xmlrpc-exploitation
Fail
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONDATA_EXFILTRATIONCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill documents and provides code for a full RCE chain against target WordPress installations. This involves registering a user and utilizing the
wp.uploadFileXML-RPC method to upload a base64-encoded PHP webshell (<?php system($_GET["cmd"]); ?>), followed by execution via HTTP requests. - [DATA_EXFILTRATION]: The skill implements Server-Side Request Forgery (SSRF) techniques using the
pingback.pingmethod. It specifically targets internal resources and cloud metadata endpoints (IMDS) to extract sensitive information. It also includes a timing-based oracle script to enumerate IAM roles from the metadata service. - [COMMAND_EXECUTION]: Automated exploitation is performed through shell script loops and inline Python execution (
python3 -c). These scripts generate XML payloads dynamically and process target responses to facilitate multi-stage attacks. - [CREDENTIALS_UNSAFE]: The skill focuses on large-scale credential harvesting by exploiting the
system.multicallmethod, allowing for 1000x brute-force amplification (100-1000 authentication attempts in a single HTTP request).
Recommendations
- AI detected serious security threats
Audit Metadata