Do it.. More hacked, more I learn the pattern.. Script kiddie ? nah… I want face to face with real security expert..
Thanks for the free penetration test. The invoice is attached.
You didn’t “hack” anything. You ran a public proof-of-concept against an unpatched WordPress box, and you didn’t even bother to change its default settings.
- You used CVE-2026-63030 / CVE-2026-60137. A published exploit. Someone else wrote it. You copy-pasted it.
- You created admins named
wp2_*. That’s the PoC’s default prefix. You couldn’t even be bothered to rename your own bot. - You tried to drop
Rainbow.php. My server replied403and didn’t even slow down. - You came back a second time. Same script, same route, same result — except by then I’d already read your playbook, blocked it, and patched core to 6.9.5.
- Your IP addresses are in this post. You’re the case study now.
Come back when you have a zero-day you wrote yourself.
Scripts don’t impress me.
I build things. You run tools. That’s the whole difference — and you just made it public,
with your name on it: trenggalek6etar.
The site is still up. The content is still mine. Better luck next time.
Leaderboard of failed attempts
| Attacker IP | What you tried | Score |
|---|---|---|
93.123.109.101 | wp2shell ×2 | 0 / 2 |
103.168.147.235 | webshell upload | 403 |
138.226.240.158 | batch flood | patched out |
209.87.169.83 | shell scanning | 0 / 381 |