dreadnaught- Machine
- MetaTwo
- OS
- Linux
- Difficulty
- Easy
- Steps
- 4
- Added
- 29 Apr 2023
A plugin SQLi and a WordPress XXE leak chained credentials to a user; a cracked PassPie key gives the root password.
How it went
- 0nmap
An nmap scan shows FTP and a WordPress site at metapress.htb.
- 1BookingPress
The BookingPress plugin is vulnerable to SQL injection; dumping and cracking the hashes gives manager:partylikearockstar.
- 2media XXE
WordPress 5.6.2's media XXE reads wp-config.php and the nginx config, leaking database and FTP credentials.
- 3jnelson
An FTP-hosted PHPMailer config leaks jnelson's password for an SSH login and the user flag.
- 4PassPie
A PassPie PGP key in jnelson's home cracks with John, decrypting the stored root password for su.