in Python?", and not meant as a robust exploit. It Works

Joe Ammond 92 Dec 29, 2022
NS-Defacer: a auto html injecter, In other words It's a auto defacer to deface a lot of websites in less time

Overview NS-Defacer is a auto html injecter, In other words It's a auto defacer

NightSec 10 Nov 19, 2022
Everything I needed to understand what was going on with "Spring4Shell" - translated source materials, exploit, links to demo apps, and more.

springcore-0day-en These are all my notes from the alleged confirmed! 0day dropped on 2022-03-29. This vulnerability is commonly referred to as "Sprin

Chris Partridge 105 Nov 26, 2022
Pupy is an opensource, cross-platform (Windows, Linux, OSX, Android) remote administration and post-exploitation tool mainly written in python

Pupy Installation Installation instructions are on the wiki, in addition to all other documentation. For maximum compatibility, it is recommended to u

7.4k Jan 04, 2023
Valeria stealer- - (4Feb 2022) program detects wifi saved passwords in your ROM

Valeria_stealer- Requirements : python 3.9.2 and higher (4Feb 2022) program dete

Mikhail Yolkin 3 May 05, 2022
An automated, reliable scanner for the Log4Shell (CVE-2021-44228) vulnerability.

Log4JHunt An automated, reliable scanner for the Log4Shell CVE-2021-44228 vulnerability. Video demo: Usage Here the help usage: $ python3 log4jhunt.py

RedHunt Labs 39 Nov 21, 2022
Port scanner tool with easy installation

ort scanner tool with easy installation! Python programming language is used and The text in the program is Georgian 3

2 Mar 24, 2022
Dark-Fb No Login 100% safe

Dark-Fb No Login 100% safe TERMUX • pkg install python2 && git -y • pip2 install requests mechanize tqdm • git clone https://github.com/BOT-033/Sensei

Bukan Hamkel 1 Dec 04, 2021
The probability of having the password you want in the PassMaker is +90%!!

PasswordMaker Strong listing password Introduction The probability of having the password you want in the tool is +90%!! How to Install Open the termi

MasterBurnt 4 Sep 05, 2021
OpenTOTP is yet another time-based, one-time passwords (OTPs) generator/verifier inspired by RFC 6238.

OpenTOTP is yet another time-based, one-time passwords (OTPs) generator/verifier inspired by RFC 6238. It generates and validates OTPs based

1 Nov 15, 2021
FTP-Exploits is a tool made in python that contains 4 diffrent types of ftp exploits that can be used in Penetration Testing.

FTP-exploits FTP-exploits is a tool which is used for Penetration Testing that can run many kinds of exploits on port 21(FTP) Commands and Exploits Ex

1 Dec 26, 2021
Python implementation for CVE-2021-42278 (Active Directory Privilege Escalation)

Pachine Python implementation for CVE-2021-42278 (Active Directory Privilege Escalation). Installtion $ pip3 install impacket Usage Impacket v0.9.23 -

Oliver Lyak 250 Dec 31, 2022
Open-source keylogger write in python

Python open-source keylogger Language Python open-source keylogger using pynput module Using Install dependences in archive setup.py or install.sh in

Dio brando 4 Jan 15, 2022
威胁情报播报

Threat-Broadcast 威胁情报播报 运行环境 项目介绍 从以下公开的威胁情报来源爬取并整合最新信息： 360：https://cert.360.cn/warning 奇安信：https://ti.qianxin.com/advisory/ 红后：https://redqueen.tj-u

东方有鱼名为咸 148 Nov 09, 2022
CVE-2021-45232-RCE-多线程批量漏洞检测

CVE-2021-45232-RCE CVE-2021-45232-RCE-多线程批量漏洞检测 FOFA 查询 title="Apache APISIX Das

孤桜懶契 36 Sep 21, 2022
Searches for potentially vulnerable websites to local file inclusion, throughout the web and then exploits them for LFI

LFI-Hunter Searches for potentially vulnerable websites to local file inclusion, throughout the web and then exploits them for LFI A script written in

Anukul Pandey 6 Jan 30, 2022
A burp-suite plugin that extract all parameter names from in-scope requests

ParamsExtractor A burp-suite plugin that extract all parameters name from in-scope requests. You can run the plugin while you are working on the targe

29 Nov 09, 2022
SEBUAH TOOLS TERMUX CRACK AKUN FF HOMKI AKUN EPEP DAH SATU FOLLOW AE YA BROO AWOKWOK

print " INSTALL TOOLS " $ pkg update && upgrade $ pkg install python2 $ pkg install git $ pip2 install lolcat $ pip2 install bs4 $ pip2 install reques

Jeeck 2 Nov 29, 2021
NExfil is an OSINT tool written in python for finding profiles by username.

NExfil is an OSINT tool written in python for finding profiles by username. The provided usernames are checked on over 350 websites within few seconds.

thewhiteh4t 1.4k Jan 01, 2023