[Resolved] Starting Point SHIELD: Unable to load Metasploit wp_admin_shell_upload

Have you tried running the module itself after setting the parameters? (RHOST, USERNAME, PASSWORD, TARGETURI, LHOST?)

The “No payload configured, defaulting to php/meterpreter/reverse_tcp” occurs because you have the option to use your own/different payload with the module. The module (exploit/unix/webapp/admin/wp_admin_shell_upload) is an exploit that allows you to upload a reverse shell payload into Wordpress as a plugin. Thats what the module itself exploits and you have the choice of what payload it uses. If you do not provide a payload for it to use, it will default to the php/meterpreter/reverse_tcp payload (Which is okay to do).

Set RHOSTS to the IP of the attack target, USERNAME/PASSWORD you should know, TARGETURI to /wordpress and don’t forget to set LHOST to your local IP (tun0 in “ip a” command)

Then run the module and your netcat listener should catch the reverse shell.