Paper [Hack the box] [BLOG]

regular scan

When I was crawling the site manually it wasnt super match to look at

I wasnt able to navigate to the page but when I was running a curl command with flag -I

I was able to find the hostname through response header.

its exposed another url I I didnt found that one within gobuster.

so I added that local address

My first thought was oh its wordpress and it was =)

so I ran wpscan against the target

it was a old version of wordpress like usually there was many different exploits that could work

the exploit displayed posts in draft status.

I was able to find following entry:

so next thing was to add chat.office.paper as local domain to the hosts file:

then I was able to navigate to following page

then I was able to login to the page

there was bot in the channel that was allow to state info about the server

a sensitive file usually on servers are following path

so the username was clearly dwight for the ssh also the password was there as well.

then I just started a local webserver on my hostmachine also was adding privelege escalation shell

then uploaded to the victim

in quite early beginning I found following issue with an old dated sudo version

voila root =)