brute force success but password doesn't work

1N3 / Wordpress-XMLRPC-Brute-Force-Exploit

Wordpress XMLRPC System Multicall Brute Force Exploit (0day) by 1N3 @ CrowdShield

https://crowdshield.com

450 stars 197 forks source link

brute force success but password doesn't work #10

Closed radupaunescu2021 closed 7 years ago

radupaunescu2021 commented 7 years ago

I run the script with username:admin and sqlmap.txt wordlist.After 10 seconds,it say bruteforce success user spawned: a/#morron.After checking the script,it seems the password is after the backslash,and the user before. But when i try to login with user:admin it doesn t work.I tried also with user :a

cluc-dev commented 7 years ago

I found that this happened to me if I just did http://someurl.com instead of http://someurl.com/xmlrpc.php. I would make sure you're not doing the same.

Using two different wordlists would give me two different "correct" passwords! Very strange.

1N3 commented 7 years ago

Hi, sorry for the delay. I agree with @ctluciani... check to make sure you're using http://target.com/xmlrpc.com when running.