Proving Grounds BTRSys2.1- Walkthrough

Proving Grounds BTRSys2.1- Walkthrough

BOX RATING INTERMEDIATE
MY RATING VERY EASY
first look

the website look something like this so without ever thinking
i started scan with Dir search and it told me the website is using
WordPress .

NAMP SCAN REASULTS

anonymous ftp is enabled but found nothing

wp scan reasults found 2 users
user 1 btrisk
user 2 admin

trying to bruteforce lets hope it will work 😉

and indeed we hit it we got the login credentials of the room
and we logged in now lets see would we able to trigger the reverse shell or not

indeed i got the reverse shell and i injected the php code in the

comment section

and we get the reverse shell

and the first user flag is e9bbd768d73d1004378c14eb30b377fd

so i get the cred of root and the password from wp-config file
but i wont able to get the root by switching the root user
then i check the process and i found that mysql service is running
and boom we hit it

we are logged in with the creds

then i extract the root username and the password from the WordPress database using mysql

and the box is rooted

and the root flag is 74223b027920674462883a8a1239be8c

READ MORE ARTICLE HERE

Money Box Proving Grounds : Walkthrough

Gobuster Full Tutorial Step by Step

Recon-ng Tutorial for Beginners

About Author

Tahir

See author's posts