Overview

This project documents and demonstrates a common attack chain against a web application that includes external reconnaissance, application layer enumeration, credential discovery, privilege escalation through a vulnerable plugin, web shell deployment, host enumeration, lateral movement to a user account, and local privilege escalation to root. The write up focuses on evidence based actions taken, the security weaknesses exploited, and practical remediation advice that maps directly to production security controls.

The Challenge

The target was a small web facing service hosting a content management system. The high level objective was to determine whether a motivated attacker could move from initial access to full system compromise by leveraging weak authentication, vulnerable third party components, and weak host level hygiene. Specific goals were to obtain an interactive shell on the host, locate credentials or artifacts that enable further access, and demonstrate a path to escalate privileges to the operating system root account.

Tools used

1. Nmap for service and port discovery
2. WPScan for WordPress enumeration and credential testing
3. Burp Suite for request interception, replay, and file editing
4. SSH client for authenticated shell access to the host
5. Netcat for listener setup and interactive shell handling
6. linpeas for rapid host enumeration and discovery of privilege escalation vectors
7. pspy64 for cron activity discovery on the host
8. Local note taking and artifact collection for traceability and remediation evidence

The Execution

1. Initial network and service discovery

   I began with a top level scan to identify reachable services and gather version information. The scan revealed SSH and HTTP services and the presence of a web application. Evidence from the robots file and the web server responses strongly suggested a WordPress installation.

   nmap -A <target-ip>
   

   

2. WordPress fingerprinting and enumeration

   With the web application identified, I ran an application specific enumeration against WordPress to harvest usernames, version information, themes, and plugins. This provided the user accounts that became important for subsequent credential testing.

   wpscan --url http://<target-ip> -e u
   

   

   Identified the Wordpress verion as 5.3.2, the theme in used was online-portfolio , users found were jack, wendy and danny

3. Aggressive plugin detection to surface vulnerable components

   To identify known vulnerable third party components I invoked WPScan plugin detection in aggressive mode using my API token. The default passive detection did not reveal much so I used the higher sensitivity mode which identified an outdated installation of the User Role Editor plugin. This component became the primary escalation vector.

   wpscan --url http://<target-ip> --enumerate vp --api-token <your-token> --plugins-detection aggressive