BTRSys2.1 - Proving Grounds Play

Enumeration

Nmap

Initial nmap scan revealed HTTP, SSH and FTP ports were open.

The nmap showed FTP had anonymous session enabled. But the ftp did not have anything in it.

Web Enumeration

Website just showed a gif file.

The robots.txt file revealed wordpress endpoint.

Enumerating the wordpress endpoint with wpscan revealed two valid users.

Then brute forced the users and got a valid credential.

Exploitation

Wordpress Theme Editor

The user was administrator. So I could simply open wordpress theme editor and edit 404.php file as reverse shell.

Then all I need to do is setting up a reverse shell and visit /wp-content/themes//404.php endpoint.

Then visiting the home page of the btrisk user revealed user flag.

Privilege Escalation

WP Config

The wp-config.php file revealed a valid root password for the mysql database.

I used that password to login to mysql with the command ‘mysql -u root -p’ which prompts for password login. Then checking the wp_users table revealed hashed password of the root user.

Used crackstation to crack the hash of the root.

Then, tried it with ‘su root’ command and it worked. I simply got the root.

---

<

Previous Post

Seppuku - Proving Grounds Play

>

Next Post

Funbox - Proving Grounds Play