Deep Dive into wp2shell: A Cross‑Platform RAT Attack Platform

Overview

Continuous monitoring uncovered an unauthenticated open directory that hosts the complete wp2shell attack platform. The platform has been active since 2026‑07‑10 and combines a WordPress core zero‑credential SQL injection exploit toolkit with a large‑scale IoT botnet targeting Ubiquiti, D‑Link and Totolink devices. The payload is Agent‑TCP , a cross‑platform Go RAT compiled for 14 CPU architectures.

Infrastructure Architecture

Transition server (port 80) – hosts the open directory containing all artifacts (binaries, stager scripts, deployment logs).

Beacon endpoint (port 8443) – receives lightweight heartbeat pings only.

RAT C2 (v9g6.my:443) – full‑duplex TLS 1.3 channel handling command execution, file upload/download, SOCKS5 proxy, and host profiling.

All Agent‑TCP binaries communicate directly with v9g6.my:443; no traffic returns to the transition server.

Agent‑TCP Binary Details

Two binaries were recovered (Linux 6.57 MB, Windows 6.81 MB) after UPX decompression. Build flags -ldflags="-s -w" strip symbols, but module paths, type strings and internal package names remain.

C2 Protocol Stack

Transport: TCP → TLS 1.3 (ECH, MLKEM)
Encapsulation: HTTP/2 (HPACK)
Encryption: ChaCha20Poly1305 AEAD (fallback AES‑GCM)
Key exchange: RSA → HKDF‑derived session keys
Payload encoding: base64
Telemetry: JSON fields (hostname, CPU info, architecture, IPs, libp2p peer ID)

Commands are identified by a uint16 opcode and dispatched via a map of uint16 to handler functions. Each frame contains a length‑prefixed header and an encoded body.

Core Findings – Binary Capabilities

GO RAT – 14 architectures : supports Linux, Windows and embedded platforms.

Fileless + Post‑Quantum Agent : uses unix.MemfdCreate for in‑memory execution on Linux and DLL injection via LoadLibraryEx and GetProcAddress on Windows. TLS stack includes MLKEM‑based post‑quantum key exchange and ChaCha20Poly1305 AEAD.

Pre‑authenticated WordPress RCE : a six‑step zero‑credential attack chain leveraging route‑confusion, UNION/Blind‑SQLi, oEmbed cache poisoning, customize_changeset conversion, pre‑auth admin creation, plugin webshell upload, and stager execution.

Root‑level compromise of Ubiquiti UniFi : automated large‑scale deployment against CVE‑2021‑36260, with four persistence methods (systemd, crontab, init.d, profile) and masquerading binaries ( .uniFi‑core, .cache‑mgr, dbusd, syslog‑ng).

Juniper SRX320 fallback execution : embedded raw shell script provides a new escalation vector to enterprise firewalls.

IFEO abuse + Argv spoofing : Windows processes hijacked via Image File Execution Options registry keys; Linux processes disguised using prctl PR_SET_NAME and argument spoofing.

SOCKS5 proxy + ConPTY shell : full network pivoting capability with interactive pseudo‑console on Windows.

Binary Capability Matrix (selected entries)

Memory‑less execution (Linux) : symbols unix.MemfdCreate, mmap, mremap, munmap – Critical

DLL injection (Windows) : symbols LoadLibraryEx, GetProcAddress – Critical

Juniper SRX320 execution : string falling back to SRX320 raw exec: %q#!/bin/sh – Critical

Post‑quantum TLS (MLKEM) : strings mlkemCiphertextSize, mlkem.encryptionKey, tlsmlkem – High

Encrypted C2 (AEAD) : strings chacha20poly1305Seal/Open, poly1305, hkdf – Critical

SOCKS5 proxy : strings handleProxyStart, handleSOCKS5 – Critical

ConPTY interactive shell (Windows) : strings CreatePseudoConsole, ResizePseudoConsole – Critical

IFEO registry hijack (Windows) : strings disguiseIFEO, Image File Execution Options\Debugger – Critical

Argv spoofing (Linux) : strings prctl PR_SET_NAME, spoofArgv – Critical

Full Attack Chains

Chain A – WordPress to RAT

Recon – wp2shell check : probe /wp-json/batch/v1 for route‑confusion markers ( parse_path_failed, block_cannot_read, rest_batch_not_allowed).

SQL injection : extract DB version, table prefix, admin ID and wp_posts name using automatic UNION/Blind‑SQLi selection.

oEmbed cache poisoning + changeset chain : inject seven crafted wp_posts rows that flow through customize_changeset → nav_menu_item → request, creating a real oEmbed cache entry.

Pre‑auth admin creation : send POST /wp/v2/users to create a wp2_<nonce> admin without credentials; the account self‑deletes after the session.

Plugin webshell upload : upload a random‑path webshell via the newly created admin, then execute wp2shell_stager.sh.

Stager execution + cleanup : the stager detects architecture ( uname -m), downloads the matching Agent‑TCP binary, installs one of six persistence methods, and removes the webshell and admin account.

Agent execution → C2 beacon : the agent runs in the background, optionally using MemfdCreate for fileless execution, and contacts v9g6.my:443 over TLS 1.3.

Chain B – IoT Large‑Scale Invasion

Target list ingestion : confirmed.json provides IP:port:arch tuples; batch_deploy_full.py runs with five concurrent threads.

CVE‑2021‑36260 exploitation : unauthenticated GET to UniFi SSO endpoint with path traversal and base64‑encoded shell payload; time‑based blind injection confirms root RCE.

SUID bash privilege escalation : sudo -n chmod 4755 /bin/bash followed by bash -p -c to obtain root, then restore original permissions.

Agent download + execution : curl the architecture‑specific binary to /usr/local/bin/.uniFi-core, start with nohup, and verify PID via time‑based inference.

Four persistence methods : systemd service ( uniFi-core.service), @reboot crontab, init.d script, and rc‑update entry; all are deployed simultaneously.

Heartbeat + RAT C2 : a 10‑minute cron beacon contacts the transition server, while the agent maintains a persistent TLS channel to v9g6.my:443.

Geographic Targeting

Taiwan (AS3462 – Chunghwa Telecom) : dedicated target list, Chinese‑language script comments, and HNAP model fingerprinting of a D‑Link DIR‑868L (firmware 1.13/1.20, unpatched since 2017).

Japan : devices observed during deployment logs.

United States : opportunistic botnet nodes observed in deployment logs.

MITRE ATT&CK Mapping (selected techniques)

T1190 – Exploit Public‑Facing Application : CVE‑2026‑63030, CVE‑2026‑60137, CVE‑2021‑36260, CVE‑2026‑34908, CVE‑2026‑1547.

T1505.003 – Web Shell : WordPress plugin upload of random‑path webshell, auto‑deleted after use.

T1059.004 – Unix Shell : all stager/dropper/persistence scripts.

T1105 – Ingress Tool Transfer : curl/wget/python3 download from transition server.

T1053.003 – Cron : @reboot and */10 * * * cron entries on all stagers.

T1543.002 – Systemd Service : cache‑mgr.service, uniFi‑core.service, S99dbusd.

T1036.005 – Masquerading : binaries named .cache‑mgr, .uniFi‑core, syslog‑ng, dbusd.

T1620 – Reflective Code Loading : Linux unix.MemfdCreate fileless execution.

T1055.001 – DLL Injection : Windows LoadLibraryEx + GetProcAddress.

T1071.001 – Web Protocol C2 : HTTP/2 + TLS 1.3, beacon to :8443/beacon.

T1573.002 – Encrypted Channel – Asymmetric : ChaCha20Poly1305 AEAD + RSA key exchange.

Detection Rules

YARA

rule AgentTCP_Packed {
    meta:
        description  = "Agent‑TCP RAT – UPX packed binary (wp2shell activity)"
        hash_linux   = "9c285fe3a491ee6a6f872ae71d47dfe29e44a40b9e7fcba85a39a2368584333a"
        hash_windows = "4ff527e0d8fc36a99a491bc69a9cabeb055a4be470e22ec3da8e8bb741be9efc"
    strings:
        $upx   = { 55 50 58 21 0D 0A 1A 0A }
        $build = "go-agent-tcp" ascii
    condition:
        (uint32(0) == 0x464C457F or uint16(0) == 0x5A4D) and $upx and $build
}

rule AgentTCP_Unpacked {
    meta:
        description = "Agent‑TCP RAT – unpacked binary or memory scan"
    strings:
        $path   = "D:/BIN_Research/Knowledge/Defense-Evasion/go-agent-tcp" ascii
        $mlkem  = "mlkemCiphertextSize" ascii
        $memexec = "handleMemExec" ascii
    condition:
        $path or ($mlkem and $memexec)
}

rule wp2shell_Stager {
    meta:
        description = "wp2shell post‑exploitation stager script"
        hash        = "8d7885a574459908cd70d3718119a31a4a6c95052e3d1548feeccfffa00d4cde"
    strings:
        $tag   = "[wp2]" ascii
        $beacon = "/beacon?host=" ascii
    condition:
        $tag and $beacon
}

Sigma

title: WordPress batch/v1 route‑confusion SQLi (CVE‑2026‑63030/wp2shell)
id: 7f3a8c20-e14b-4d92-b561-9c0d3f5e7a81
status: stable
tags: [attack.initial_access, attack.t1190]
logsource:
  category: webserver

detection:
  selection:
    cs-uri-stem|contains: '/wp-json/batch/v1'
    cs-uri-query|contains: 'author_exclude'
  condition: selection
level: critical
---
title: Agent‑TCP process masquerading (wp2shell activity)
id: 3d8b5f92-a741-4c1e-8b03-6e2d9f0c4a57
status: stable
tags: [attack.defense_evasion, attack.t1036.005]
logsource:
  category: process_creation
  product: linux

detection:
  selection:
    Image|endswith:
      - '/usr/local/bin/.cache-mgr'
      - '/usr/local/bin/.uniFi-core'
      - '/usr/local/bin/dbusd'
      - '/usr/local/bin/syslog-ng'
  condition: selection
level: high
---
title: Agent‑TCP IFEO debugger hijack (Windows)
id: 5a1c7e83-2b94-4f60-9d12-8c3e0b5f7a24
status: stable
tags: [attack.defense_evasion, attack.t1546.012]
logsource:
  category: registry_set
  product: windows

detection:
  selection:
    TargetObject|contains: '\Image File Execution Options\'
    TargetObject|endswith: '\Debugger'
    Details|contains: 'agent_windows_amd64'
  condition: selection
level: high

Indicators of Compromise

Domain : v9g6.my (active RAT C2)

IP addresses : 202.61.136.40 (RAT C2 resolver) and 43.161.245.209 (auxiliary C2)

Agent binaries : SHA‑256 hashes for each architecture (e.g., Linux x86‑64

9c285fe3a491ee6a6f872ae71d47dfe29e44a40b9e7fcba85a39a2368584333a

, Windows x86‑64

4ff527e0d8fc36a99a491bc69a9cabeb055a4be470e22ec3da8e8bb741be9efc

).

File paths : /usr/local/bin/.uniFi-core, /usr/local/bin/.cache-mgr, /usr/local/bin/dbusd, /usr/local/bin/syslog-ng, /tmp/.cache-mgr.

Systemd services : uniFi-core.service, cache-mgr.service, S99dbusd.

Cron entries : @reboot /usr/local/bin/.uniFi-core, */10 * * * * wget … /beacon.

Windows registry key :

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\*\Debugger

pointing to agent_windows_amd64.exe.

Forensic Hunt Commands

# Linux – locate binaries and persistence artifacts
find /tmp /usr/local/bin -name ".cache-mgr" -o -name ".uniFi-core" -o -name "dbusd" 2>/dev/null
stat /tmp/.cache-mgr.log 2>/dev/null
systemctl status cache-mgr uniFi-core syslog-ng 2>/dev/null
crontab -l 2>/dev/null | grep -E "cache-mgr|uniFi|dbusd|beacon"
find /etc/systemd/system /etc/init.d -name "cache-mgr" -o -name "uniFi-core" -o -name "S99dbusd" 2>/dev/null
# Detect MemfdCreate usage (fileless execution)
ls -la /proc/*/fd/ 2>/dev/null | grep "memfd"
# WordPress admin audit
wp user list --role=administrator --fields=user_login,user_email 2>/dev/null | grep "wp2_\|wp2shell"