Loly Medium box on Offensive Security Proving Grounds - OSCP Preparation.

Hello,

We are going to exploit one of OffSec Proving Grounds Medium machines which called Loly and this post is not a fully detailed walkthrough, I will just go through the important points during the exploit process.

Enumeration:

• Nmap:

• Using wpscan against wordpress running on port 80:

  wpscan --rua --url http://loly.lc/wordpress/ -P /usr/share/wordlists/rockyou.txt
  

• We found a valid Credentials for wordpress:

Getting Shell:

1. First lets make a shell and zip it:

2. Uploading the shell:

3. Access the shell:

4. We got RCE:

Privilege Escalation:

• Creds on wp-config.php file:

/** MySQL database username */
define( 'DB_USER', 'wordpress' );

/** MySQL database password */
define( 'DB_PASSWORD', 'lolyisabeautifulgirl' );

• Switching to loly user using the password that we found on wp-config.php file:

Kernel Exploit:

• Enumeration:

• The Exploit:
  • https://packetstormsecurity.com/files/148517/Linux-Kernel-Local-Privilege-Escalation.html
• Getting root:

Happy Hacking!