I’ll have to look at the source for that plugin to figure out how to decrypt the information and get another user’s SSH key. From there, with access to the WordPress config, I’ll get the MySQL password which gives access to secrets stored via another WordPress plugin. With a shell, I’ll access an internal WordPress site exploiting the Brandfolder plugin to pivot to the next user. I’ll start by enumerating a website to eventually find a file upload page, where I’ll bypass filters to get a webshell. Moderators was a long box with a bunch of web enumerations, some source code analysis, and cracking multiple passwords for a VM. Htb-moderators hackthebox ctf nmap feroxbuster wfuzz fuzz crackstation filter burp burp-repeater upload webshell php-disable-functions wordpress wordpress-brandfolder wordpress-passwords-manager wordpress-plugin source-code crypto virtualbox virtualbox-encryption pyvboxdie-cracker hashcat luks chisel
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |