Vulnhub – Haclabs Deception Walkthrough

Scanning the host with dirbuster, the host running WordPress:

Now we run wpscan to enumerate users and vulnerable themes and plugs wpscan –url http://192.168.1.2/wordpress -e u

Running dirb with –X .txt found robots.txt

Nothing to see here lol,but ok looks like we have an .html pages too, using dirb again came with this:

Ok searching for API in the source of the home page i found these:

I tried each one as a password for login for phpmyadmin page and for wordpress page and for ssh service but didn’t work, till i gatherd them all as 5F4DCC3B5AA765D61D8327DEB882CF99 and then tried all and the ssh service worked for yash user:

I used the LinEnum.sh script and i got this back:

To become a root with this vulnerability we use this command python -c ‘import os; os.execl(“/bin/sh”, “sh”, “-p”)’

And then we access the root directory:

As you can see after grabbing the root flag i went back and got the other flag from the user haclabs 😀 guess i’ve made a deception but the lab started it first lol.