BTRSys2.1 Medium box on Offensive Security Proving Grounds - OSCP Preparation.

Hello,

We are going to exploit one of OffSec Proving Grounds Medium machines which called BTRSys2.1 and this post is not a fully detailed walkthrough, I will just go through the important points during the exploit process.

Enumeration:

• Nmap:

Getting Shell:

1. Wordpress running on port 80, you can login with Creds:
   • User: admin
   • Pass: admin

2. Edit the theme and add your payload to any writable php file:

3. Access the shell:

Privilege Escalation:

• Mysql Creds:

found in wp-config.php for wordpress:

/** MySQL database username */
define('DB_USER', 'root');

/** MySQL database password */
define('DB_PASSWORD', 'rootpassword!');

Enumerating Mysql:

• Databases:

  +--------------------+
  | Database           |
  +--------------------+
  | information_schema |
  | deneme             |
  | mysql              |
  | performance_schema |
  | phpmyadmin         |
  | sys                |
  | wordpress          |
  +--------------------+
  

• Explore wordpress DB:

  mysql> use wordpress;
  mysql> show tables;
  +----------------------------+
  | Tables_in_wordpress        |
  +----------------------------+
  | wp_abtest_experiments      |
  .
  .
  .
  | wp_usermeta                |
  | wp_users                   |
  +----------------------------+
  

• Getting password for btrisk user then getting root:

Happy Hacking!