ThisIsSoEasy1
Enumeration
Nmap
We can start by enumerating the services after getting the IP address.
As we can see, there are few ports open such as 80, 22, 21
We can first put the IP at the browser since port 80 is open.
HTTP
Flight Details page
For the Wordpress we can see it redirects to a specific domain. What we can do is add the domain to our /etc/hosts.
Reload the page and we get this!
FTP
For the FTP, we can login using anonymous login. We then found out there is a secret folder available inside. Inside the secret folder there is a TODO.txt
cat the TODO.txt
Interesting.
After poking around for some time, I found out that the flightPage is actually a rabbit hole and it contains nothing interesting in it.
WPScan
We can see from the wpscan output, the users that detected by wpscan is administrator and jane.
We can navigate to /wp-admin to try to brute-force or login with default credentials.
Upon trying here and there, and also some hints we got from the TODO.txt, we got to log in to the WordPress admin dashboard with the username administrator and password admin
We can then navigate to Appearance -> Theme Editor
Navigate to 404 Template
Reverse Shell
We can replace it with PHP Reverse Shell
Choose the PHP PentestMonkey Reverse Shell.
Copy the contents and replace it to the 404 template
Update the file.
At our own Kali machine, set up a reverse shell listener
Navigate to this link
Got a reverse shell back!
User
Navigate to /var/www and we get the user flag.
Privilege Escalation
First thing we can do (before passing in any scripts) is by supplying sudo -l
we can see the user can execute env command by using sudo.
Got root right away!
Boom, flag! Congratz!
Last updated
Was this helpful?
