HAwordy Medium box on Offensive Security Proving Grounds - OSCP Preparation.

Hello,

We are going to exploit one of OffSec Proving Grounds Medium machines which called HAwordy and this post is not a fully detailed walkthrough, I will just go through the important points during the exploit process.

Enumeration:

• Nmap:

• Using wpscan against wordpress running on port 80, path /wordpress:

• The Exploit:

• phtml file to upload:

• RCE:

Privilege Escalation:

• the wget binary on the system has the SUID bit:

• we can add our root user to the system by overwriting /etc/passwd file using wget:

  1. copying /etc/passwd file to our attack machine.

  2. creating new user named bingo with password pwned using openssl:

  3. adding the new user to the downloaded passwd file:

  4. uploading the new passwd file to the target machine and overwriting the remote /etc/passwd using wget:

Happy Hacking!