Funbox Medium box on Offensive Security Proving Grounds - OSCP Preparation.

Hello,

We are going to exploit one of OffSec Proving Grounds Medium machines which called Funbox and this post is not a fully detailed walkthrough, I will just go through the important points during the exploit process.

Enumeration:

• Nmap:

• Enumerating users on Wordpress running on port 80 using wpscan:

  wpscan --url http://funbox.fritz.box/ -e u1-20
  

• Valid wordpress users:

• Dictionary attack on ssh using hydra:

Privilege Escalation:

• Checking funny user home directory:

  • As shown in the picture above the script .backup.sh is writable by anyone on the box and it keeps running doing backup to /var/www/html
• Exploit .backup.sh script:

  • Generating bash reverse shell payload:

  • Injecting the payload to .backup.sh script:

• Wainting for a few minutes and boom!:

Happy Hacking!