# Wordpress

#### User enumeration

```bash
wpscan --enumeration u --url <url>
curl -s -X GET "http://<url>/wp-json/wp/v2/users/"
```





#### RCE via edit themes

Una vez logeados en el wp-admin, nos vamos a themes->theme editor->

1. &#x20;404.php

<figure><img src="https://3633569060-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fe5JdwWVWg04LoumBdXxj%2Fuploads%2FtvdJbVoRc8N3lOT7Pl3V%2Fimage.png?alt=media&#x26;token=d3ee1506-1931-40fc-badc-42bf78a79700" alt=""><figcaption></figcaption></figure>

Y generar un 404 error modificando la url:

<figure><img src="https://3633569060-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fe5JdwWVWg04LoumBdXxj%2Fuploads%2F6WMDW4xjJIW8dnsCZkp2%2Fimage.png?alt=media&#x26;token=803aaf5e-9822-4048-9784-3789e911f62e" alt=""><figcaption></figcaption></figure>

2. Modificar el header.php

<figure><img src="https://3633569060-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fe5JdwWVWg04LoumBdXxj%2Fuploads%2FmlZpZ31oaOzLKLeHUAYv%2Fimage.png?alt=media&#x26;token=0b67c99a-37f7-4407-9799-d9ee65fa6a4c" alt=""><figcaption></figcaption></figure>



