Hands-On Web Penetration Testing with Metasploit

Exploiting the vulnerability using Metasploit

Metasploit has a built-in exploit module that deletes any arbitrary file on the server. We will use an example of the wp-config file, as we will later discuss how to use this exploit as a way to upload the shell on to the server:

1. To use the module, we run the following command in msfconsole.
2. Use auxiliary/scanner/http/wp_arbitrary_file_deletion:

As shown in the preceding screenshot, we enter the RHOST, the WordPress username and password, and the path of the config file. Before we run the exploit, let's also look at the current entries in the wp_postmeta table of our WordPress database, as shown ...